Terms of service

Who these terms are between

These terms are between Backtracking Limited, a company registered in England and Wales, company number 17083080, registered office 82a James Carter Road, Mildenhall, IP28 7DE ("we", "us"), and the company that signs up to use the service ("you"). Where a person accepts these terms on behalf of a company, they confirm they are authorised to do so, and "you" means that company.

Settledge is sold business to business. It is a bookkeeping and bank-reconciliation tool for UK limited companies and the accountants who work with them. It is not offered to consumers, and the consumer rights that apply to a purchase made outside a business do not apply to it. Nothing in these terms limits a right that cannot lawfully be limited.

These terms, the privacy policy and the data-processing terms below are the whole agreement between us about the service.

What the service does

The service lets you record expenses and receipts, import and categorise bank transactions, match them against your records, keep ledgers, produce a flat-rate VAT figure for a quarter, and export your data for an accountant.

Settledge is a record-keeping tool, not an accountant and not a tax adviser. The figures it produces are computed from the records you give it and the settings you choose. Checking a return before it is filed, and filing it, remain yours and your accountant's. Nothing the service displays is advice.

The service is provided as it stands and as it is available. We do not promise that it will be free of faults or available without interruption. During the pilot there is no availability commitment and no service-level agreement: we run the service on a best-effort basis.

AI features

Some features use an AI model: reading an uploaded receipt or document, suggesting a category or a match for a bank line, and answering questions about your books. The company's owner chooses the level. At Restricted only uploaded files and the questions asked about documents go to the AI provider. At Full, bank-line descriptions, amounts and dates also go, for categories and match suggestions, along with summary tables of the books, for answers. Account numbers, IBANs, balances and raw bank payloads are never sent at either level. What each level sends, and where it is processed, is in the privacy policy.

AI output can be wrong. Treat a suggestion as a draft: a person on your side confirms it before it becomes part of your records, and the records stay your responsibility. The AI features are pilot software, so they may change or be withdrawn. We will tell you by email at least 30 days before an AI feature changes or is withdrawn, except where a security reason or a change by the AI provider leaves no time for that.

Your account

You need an account to use the service, and a company inside it. You are responsible for who you invite into your company and for the role you give them: a role decides what that person can do with your records.

Two-step sign-in is required. Once you have set it up, every screen that shows your company's records sits behind it: your password alone will not open one. A short list of screens is deliberately outside it, because they are the ones you need before you have a second factor or when you have lost access to it — setting up, changing and turning off two-step sign-in, adding, renaming and removing a passkey, viewing, downloading and regenerating your recovery codes, entering your code or using your passkey to prove it is you, signing out your trusted devices, changing your password, creating your company, accepting an invitation, deleting your account, and signing out.

Being outside the second step does not leave them unguarded, and they do not all guard themselves the same way. Changing your password asks for your current password on the same form, every time. Turning two-step sign-in on or off, viewing, downloading or regenerating your recovery codes, adding, renaming or removing a passkey, and deleting your account ask you to confirm it is you unless you signed in within the last few minutes: your password again, or a second-step code when this session skipped that step on a trusted device. Entering that code, and confirming with your passkey, are the proof itself, so nothing is asked in front of them. The rest — your two-step settings screen, signing out your trusted devices, creating your company, accepting an invitation and signing out — ask for no further proof. That is every screen on the list above.

Keep your second factor and your recovery codes somewhere you can reach without your phone. An account with no way to complete the second step cannot be recovered from inside the app. Our platform operator can remove a second factor from the administration console described below, which puts the account back within reach of its password; whether we will do that, for whom, and after what identity checks is set out here. The route is by email to the contact address above, and we check the request against your company's registered details before it removes anything.

Keep your password to yourself, and tell us at the contact address above if you think somebody else has used your account.

What you may not do

Do not use the service to break the law, to store somebody else's records without the right to do so, to attack or probe the service or the systems it runs on, or to resell access to it.

Use the service for your own company's bookkeeping only. There is no resale or white-labelling of the service, except under an accountant practice plan: an accountant may add client companies to their subscription, and each client company accepts these terms itself. Do not scrape the service by automated means. Fair-use limits apply, to the AI features in particular, and they may change; a change that lowers a limit gets 30 days by email.

We may suspend an account that is being used this way, and will say why. We give 14 days' notice before suspending, except that we may suspend immediately for security, abuse or non-payment. We may suspend the AI features for an account that abuses them, without suspending the rest of the account.

Fees

The service costs £24 a month for each company, including VAT at the standard rate. Your first 30 days are free, counted from the day your company is created, and no payment details are taken until you choose to subscribe. After that the fee is charged monthly in advance to the payment method you provide. Payments are collected by Stripe, our payment processor; your card details never reach our servers. Each payment produces a VAT invoice that you can download from Stripe's billing page, which the billing screen opens for you.

If a payment fails, Stripe emails you and retries for up to 14 days, and a notice appears on every screen of the company. Nothing changes during that time. If the payment is still unpaid after that, your company's books become read-only: everyone who can sign in can still see its records, people allowed to export can still export, and owners and admins can still reach Billing to pay, but nothing can be added or changed until payment is made. We never delete your records because of non-payment; the retention rules in the privacy policy apply unchanged.

We may change the price. We will tell you by email at least 30 days before a new price applies, and you may cancel before it does.

Some accounting firms have an agreement with us under which the firm adds its own clients, those clients get no bill of their own, and we bill the firm at a discount to the monthly price for each client. That is an arrangement made with the firm directly; it does not change what a company that pays for itself is charged.

This section is to be confirmed before launch: a solicitor reviews it before the first payment is taken on 1 January 2027.

Your data

Your records are yours. We do not sell them, do not use them to train a model, and do not share them with anyone except the sub-processors named below, the people you invite into your company, and where the law requires it.

You can export everything you have put in, in an open format, while your account exists. You can ask for your account to be deleted from the "Delete your account" screen. Some records cannot be deleted on request: bank transactions and their source payloads, receipts, invoices, expenses, documents, ledger entries and matches are VAT records and are kept for at least six years. The privacy policy explains this in full.

Ending these terms

You can cancel at any time from the billing screen, which opens Stripe's billing page. Cancellation takes effect at the end of the month you have paid for, and no refund is made for the rest of that month. Afterwards your company's books stay read-only and exportable for at least six years from your last record, in line with the retention rules in the privacy policy.

We may end these terms if you break them and do not put it right within 14 days of being asked.

Liability

Our total liability to you for anything arising from the service or these terms, in contract, tort (including negligence) or otherwise, is limited to the fees you paid in the 12 months before the claim arose. We are not liable for indirect or consequential loss, or for lost profits. Neither of us excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.

Changes to these terms

These terms carry a version and a date, both shown at the top of this page. A material change bumps the version. We give 30 days' notice of a changed version by email before it takes effect. If you carry on using the service after that, you accept the changed version; you may cancel instead. The version you accepted is recorded against your account when you accept an invitation or create an account.

Version 1.1, 2026-11-09: Product renamed to Settledge; no change to what we do with your data.

Governing law

These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute about them. Before going to court, send a written complaint to the contact address above; we have 30 days to resolve it.

Data-processing terms

This section applies where we process personal data on your behalf. It forms part of these terms and is the data-processing agreement between us.

Roles

For your own company's records — your expenses, your bank transactions, your invoices, the people you invite — you are the controller and we are the processor. For the account itself (the email address, the password, the two-step sign-in) and for our own correspondence with you, we are the controller. The privacy policy sets out both hats.

What is processed, and why

We process this data only to run the service, and on your instructions: using the service is the instruction. Where the law requires processing for another reason, we will tell you unless the law forbids it. Everyone at Backtracking Limited with access to the data is under a duty of confidence.

Platform-operator access

Our platform operator can open a customer's company without being a member of it, for example to give you support. The visit is recorded for us only. Every such request that reaches a screen inside your company is recorded on our side, with the account, the company, the time, the HTTP method, the screen reached and the permission checked — and nothing else: no company name, no email address, no address bar contents, and nothing you have typed.

This is the same class of disclosure as an export of your data. The record is not shown in the app and no notification is sent. If you ask at the contact address above, the question "was an operator in my company, and when" can be answered from that record, within the limits set out below. We answer such a question within 30 days, to the company's owner.

Our own administration console is outside that record. It is a separate set of screens, reached with the deployment's own staff credentials and behind the same two-step sign-in as the rest of the service, and it is not inside any one company — so a request to it writes no record of the kind above, unless that same session already had one of your screens open.

The console keeps its own record of changes made there, and a different one. Each time an operator adds, changes or deletes a row there, the console's own log stores which operator did it, what they did, when, and a text label for the row touched. That label is not anonymous: for a membership it is the account's email address, your company's name and the role — so this record carries more about you than the one above, not less. Like the record above, it is not shown in the app and no notification is sent. It is kept for 6 years, the same as the statutory VAT records.

That record covers changes, not reading. An operator who only opens a list in the console — your bank lines, your receipts, your people, your accounts — makes no entry in that log: it records additions, changes and deletions only. Whether anything is written at all then turns on the same session rule as above: if the session had already opened one of your screens, every console request it makes writes a record of the first kind, reads included; if it had not, nothing is written anywhere. So "was an operator in my company, and when" can be answered for visits to your own screens, for changes made in the console, and for a console read in a session that had already been inside your company — and it cannot be answered for a console read in a session that never was.

An operator visiting a company they are not a member of cannot change a member's role, cannot remove a member and cannot invite anyone from the company screens themselves: those screens refuse it.

That limit belongs to the company screens, not to the platform. From the administration console named above, an operator holding the deployment's staff credentials can add a membership to your company — including an owner membership for themselves — can remove one, and can delete a person's second factor. That route exists so that a company which has locked itself out can be repaired, and it is not reachable from any customer-facing screen; we use it against a customer's company only to repair a locked-out company at its owner's request, or where the law requires it. The company's owner is told within 5 working days, unless the law forbids it.

Nothing in the software limits when an operator may do this: the check reads whether the account is a platform operator and nothing else. There is no support-request trigger, no per-visit approval and no time limit built into the product, so any such limit is an undertaking given here rather than a control the software enforces — and the undertaking is this: a platform operator enters a customer's company only at a member's written support request, or to meet a legal obligation.

The record is kept for as long as the application logs it sits in, which is 90 days, the figure in section 6 of the privacy policy.

Sub-processors

You agree to us using these sub-processors.

Where each one is located and what each one receives is in the privacy policy's sub-processor table, which is the maintained list. This table names the same processors and no others. A new sub-processor is added to the privacy policy's list before it is used. We tell you by email 30 days before it starts, and you may object by cancelling.

Security and personal data breaches

We keep the technical and organisational measures set out in our security policy: encryption in transit, two-step sign-in in front of every screen that shows your records, role-based access inside a company, short-lived signed links for files, and rate limits on the sign-in routes.

Files in object storage are encrypted at rest by the storage provider named in the table above. The database sits on an encrypted DigitalOcean Volume (London), and the application adds no encryption of its own to the fields inside it.

If there is a personal data breach affecting your data, we will tell you without undue delay and within 48 hours of becoming aware of it, so that you can meet the ICO's 72 hours, and will give you what you need to meet your own reporting duties. We will help you answer a request from one of your own data subjects, and will help with a data protection impact assessment, so far as the service makes that possible.

You may audit this. We answer a written security questionnaire once a year at no cost; anything more is at your cost, on 30 days' notice.

The record of your acceptance

When you create an account or accept an invitation, we record which version of the privacy policy and which version of these terms you accepted, against your account, with the moment you accepted them. Each acceptance writes one record per document. Accepting again — on a second invitation, say — writes another record for each document rather than replacing the first.

That record is not deleted when the rest of your account data is. It is the evidence of what was agreed, so it is kept for at least six years — the same period as the VAT records described above. It is not shown to you anywhere in the app.

At the end

When your account is deleted, we delete or return the personal data we hold as a processor, except where we must keep it — the six-year VAT records named in the privacy policy, which are kept and not used for anything else.