Privacy Policy

1. Who this applies to

This policy covers the Ledger application: an account holder (the "operator") uploads bank statements — either their own, or on behalf of clients they represent as a bookkeeper — and the app extracts, categorizes, and stores the resulting financial data. If you're an operator's client, your financial data may be processed here by the operator, not by you directly — see the Data Processing Agreement for how that relationship is meant to work.

2. What data is collected

• Account details: name, email address, hashed password
• Bank statement content: transaction dates, descriptions, amounts, categories, running balances
• Account holder details as printed on statements: name, address, sort code, account number, IBAN, bank name
• The original uploaded file itself (PDF or photo)
• API keys and webhook configuration, if used
• Standard server logs (IP address, timestamps) — used for rate limiting and troubleshooting, not analytics or tracking

3. Why this data is processed

To provide the service you've asked for: extracting and organizing your bank statement data, so it doesn't need to be entered by hand. The legal basis is performance of a contract (providing the service you've signed up for) and, for security measures like rate limiting, legitimate interest in keeping the service available and safe to use.

4. Who else sees this data

Anthropic (the provider of the Claude AI model) processes the text and images of uploaded statements as part of extracting structured data from them — this is a genuine sub-processor relationship, and statement content is sent to Anthropic's API for this purpose. No other third party receives your data. There's no advertising, analytics, or tracking integration in this app.

5. How it's protected

Account numbers, IBANs, sort codes, account holder names/addresses, and the original uploaded file are encrypted at rest (AES-256-GCM). The application runs over HTTPS. Passwords and API keys are hashed, never stored in plain text. This is a self-hosted deployment — data isn't held by a third-party cloud provider, but equally isn't backed by a certified, independently-audited infrastructure provider either. See the FAQ for a fuller, honest comparison of what this does and doesn't guarantee.

6. How long data is kept

By default, statements are kept indefinitely, for ongoing bookkeeping and record-keeping purposes. Account holders can set a specific retention period (e.g. 12, 24, 36, or 60 months) in Account & Privacy settings, after which older statements are deleted automatically. Deleting your account deletes everything associated with it immediately.

7. Your rights

You can export a full copy of your data at any time (Account & Privacy → "Download all my data"), correct inaccurate data directly in the app, and delete your account and everything under it permanently (Account & Privacy → "Delete my account"). If your data is held by an operator on your behalf as a client — rather than by you directly — these requests should go to that operator, who controls the account.

8. Data breaches

[Placeholder: describe your actual breach notification process here — who is responsible for detecting and reporting a breach, and the timeframe for notifying affected individuals and, where required, the ICO within 72 hours.]

9. Contact

[Placeholder: add a real contact method — email address or postal address — for data protection queries and requests.]