Legal

Privacy Policy

Who we are

This service is operated by [to be confirmed: operator legal name and business registration] (“we”, “us”). It helps accounting firms collect documents from their clients by sending reminders about documents that are still outstanding. Contact: [to be confirmed: privacy contact email address].

Two kinds of people, two different roles

Accounting firms hold an account with us. For account data we decide how it is used, so for that data we are the controller.

A firm’s clients never hold an account. The firm enters their details and decides who is contacted and about what. For that data the firm is the controller and we act on its instructions as its processor. If you are a firm’s client, the firm is your first point of contact for questions about your data; we will help the firm answer them.

What we store

• Firm accounts: the account email address, a password (stored only as a secure hash by our authentication provider, never readable by us), the firm’s name, its time zone and preferred sending hours, and the date the firm accepted our Terms.
• Clients, as entered by the firm: name, email address, phone number (if provided), time zone, and tax year.
• Document checklists: the names of documents a firm has asked a client for, and whether each has been received. We never receive, store or host the documents themselves — the service only records whether they have arrived.
• Reminder messages: the subject and text of each reminder, which channel it was sent on, when, and its delivery status (including bounces and failures).
• WhatsApp consent records: when a client agreed to WhatsApp reminders, how that consent was given, when the consent link was issued, and when the client opted out.

What we do not do

• We do not sell or rent personal data, and we do not use it for advertising.
• We use no analytics, advertising or tracking cookies. The only cookie is the sign-in session cookie for firm accounts, which is strictly necessary and cannot be read by page scripts.
• Reminder text is produced from fixed templates. It is not generated by an AI model, and no client data is sent to one.

How reminders reach clients, and how they stop

Email. A firm starts a reminder sequence for a client: up to five reminders over three weeks, sent within the firm’s sending hours in the client’s time zone. Reminders stop automatically when the firm has marked every requested document as received or no longer needed, when an address bounces, or when a recipient marks a reminder as spam. Reminders do not currently include an unsubscribe link; a client who wants them to stop should reply to the reminder or contact their firm.

WhatsApp. A client receives WhatsApp reminders only after agreeing to them on a consent page the firm sends them a link to. The link works for 30 days. Replying STOP to any WhatsApp reminder turns WhatsApp reminders off. Opting out of WhatsApp does not stop the reminder sequence itself: any remaining reminders are sent by email instead, and stop in the ways described above.

How long we keep it

• Reminder text (subject and body) is deleted no later than 90 days after the reminder was created or sent. A record that the reminder existed — its date, channel and status — is kept, because it is what prevents the same reminder from ever being sent twice.
• Account, client and checklist data is kept while the firm’s account exists. Deleting a firm’s account deletes its clients, checklists and reminder records with it. Account deletion is currently handled on request: contact us at the address above.

Who else processes it

We use the service providers listed under Sub-processors below to run the service. Each receives only what it needs for its stated purpose.

Where it is processed

Our providers process data in the United States. Where the law requires safeguards for transfers outside your country, we rely on [to be confirmed: transfer mechanism, e.g. Standard Contractual Clauses].

How it is protected

Every firm’s data is isolated from every other firm’s by rules enforced in the database itself, not only in application code. Data travels over encrypted connections, and the sign-in cookie is inaccessible to page scripts.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict its use, and to complain to a data protection authority. Firms can exercise these rights by contacting us. Clients should contact their firm, which controls their data; if you contact us directly, we will pass your request to the firm.

Changes

We will post any change to this policy on this page with a new date, and notify firm accounts by email of material changes before they take effect.

Terms of Service

1. The agreement

These Terms are an agreement between [to be confirmed: operator legal name] (“we”) and the accounting firm that creates an account (“you”). You accept them when you set up your firm’s account; we record the date you did. The service is for businesses only — not for personal or household use.

2. What the service does

You record your clients and the documents you need from each. The service sends your clients reminders about documents that are still outstanding, by email and, where a client has opted in, by WhatsApp, and stops once you have marked every requested document as received or no longer needed. The service does not receive, store or host the documents themselves.

3. Your responsibilities

• You are responsible for having a lawful basis to contact each client you add, and for the accuracy of the details you enter.
• You will use the service only to contact your own clients about documents you genuinely need from them, and not for marketing or unsolicited messages.
• You will not ask clients to send documents through the service, since it is not built to receive them.
• You are responsible for keeping your account credentials secure.
• Reminders are sent in your firm’s name. Their wording is fixed by the service’s templates; you are responsible for the documents you ask for and the clients you contact.

4. Data protection

For your clients’ personal data, you are the controller and we are your processor. The Data Processing Addendum below forms part of these Terms and governs that processing.

5. Fees

Any fees, and what they include, are shown to you before you pay. [to be confirmed: refund and cancellation terms, to be set with billing]

6. Availability

We work to keep the service available but do not guarantee uninterrupted operation. Reminders are sent by scheduled jobs and may be delayed; the service is not suitable for deadlines that depend on a message arriving at an exact time.

7. Suspension and ending the agreement

You may stop using the service and ask us to delete your account at any time. We may suspend an account that is used in breach of these Terms, in particular for unsolicited messaging. When an account is deleted, its clients, checklists and reminder records are deleted with it.

8. Disclaimers and liability

The service is provided “as is”. To the extent the law allows, our total liability under these Terms is limited to [to be confirmed: liability cap], and we are not liable for indirect or consequential losses. Nothing in these Terms limits liability that cannot be limited by law.

9. Changes to these Terms

We will notify you by email at least [to be confirmed: notice period for changes to Terms] before a material change takes effect.

10. Governing law

These Terms are governed by [to be confirmed: governing law and courts].

Data Processing Addendum

This Addendum forms part of the Terms of Service and applies where we process personal data on your behalf as your processor.

1. The processing

Subject matter

Sending your clients reminders about documents they have not yet provided.

Duration

For as long as your account exists, subject to section 7.

Nature and purpose

Storing client and checklist details you enter, generating reminder text from fixed templates, delivering reminders by email and WhatsApp, recording delivery status and WhatsApp consent, stopping reminders once no requested document is outstanding, and switching a client who opts out of WhatsApp to email.

Categories of data subjects

Your clients.

Types of personal data

Names, email addresses, phone numbers, time zones, tax year, the names of requested documents and their status, reminder text and delivery status, and WhatsApp consent and opt-out records. No special-category data is intended to be processed, and no tax documents are received.

2. Instructions

We process your clients’ personal data only on your documented instructions — which are these Terms and your use of the service’s features — unless the law requires otherwise, in which case we will tell you first unless the law forbids it.

3. Confidentiality

Anyone we authorise to process the data is bound by confidentiality.

4. Security

We keep appropriate technical and organisational measures in place, including database-level isolation of each firm’s data, encryption in transit, and deletion of reminder text no later than 90 days after the reminder was created or sent.

5. Sub-processors

You authorise the sub-processors listed below. We will give you at least [to be confirmed: notice period for new sub-processors] notice by email before adding or replacing one, and you may object; if we cannot reasonably accommodate the objection, you may end the agreement. We impose data protection terms on each sub-processor equivalent to these, and remain responsible to you for their performance.

6. Assistance

We will help you, taking into account the nature of the processing, to respond to requests from your clients exercising their rights, and to meet your obligations on security, breach notification and data protection impact assessments.

7. Breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your clients’ data, with the information we have and as it becomes available.

8. Deletion at the end

When your account ends, we delete your clients’ personal data, unless the law requires us to keep it. You may ask for a copy before deletion.

9. Audits and information

We will make available the information reasonably needed to demonstrate compliance with this Addendum, and allow for and contribute to audits on [to be confirmed: audit terms].

10. International transfers

Personal data is processed in the United States. Where required, transfers are covered by [to be confirmed: transfer mechanism, e.g. Standard Contractual Clauses].

Sub-processors

These providers process personal data on our behalf to run the service.