Privacy Policy

Last Updated: January 2024
Effective Date: January 2024

1. Introduction

foxtract.com ("we", "us", or "our") is committed to protecting your privacy and ensuring that your personal data is handled in a safe and responsible manner. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our document management and accounting services.

2. Data Controller

For the purposes of the UK GDPR, the data controller is:
foxtract.com
Contact: [email protected]

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity Data: First name, last name, username
• Contact Data: Email address, telephone number
• Account Data: Login credentials, account preferences
• Financial Data: Payment card details (processed securely via Stripe)
• Document Data: Business documents you upload for processing
• Technical Data: IP address, browser type, device information
• Usage Data: Information about how you use our services

4. Lawful Basis for Processing

We process your personal data on the following legal bases under Article 6 of the UK GDPR:

• Contract: Processing necessary to perform our contract with you
• Legitimate Interests: Processing necessary for our legitimate business interests
• Consent: Where you have given explicit consent for specific purposes
• Legal Obligation: Processing necessary to comply with UK law

5. How We Use Your Data

We use your personal data to:

• Provide and manage your account
• Process and analyse your uploaded documents
• Process payments and manage subscriptions
• Send service-related communications
• Provide customer support
• Improve our services
• Comply with legal obligations

6. Data Sharing

We may share your personal data with:

• Service Providers: Third-party providers who assist in operating our services (e.g., cloud hosting, payment processing)
• Your Accountancy Practice: If you have linked your account to an accountancy practice
• Legal Authorities: When required by law or to protect our legal rights

We do not sell your personal data to third parties.

7. Supplier Information We Hold

To read your documents accurately we keep a shared reference of public information about supplier businesses — the businesses that issue invoices and receipts to our customers. This section is the information required by Article 14 of the UK GDPR, because this information is obtained from the documents those businesses issue and from public registers rather than from the businesses themselves.

• What we hold: a supplier's registered legal name as published by HMRC and Companies House, the VAT registration number, company registration number and internet domains it prints on its own documents, and the layout conventions of the documents it issues — whether prices are shown inclusive or exclusive of VAT, whether discounts are applied before or after VAT, the character shape of its invoice references, and the printed labels beside which each value appears. We also hold counts of how many customer businesses and how many independent owners support each of those facts.
• What we never hold: financial amounts, line items, invoice numbers, dates, expense classifications, notes, free text entered by users, document images, or any identifier of the customers whose documents the information was derived from. No record in this reference can show which of our customers buys from which supplier, because no customer identifier is stored in it in any form, including hashed or pseudonymised.
• Where it comes from: documents issued by the supplier to our customers, and the public HMRC and Companies House registers.
• Why we hold it, and our lawful basis: legitimate interests (Article 6(1)(f)) — the accuracy of an automated bookkeeping service, so that a customer's first document from a supplier is read as accurately as their five-hundredth. Our assessment of that balance is recorded and reviewed; no information is shared until at least three independent customer businesses have established it.
• Who sees it: our own customers, as pre-filled supplier details on their own documents. It is not sold, not disclosed to any third party, not exported, not made available through any interface for others to query, and not used to train any model. No decision about a supplier business is made from it.
• How long we keep it: it is recalculated from live records at least every 7 days. Information not confirmed for 400 days is shared with nobody, and a supplier record with no supporting customer for 730 days is deleted.
• Rights of a supplier business: a supplier may ask us for a copy of what we hold about it, ask us to correct it, or object to it being held at all, in which case we remove it from the shared reference and no later recalculation re-creates it. Contact [email protected], or lodge a complaint with the ICO (section 15 below).

If you are a Foxtract customer, you can stop your own records contributing to this shared reference at any time in your company settings ("Share public supplier facts"), and you can stop your documents being read using it ("Use shared supplier facts"). Neither choice affects any other part of the service, and turning contribution off removes your contribution at the next recalculation.

8. International Transfers

Your data may be processed outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Document data is retained according to your subscription terms and can be deleted upon request.

10. Your Rights Under UK GDPR

Under the UK GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, you can submit a Data Subject Access Request through your account, or contact us at [email protected]

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Secure access controls and authentication
• Regular security assessments
• Staff training on data protection

12. Cookies

We use essential cookies to ensure our website functions properly. For more information, please see our Cookie Policy.

13. Children's Privacy

Our services are not intended for children under 18 years of age. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through our platform.

15. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

16. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:
Email: [email protected]