Privacy Policy

Pivitax ("we", "us", "our") operates the web application available at https://pivitax.com. Pivitax is an expense and receipt tracker for UK sole traders and freelancers.

This Privacy Policy explains what personal data we collect when you use Pivitax, why we collect it, how we use and protect it, who we share it with, and what rights you have under UK data protection law — principally the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By creating an account or using our web app, you confirm that you have read and understood this policy. If you do not agree, please do not use the service.

Data controller: Pivitax — info@pivitax.com

1. Data We Collect

We collect the following categories of personal data when you use Pivitax:

1.1 Account & Identity Data

• Your name and email address, provided when you register
• Password (stored in hashed form — we never store your plain-text password)
• Account preferences and settings

1.2 Financial & Expense Data

• Expense records you create, including amounts, categories, dates, and descriptions
• Receipt images and documents you upload
• Tax-related information you input (such as income figures or business categories)
• Bank transaction data, where you choose to connect a bank account via our Full plan (see section 6)

1.3 Subscription & Billing Data

• Your chosen subscription plan and billing cadence
• Payment method details (processed and stored by Paddle — we do not store your full card number)
• Transaction history and invoices
• Billing address, if provided

1.4 Technical & Usage Data

• IP address and device/browser information
• Log data generated when you access or use the web app (collected via Vercel hosting)
• Pages visited, features used, and session duration
• Error reports and diagnostic data

1.5 Communications Data

• Emails we send you (delivered via Resend), including account confirmations, receipts, and service notifications
• Any messages you send to us directly (for example, via our contact email)

1.6 Receipt & Document Content

• Text extracted from receipt photos you upload, which is processed by AI services to identify expense details
• Document content submitted for tax report generation or complex document analysis

2. How We Use Your Data

We use your personal data for the following purposes:

• 2.1 To provide the Pivitax service — creating and managing your account, storing your expenses and receipts, generating tax summaries and reports, and enabling bank connection features on the Full plan.
• 2.2 To process AI-assisted features — sending receipt images, extracted text, and document content to Anthropic (Claude) for automated expense categorisation, tax report generation, and document analysis.
• 2.3 To manage your subscription and billing — processing payments, issuing invoices, managing plan upgrades or downgrades, and handling billing queries via Paddle.
• 2.4 To connect your bank account — where you opt in to the Full plan, passing your bank connection through TrueLayer to retrieve transaction data for import into your expense records.
• 2.5 To communicate with you — sending transactional emails (such as account confirmations, password resets, subscription receipts, and important service updates) via Resend.
• 2.6 To maintain and improve the service — analysing usage patterns (using aggregated, anonymised data where possible), debugging errors, and improving features.
• 2.7 To comply with legal obligations — retaining records as required by UK tax and financial regulations, and responding to lawful requests from regulatory or law-enforcement authorities.
• 2.8 To protect security — detecting and preventing fraud, abuse, or unauthorised access to your account.

3. Legal Bases for Processing (UK GDPR Article 6)

We process your personal data only where we have a valid legal basis:

• 3.1 Contract (Article 6(1)(b)) — Processing necessary to perform our contract with you: storing your expenses and receipts, processing subscription payments, enabling bank connections on the Full plan, and sending essential service communications.
• 3.2 Legitimate interests (Article 6(1)(f)) — Analysing usage to improve the service, maintaining security and fraud prevention, and hosting/logging activity via Vercel.
• 3.3 Legal obligation (Article 6(1)(c)) — Processing required to comply with UK law, including financial record-keeping obligations and responding to lawful authority requests.
• 3.4 Consent (Article 6(1)(a)) — Where we ask for your consent to a specific use (for example, optional marketing communications). You may withdraw consent at any time by contacting us at info@pivitax.com.

4. Cookies & Tracking

• 4.1 Strictly necessary cookies — Required for the web app to function. They keep you logged in, maintain your session, and protect against cross-site request forgery. You cannot opt out of these without stopping your use of Pivitax.
• 4.2 Analytics and performance cookies — We may use cookies or server-side logging (via Vercel) to understand how the app is used, identify errors, and improve performance. Where possible, this data is aggregated and anonymised.
• 4.3 Third-party scripts — Paddle may set cookies on payment-related pages for fraud prevention and security purposes. These are governed by Paddle's own privacy policy.
• 4.4 Cookie consent — For cookies that are not strictly necessary, we will ask for your consent when you first access the app. See our Cookie Policy for full details.

5. Sharing & Third Parties

We share your personal data only with the third-party service providers listed below, and only to the extent necessary to operate Pivitax. We do not sell your personal data. We do not share it for third-party advertising.

5.1 All processors are required by contract to process your data only on our documented instructions and to maintain appropriate technical and organisational security measures.

5.2 We may disclose your personal data to law enforcement, regulators, or courts where required to do so by law, or where necessary to protect the rights, property, or safety of Pivitax, our users, or others.

5.3 If Pivitax is acquired by or merged with another business, your personal data may be transferred to the new owner. We will notify you before any such transfer takes effect.

6. International Transfers

Some of our third-party processors operate servers or infrastructure outside the United Kingdom. Where your personal data is transferred outside the UK, we ensure appropriate safeguards are in place:

• Supabase — EU and US infrastructure, covered by UK IDTA or UK Addendum to EU SCCs.
• Anthropic (Claude) — US-based, transfers under appropriate contractual safeguards including UK Addendum to EU SCCs.
• Paddle — Operates globally, covered by Paddle's UK GDPR-compliant data processing agreements and SCCs.
• TrueLayer — UK-based, regulated by the FCA. Data primarily processed within the UK and EEA.
• Resend — US-based, covered by appropriate contractual safeguards.
• Vercel — Operates globally, covered by Vercel's data processing addendum incorporating SCCs.

You may request further information about international transfer safeguards by contacting us at info@pivitax.com.

7. Data Retention

• 7.1 Account and expense data — Retained for as long as your account is active. On closure, deleted or anonymised within 30 days, except where required by law.
• 7.2 Financial and billing records — Retained for 6 years following the end of the relevant tax year, in accordance with UK HMRC record-keeping requirements.
• 7.3 Receipt images and extracted text — Retained while your account is active and deleted within 30 days of account closure, unless you delete them earlier within the app.
• 7.4 Bank transaction data — Retained within your account for as long as you choose to keep it. You may delete individual transactions or disconnect your bank at any time.
• 7.5 Server and access logs — Technical logs held by Vercel are typically retained for up to 30 days.
• 7.6 Communications — Emails and support correspondence are retained for up to 2 years.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at info@pivitax.com. We will respond within one calendar month.

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Ask us to correct inaccurate or incomplete data.
• Right to erasure — Ask us to delete your personal data in certain circumstances. Note we may be unable to delete data we are legally required to retain.
• Right to restriction of processing — Ask us to restrict how we use your data in certain circumstances.
• Right to data portability — Receive a copy of your personal data in a machine-readable format.
• Right to object — Object to processing carried out on the basis of our legitimate interests.
• Right to withdraw consent — Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.

8.9 Right to complain to the ICO — If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would welcome the opportunity to address your concerns first — please contact us before raising a complaint with the ICO.

9. Children's Data

Pivitax is designed for UK sole traders and freelancers engaged in business activities. It is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has created an account with us, please contact us at info@pivitax.com and we will promptly delete the relevant data.

10. Security

10.1 We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration, or disclosure.

10.2 Measures we use include: encrypted storage via Supabase, HTTPS encryption for all data in transit, hashed password storage, access controls limiting which team members can access user data, and Paddle's PCI-DSS-compliant payment infrastructure.

10.3 Despite our precautions, no internet-based service can guarantee absolute security. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.

10.4 You are responsible for keeping your account credentials secure. Please use a strong, unique password and do not share your login details with others.

11. Subscriptions, Billing & Payment Data

11.1 Your subscription plan, billing details, and payment information are processed by Paddle. You can manage your subscription, view invoices, and update payment details from within your account settings.

11.2 Paddle is PCI-DSS compliant. We receive confirmation of payment status and basic billing information from Paddle but do not store your full card number, CVV, or other sensitive payment credentials on our own systems.

11.3 Subscription data (plan type, billing cadence, and payment history) is retained for 6 years following the relevant tax year end, in accordance with UK HMRC requirements, even if your account is closed.

11.4 If you have questions about a charge, your subscription, or a refund, please contact us at info@pivitax.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this policy and, where the changes are significant, notify you by email or by a prominent notice within the app. Your continued use of Pivitax after any changes are published constitutes your acceptance of the updated policy.

13. Contact

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

Email: info@pivitax.com

We aim to respond to all enquiries within 5 working days and to all formal rights requests within one calendar month.