Privacy policy
Last updated: [date]
Draft. This page is being checked by our solicitor and may change before Peza opens to everyone.
Peza keeps your tax records and sends them to HMRC for you. We collect only what we need to do that, we never sell your data, and we don't show ads.
Who we are
Peza is a trading name of Hart & Sibs Accountants Ltd, a company registered in [England and Wales] (company number [number]), registered office [address]. We are the data controller for the personal data described here. ICO registration number: [number]. Contact us at [email protected].
What we collect and why
| What | Examples | Why we need it | Lawful basis |
|---|---|---|---|
| Account details | Your email address, sign-in codes, two-step sign-in settings | To create your account and sign you in safely | Contract |
| Tax records | Income and expenses you enter (date, amount, category, description), updates you send, final declarations and HMRC's tax calculation | To keep your records and send them to HMRC | Contract |
| HMRC connection | The access key HMRC gives us when you connect, and your National Insurance number when you check what's due | To talk to HMRC on your behalf | Contract |
| Device and network details | IP address, a random device ID, screen and window size, time zone, app version, how you signed in | HMRC requires these with every request to help prevent tax fraud | Legal obligation |
| Payment details | Your plan, payment status and renewal date. Stripe holds your card details, and we never see them | To run your free trial and paid plan | Contract, and legal obligation for accounting records |
| Error reports | Technical details when something breaks in Peza. No names, figures or National Insurance numbers | To find and fix problems | Legitimate interests |
We don't store your National Insurance number on our server. It is sent to HMRC when you check what's due, and the app remembers it on your device until you sign out. Sign-in codes and recovery codes are stored scrambled (hashed), and HMRC access keys and two-step secrets are encrypted.
Your Peza data is kept separate from the accountancy firm's client files. We don't use it to offer you accountancy services unless you ask us to.
Who we share it with
| Who | What they do for us | Where |
|---|---|---|
| HMRC | Receives your updates and declarations, which is the point of Peza. HMRC is responsible for what it does with them | UK |
| DigitalOcean | Hosts Peza's server and database | London, UK |
| Stripe | Takes payments and manages plans | UK, EU and US |
| Resend | Sends sign-in code emails | EU (Ireland) |
| Sentry | Stores error reports | EU (Germany) |
These companies only process data on our instructions. Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum. We share data with others only when the law requires it.
How long we keep it
- Your account and tax records: while your account is open. If you close it, we delete them straight away. Download anything you need first, because HMRC expects you to keep records for at least 5 years after the 31 January deadline for that tax year. You can download them from the Account screen.
- Billing records: 6 years, because tax law requires it.
- Sign-in codes: they expire within minutes.
- Error reports: deleted by Sentry after 30 days.
- After you close your account: we keep only a scrambled (hashed) copy of your email address and the date you first signed up, so a new account with the same email doesn't get a second free trial.
Cookies and storage
Peza doesn't use advertising or tracking cookies. The app keeps your sign-in and a random device ID on your device, so you stay signed in and HMRC's fraud checks work. These are strictly necessary, so we don't ask for consent.
Your rights
Under UK data protection law you can ask us to:
- see the data we hold about you
- correct it
- delete it
- restrict how we use it, or object to it
- give it to you in a format you can move to other software
You can download your data and close your account yourself from the Account screen, or email [email protected] and we'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect.