Privacy Notice

Fiona Barad(“EasyAcco”, “we”) is the data controller for the personal data described here. EasyAcco is independent software, operated by a sole trader in the United Kingdom.

For any question about this notice, to exercise the rights set out below, or to request a postal address for correspondence, contact baradfiona14@gmail.com. We respond to rights requests within one month, as UK GDPR requires.

• Account data — your email address, and an account identifier. Collected when you sign up.
• Financial records you enter — transactions, expenses, invoices, mileage journeys and the figures you type into the tax tools. This is the substance of the service.
• Tax identifiers — where you use the Making Tax Digital features, your National Insurance number and/or VAT registration number, entered by you for the purpose of filing.
• Device and connection data— where you submit to HMRC, HMRC’s Fraud Prevention Headers specification obliges us to send them your public IP address, device identifier, screen dimensions, window size, timezone and browser user-agent string. This is a legal requirement of using their API; we cannot file without it.
• Payslip images you upload — where you use the Payslip Reader, the photo or scan you choose to upload, which typically shows your employer, gross pay, tax and National Insurance deducted, and your tax code. It is sent to our server, read once to pull those figures out, and discarded. We do not store the image, and the figures it produces are shown to you rather than saved anywhere.
• Change history — an audit log of creates, updates and deletions against your records, so that changes to accounting data are traceable.

EasyAcco embeds no analytics SDKs, tracking pixels, advertising networks or behavioural profiling of any kind. There is nothing to opt out of because there is nothing running.

The only browser storage we use is strictly necessary: a session cookie to keep you signed in, an encrypted IndexedDB store holding your own records on your own device, and — where you have connected HMRC — an encrypted, HttpOnly cookie holding your HMRC access tokens. Under PECR reg. 6(4) strictly necessary storage does not require consent, which is why you are not asked for any.

We do not sell personal data, and we do not share it for anyone else’s marketing. The only recipients are the processors below, each used solely to deliver the service:

EasyAcco has no AI features enabled and sends nothing to any AI provider.

The two features that read images work differently, and it matters which is which. Receipt scanningreads the photo entirely inside your browser — it never reaches a server of ours or anyone else’s. The Payslip Reader does upload: the image is sent to our server, where it is read once to extract the figures and then discarded. It is not written to a database, kept on disk, or recorded in a log, and it is not passed to anyone else. Our servers run on Vercel, so the image passes through their infrastructure for the few seconds it is being read.

The currency converter calls an external exchange-rate service. That request asks only for public rates and carries none of your data.

• Contract (Art. 6(1)(b)) — holding and processing the records you enter, so we can provide the service you signed up for.
• Legal obligation (Art. 6(1)(c)) — sending the Fraud Prevention Headers HMRC mandates for API filing.
• Legitimate interests (Art. 6(1)(f)) — keeping the audit log and applying rate limits, so accounting changes are traceable and the service is not abused. We have balanced this against your interests and consider the impact minimal.

Records stay while your account is open. Delete your account and we erase the associated records; note that anything already filed with HMRC is held by HMRC under their own retention rules and cannot be withdrawn by us. Records held only on your device are removed when you clear the site’s data in your browser.

You have the right to access your data, correct it, erase it, restrict or object to its processing, and to receive it in a portable form. The Settings page includes an export that produces your complete records as a file, so portability does not require you to ask us.

If you believe we have handled your data improperly you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you raised it with us first so we can put it right.

Records held on your device are encrypted with AES-GCM. HMRC tokens are held in encrypted, HttpOnly cookies that JavaScript cannot read. Cloud records are protected by row-level security policies so one account cannot read another’s. There is more detail on the security page.