← Back

Privacy Policy

Last updated: 1 May 2026 · ICO Registration: ZB123456

1. Who We Are

Qwikr ("we", "us", "our") is a cloud-based accounting platform operated in the United Kingdom. We are registered with the Information Commissioner's Office (ICO).

We act in two capacities: we are the data controller for your account, billing, and usage data; and we are a data processor for the financial and taxpayer records you (or your accountancy practice) store in the Service, which we process only on your instructions and on your behalf.

2. What Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, practice/company name
• Financial data: invoices, expenses, payroll records, bank transaction data you import
• Usage data: pages visited, features used, IP address, browser type, session duration
• Payment data: billing information processed via Stripe (we do not store card details)
• HMRC data: VAT numbers, UTRs, and other identifiers required for MTD submissions
• Fraud prevention data (HMRC-mandated): when you use our HMRC integration, we are legally required by HMRC's fraud prevention data specification to collect and transmit connection and device metadata with every submission — including your public IP address, device and browser identifiers, operating system and browser versions, screen properties, window size, and timezone. This data is sent to HMRC alongside each API call and is a condition of using Making Tax Digital software.

3. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Send service-related communications (receipts, security alerts)
• Facilitate HMRC MTD submissions on your behalf
• Provide AI-assisted features: our software uses automated analysis of your financial records to draft bookkeeping entries, categorise transactions, and surface insights. AI-drafted output is presented for human review and approval within the Service; we do not use your financial data to train third-party AI models, and no decision producing legal or similarly significant effects is made solely by automated means
• Detect and prevent fraud or abuse
• Comply with our legal obligations

3a. HMRC Connection & Tokens

When you connect a business or client to HMRC, you authorise Qwikr through your Government Gateway account using HMRC's OAuth process. We never see or store your Government Gateway password. HMRC issues us scoped access and refresh tokens (limited to the tax services you authorised, e.g. VAT or Self Assessment), which we store encrypted at rest. We use these tokens only when you or your authorised users initiate retrievals or submissions. You can revoke our access at any time — by disconnecting within the Service or via your Government Gateway account at HMRC — after which the stored tokens cease to function and are deleted.

4. Legal Basis for Processing

Under UK GDPR, we process your data on the following bases:

• Contract: to provide the Service you have subscribed to
• Legal obligation: compliance with UK tax and financial regulations
• Legitimate interests: fraud prevention, product improvement, security
• Consent: where we ask for your permission (e.g. marketing emails)

5. Data Sharing

We do not sell your personal data. We share data with:

• HMRC: when you initiate submissions or retrievals via our MTD integration — including the fraud prevention metadata described in section 2, which HMRC requires us to send with every API call
• Stripe: to process subscription payments (subject to Stripe's privacy policy)
• Infrastructure providers: cloud hosting, email delivery, and monitoring services, all bound by data processing agreements
• Accountants: if you grant an accounting firm access to your account, they can view your financial data

6. Data Retention

Financial and tax records are retained for as long as your account is active, plus 7 years after closure, to comply with UK financial record-keeping requirements. Other account data (profile, settings, usage history) is deleted within 30 days of account closure. Usage and log data is retained for 12 months. HMRC access and refresh tokens are deleted immediately when you disconnect a client from HMRC or close your account.

7. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure (subject to legal retention requirements)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent where processing is based on consent

To exercise these rights, email privacy@qwikr.tax. We will respond within 30 days.

8. Cookies

We use strictly necessary session cookies to keep you logged in, and analytics cookies to understand how the Service is used. You can disable analytics cookies at any time via your browser settings.

9. Security

We use TLS encryption for all data in transit, AES-256 encryption for data at rest, and enforce role-based access controls. We conduct regular security reviews and penetration testing.

Breach notification: in the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will inform affected users without undue delay, in accordance with UK GDPR Articles 33–34.

10. International Transfers

Your data is stored in UK/EEA data centres. Where we engage processors outside the UK/EEA, we ensure appropriate safeguards are in place under UK GDPR Articles 46-47.

11. Changes to This Policy

We may update this policy periodically. We will notify you by email of any material changes at least 30 days before they take effect.

12. Contact & Complaints

For privacy queries: privacy@qwikr.tax.
If you are unsatisfied with our response, you have the right to complain to the ICO at ico.org.uk.