Legal — Filabl Terms, Privacy & Cookie Policy

1. Who We Are

Filabl ("we", "us", "our") is a software company registered in England and Wales. We provide AI-powered accounting and tax filing software for UK businesses at filabl.co.uk. Our registered email address for data protection matters is privacy@filabl.co.uk.

2. Data We Collect

Account Information

• Name and email address when you sign up
• Company name, registration number, and VAT number
• Billing information (processed securely via Stripe)

Financial Data

• Bank transaction data (where you connect a bank account via Open Banking)
• VAT returns, tax submissions, and accounting records you create or import
• Invoices, bills, quotes, contacts, and fixed assets you create in the app
• Receipt images and emails you upload or forward to your receipt inbox
• HMRC Government Gateway OAuth tokens (stored encrypted — we never store your HMRC password)

Usage Data

• Pages visited, features used, and time spent in the app
• Browser type, device type, and IP address
• Error logs and performance data

3. How We Use Your Data

• To provide and improve our accounting software services
• To submit tax returns and filings to HMRC on your behalf (with your explicit authorisation)
• To generate AI-powered tax insights and suggestions
• To send service emails (receipts, deadline reminders, support)
• To comply with our legal obligations under UK law

We do not sell your data to third parties. We do not use your financial data to train AI models without your explicit consent.

4. Legal Basis for Processing

We process your data under the following legal bases under UK GDPR:

• Contract performance — to deliver the service you've subscribed to
• Legal obligation — to comply with UK tax, financial, and data protection law
• Legitimate interests — to improve our services and prevent fraud
• Consent — for marketing communications (you can withdraw at any time)

5. HMRC Data & Making Tax Digital

When you connect your HMRC Government Gateway account, we receive OAuth access tokens which allow us to submit returns on your behalf. We store these tokens encrypted in our database (hosted on Supabase in EU London). We never receive or store your HMRC Government Gateway username or password. You can disconnect your HMRC account at any time from Settings.

6. Data Sharing

We share data only with the following trusted sub-processors:

• HMRC — for tax filing via the Making Tax Digital API (UK government)
• Supabase (EU London region) — database and authentication hosting. Data stored in the UK/EU.
• Vercel (US-based) — application and serverless function hosting. Covered by Standard Contractual Clauses under the UK–US data bridge. See Vercel's Privacy Policy.
• Anthropic (US-based) — AI processing for the AI Accountant chat feature. Financial context you provide in the chat may be processed by Anthropic's API. Covered by Anthropic's data processing agreement. See Anthropic's Privacy Policy.
• Google (US-based) — receipt scanning via the Gemini API (when you upload a receipt image). Receipt images are processed to extract transaction data and are not stored or used to train Google's models. Covered by Google's data processing agreement. See Google's Privacy Policy.
• Stripe (US-based) — payment processing and Open Banking (Stripe Financial Connections). Billing data is processed by Stripe and subject to Stripe's Privacy Policy.
• Resend (US-based) — transactional email delivery (invoice payment reminders, accountant access invitations, sign-in verification codes, receipt inbox). Only the minimum data needed to deliver each email is shared. Covered by Resend's data processing agreement. See Resend's Privacy Policy.
• Companies House — public company data lookups (UK government, publicly available data only).
• Google Analytics (US-based) — website usage analytics (pages viewed, session duration, device type). Only loaded with your consent. Covered by Standard Contractual Clauses. See Google's Privacy Policy.

International Data Transfers

Some sub-processors (Vercel, Anthropic, Google, Stripe) are based in the United States. These transfers are safeguarded by Standard Contractual Clauses (SCCs) approved under UK GDPR, or the UK International Data Transfer Agreement (IDTA) where applicable. We only transfer the minimum data necessary to deliver each specific service.

7. Data Retention

We retain your data for as long as your account is active, plus 7 years after account closure (as required by HMRC record-keeping rules for business tax purposes). You may request deletion of non-statutory data at any time.

8. Your Rights

Under UK GDPR you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to processing or request restriction
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time

To exercise these rights, email privacy@filabl.co.uk. We will respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO).

9. Security

We apply multiple layers of security to protect your data:

• Encryption in transit: All connections use TLS 1.2+ (enforced via HSTS with a 2-year max-age and preload).
• Field-level encryption at rest: Sensitive credentials — including HMRC OAuth tokens — are encrypted using AES-256-GCM with a unique random 96-bit IV per encryption operation before being written to the database. Authentication tags are verified on every read, preventing undetected tampering.
• Security headers: Every response includes Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Referrer-Policy, and a strict Permissions-Policy.
• Access controls: Row-Level Security (RLS) is enforced at the database layer so each user can only access their own data. API routes verify session tokens on every request.
• Rate limiting: All authentication and API endpoints are rate-limited to protect against brute-force attacks.
• CSRF protection: OAuth flows use HMAC-signed, timestamped state tokens to prevent cross-site request forgery.

We conduct regular security reviews. In the event of a data breach affecting your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or in-app notification at least 14 days before they take effect.