1 Who we are
Settledge is a bookkeeping and bank-reconciliation application for UK small companies. It is provided by Backtracking Limited, a company registered in England and Wales, company number 17083080, registered office 82a James Carter Road, Mildenhall, IP28 7DE.
We are a single-founder company; there is no data protection officer and we are not required to appoint one. We are registered with the Information Commissioner's Office (ICO), registration number ZC292915. For anything here, write to hello@backtrackingltd.com.
2 Controller and processor — which hat we wear
- We are the controller for the data we decide the purposes of ourselves: your account (email address, password, two-step sign-in), the company details you give us when you sign up, our own correspondence with you, and our own company's books.
- We are a processor for the bookkeeping data you put into the app about your business — expenses, receipts, invoices, documents, bank transactions and the ledgers built from them. Your company is the controller of that data; we hold and process it only on your company's instructions, as set out in this policy and your contract with us. We do not use it for our own purposes, sell it, or train AI models on it.
- Where those records contain personal data about other people — a customer named on an invoice, a counterparty on a bank line, a supplier contact — your company is the controller of that too, and is responsible for telling those people how their data is used.
- Your accountant is a separate, independent controller for their own professional and legal obligations once you send them an export.
Before we take on any client company we sign a written data processing agreement covering that processor role.
3 What we collect
Account and sign-in. Your email address, an optional full name, a hashed password (never the password itself), whether you have verified your email, your two-step sign-in setup (an authenticator secret and single-use recovery codes), sign-in sessions, and records of browsers you asked us to remember — a device label derived from your browser's user agent, and a hashed token.
Company details. Company name, company number, VAT number, VAT scheme and registration date, financial year and VAT quarter settings, and who is a member of the company.
Early list. If you join the early list on our website, we receive your email address, your company name if you give one, and the ad campaign you came from (the UTM source, medium, campaign, content and term in the link you clicked). We use the campaign details only to count which ads work, and the email and company name once, to tell you when sign-up is open. They stay in our mailbox until then, and we delete them on request: write to hello@backtrackingltd.com.
Bookkeeping records you create or upload. Expenses (date, amount, VAT, supplier, category, notes, capital asset flag), receipt images and PDFs, invoices and credit notes (including your customer's name and address), uploaded documents, ledger entries, matches between expenses and bank lines, and reports and exports.
Receipts sent by email. Each company can have a secret address to email receipts to. Attachments sent from a member's verified address are stored as receipts against that member, under the same rules as an upload. We check the sender's address against your members and do not store it. The subject and body of the email are not stored.
Bank transactions. Today these reach us only when you import a statement file yourself. We store the date, amount, currency, description and counterparty name, plus the complete source row exactly as it arrived, so your records stay faithful to the bank's own. Imported rows are never edited or deleted; corrections are new rows.
Bank connections. Bank lines arrive by CSV import only today. A regulated provider will be named here before any direct connection is offered.
When you connect to HMRC: the VAT return figures you choose to send; and, as HMRC requires of all software, details of the device and browser you send them from (device identifier, IP address and port, screen size, time zone, user agent) and when you last passed two-step sign-in. We store the connection tokens encrypted; we never store your Government Gateway credentials.
Usage and technical logs. Sign-in events, error records and operational logs — record identifiers, outcome codes, counts and timings. Raw bank payloads, account numbers, IBANs, sort codes and counterparty names are never written to a log, by design and enforced by automated tests. We do not collect data about you from third-party sources, build profiles, or make automated decisions with legal effects.
4 Why we use it, and our lawful bases
| What we do | Lawful basis |
|---|---|
| Run your account, provide the app, support you | Contract — necessary to perform our agreement with you |
| Keep the service secure: two-step sign-in, rate limiting, fraud and abuse prevention, logs | Legitimate interests — keeping a financial application safe for the people who use it |
| Fix faults, improve reliability, understand aggregate usage | Legitimate interests — running and improving a service you rely on |
| Read a receipt image with an AI provider to pre-fill an expense (optional, off unless enabled) | Contract — a feature you have chosen to use |
| Keep VAT and accounting records for the statutory period | Legal obligation — HMRC record-keeping requirements |
| Send VAT returns and the device details HMRC requires | Legal obligation — VAT Regulations and HMRC’s fraud-prevention requirement |
| Send service emails (verification, password reset, digests) | Contract; legitimate interests for service notices |
Early signup requests. If you ask to hear about early signup on the Flat Rate Scheme checker, the email address you give, the checker answers and the time are sent to our mailbox at hello@backtrackingltd.com. They are used only to email you about early signup and to send the VAT quarter checklist you asked for, on the basis of your consent, and kept until you withdraw (reply to any email) or the early signup offer ends. We do not run advertising.
5 Who else processes your data (sub-processors)
| Processor | Purpose | Location | What it receives |
|---|---|---|---|
| DigitalOcean (hosting) | Application server and Redis on a droplet, PostgreSQL on an encrypted DigitalOcean Volume | London, UK | All application data |
| DigitalOcean Spaces (object storage) | Receipt, document, export and backup file storage | London, UK | Receipt, document and export files, and backups |
| Postmark (service email) | Sending service email | US | Your email address and the email's content |
| Stripe (payments) | Taking the monthly subscription payment and issuing its VAT invoice | Stripe's own infrastructure; not a UK-only processor | Your email address, your company's name and billing details, your card details (entered on Stripe's page, never on ours) and the payment history. No bookkeeping records and no bank data. We keep only Stripe's reference numbers, the subscription's status and its period end |
| Anthropic | Reading a receipt, invoice or document you upload, to pre-fill an expense or suggest a document's category; and, only at the Full level, suggesting categories and matches for bank lines and answering questions about your books (optional; off unless enabled) | US | Restricted level: The file you uploaded (an image or PDF), the questions you ask about documents, and a fixed prompt; no bank transactions at all. Bank statements and payslips that carry a text layer are recognised on our servers and never sent; a photo or scan of one that you upload can't be recognised and may be read. Full level adds, for each bank line you ask about, only a local reference number, the description and counterparty name exactly as they appear on the statement (so they can contain a person's or business's name, and any reference or account number printed in the description), the signed amount and the date; and, to answer questions about your books, period totals, category totals and counts, never individual bank lines. Never the account numbers, IBANs or balances we hold, or raw bank payloads, at either level. A document you choose to upload, such as a certificate or contract, may be read. Anthropic's own commercial terms set how long it keeps API traffic and whether it may train on it; we have agreed nothing that lets it use your files for training, and we will update this row if its terms change. |
| Google Workspace | Our company email; correspondence with you; not used for service email | US-headquartered, EU/UK data regions | Anything you send us by email; service email addressed to you |
| GitHub | Source code, issue tracking, CI | US | No customer data and no bank data |
| Your accountant (if you use one) | Preparing your accounts and returns | UK | The exports you choose to send |
Other AI providers (OpenAI, Google, a locally run model) are supported by the code but inert: with no provider named and no key configured, nothing leaves our servers. We will not enable a new processor without written terms, and will update this list first.
6 How long we keep things
Company-law records — the register of members and dividend decisions — are kept for at least 10 years; register entries are kept for 10 years after a member leaves. The decision records and dividend vouchers stored as documents are among them: ten years, not the six that other documents get.
- VAT and accounting records — 6 years. Bank transactions and their source payloads, receipts, invoices and expense records are VAT records, kept for at least six years from the end of the relevant accounting period as HMRC requires. We do not delete them on request within that period (see section 8).
- HMRC connection tokens — held while connected; overwritten on disconnect or key rotation. The connection record (who, when) is kept with the company's VAT records for 6 years.
- Account data — kept while your account exists, deleted within 30 days of a deletion request, apart from records held under the six-year rule above.
- Uploaded files never attached to anything — swept and deleted 24 hours after upload.
- Prepared "export everything" archives — deleted 7 days after production; the record of the export is kept, including who prepared it and who has downloaded it.
- Application logs — retained for 90 days, enforced by log rotation on our server.
- Administration console log — kept for 6 years, the same as the statutory records.
- Salary records — 6 years after the tax year they belong to, the same as the statutory company records.
- Backups — Nightly database backups are kept in London for 14 days, then deleted.
- Sessions and trusted devices — expired sessions are removed automatically, and a retired trusted-device
row (revoked, or expired) is deleted 30 days after that revocation or expiry. See
docs/security-policy.md§10 for the retention register (privacy/retention.py) that enforces every period on this page in code.
7 How we protect it
Access to your data is restricted to your own company by design and enforced automatically in our test suite;
files are private and served only through links expiring in five minutes; traffic is encrypted in transit; files in object storage are encrypted at rest and the database sits on an encrypted DigitalOcean Volume (London); sign-in is protected by mandatory email verification, password rules,
rate limiting and app-based two-step verification; raw bank payloads, account numbers, IBANs and balances are
never logged or sent to an AI provider, and the AI levels in section 5 set exactly what is sent; and every code
change is reviewed and tested before release. Our Information Security Policy
(docs/security-policy.md) sets out these controls, those still planned, and how we respond to incidents,
including notifying the ICO within 72 hours of a reportable breach.
8 Your rights
Under UK GDPR you can ask us to:
- Access the personal data we hold about you and get a copy, and correct anything inaccurate.
- Delete your data ("erasure"), within 30 days — except where a record must be kept as a VAT or accounting record for six years; we then keep it, use it for nothing else, and tell you which records and why. In the app: Security → Delete your account shows you exactly what goes and what stays, and starts a seven-day period in which you can change your mind; after it, the account is deleted automatically — your email address, name, password, sign-in methods, remembered devices and company memberships are removed, and records you created stop naming you. A request sent by email is recorded the same way, with the same seven days. What stays, per company, because it is a VAT record: bank transactions and their source payloads, expenses, receipts, invoices and credit notes, documents, ledger entries and matches. If you were a company's only member, nobody will be able to sign in to it afterwards; its records still stay.
- Take your data with you — the app's "export everything" feature produces your records in open, machine-readable formats; ask if you need help using it.
- Restrict or object to processing based on our legitimate interests, and withdraw consent for a bank connection at any time, without affecting anything done before you withdrew it.
Write to hello@backtrackingltd.com; we respond within one month. If you use a client company's account, we will normally pass your request to that company, since they control their own bookkeeping data. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you told us first so we can put it right.
9 International transfers
Data is held in the UK or the European Economic Area wherever we can arrange it, but several processors are US-headquartered (section 5). Where personal data goes outside the UK we rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, alongside the provider's own safeguards. Anthropic's agreement is in place, as described below. For the other processors in section 5 we have not yet recorded an executed transfer agreement, and we will not describe one as in place until we have.
Anthropic reads what section 5 lists when you turn an AI level on, and does so in the United States. Anthropic Ireland, Limited processes this data as our processor under Anthropic's Data Processing Addendum, which forms part of its Commercial Terms. Where the data leaves the UK, the transfer is covered by the EU Standard Contractual Clauses with the UK International Data Transfer Addendum (ICO template B.1.0), incorporated by that addendum's Schedule 3. Anthropic's sub-processors are listed at anthropic.com/subprocessors. This applies to the Restricted and Full levels alike.
10 Cookies
We use only the cookies the app needs to work:
- a session cookie, so you stay signed in;
- a CSRF token cookie, which protects forms against cross-site request forgery;
- an optional trusted-device cookie, set only if you tick "remember this device" at two-step sign-in;
- a menu cookie, set when you collapse or expand the left menu, so it stays the way you left it.
There are no analytics, advertising or tracking cookies, no third-party trackers and no cookie banner, because none of these cookies needs consent. Your browser can block or clear them; the app will simply ask you to sign in again.
11 Changes to this policy
We update this policy when what we do changes — a new sub-processor, a feature that handles data differently, or a change in the law. The version and date are at the top; the full history is in our source repository. If a change materially affects you we will tell you by email before it takes effect.
Version 1.1, 2026-11-09: Product renamed to Settledge; no change to what we do with your data.
Version 1.2, 2026-11-09: Lists the menu cookie that remembers whether you collapsed the left menu; no change to what we do with your data.