Privacy Policy

1. Data We Collect

This may include:

• Account details: name, email address, password (hashed)
• Business structure (Sole Trader or Limited Company)
• National Insurance number and Unique Taxpayer Reference (UTR), where you choose to provide them
• Earnings data imported from taxi/PHV platforms or entered manually
• Receipts and expense records, including images uploaded for OCR scanning
• Mileage logs
• Payment details, processed and stored by Stripe (we do not store full card numbers)
• Usage data and analytics (via PostHog) to improve the service

2. How We Use Your Data

We use your data to:

• Provide the core service: tax estimates, expense tracking, and benefit identification
• Process receipt images via AWS Textract and Anthropic's Claude API, to extract and categorise expense data
• Process payments and manage your subscription via Stripe
• Send transactional emails (welcome, billing, trial reminders) via Brevo
• Share data with your accountant if you explicitly link your account to one
• Improve and secure the platform

3. Legal Basis for Processing

We process your data under the legal bases of contract (to provide the service you've signed up for), legitimate interests (to improve and secure the platform), and, where applicable, consent (for optional analytics or marketing communications).

4. Third-Party Processors

Your data may be processed by the following sub-processors, strictly to deliver the service:

• Supabase (EU) — database and authentication
• Stripe — payment processing
• Brevo — transactional email
• AWS Textract — receipt OCR data extraction
• Anthropic (Claude API) — receipt categorisation and the Ask CabCount assistant
• Vercel — application hosting
• PostHog — product analytics
• Sentry — error monitoring

5. Data Retention

We retain your financial records for as long as your account is active, and for a reasonable period afterwards to meet UK tax record-keeping recommendations (HMRC generally recommends keeping records for at least 5 years after the relevant tax return deadline). You can request deletion of your account and data at any time, subject to any legal retention obligations.

6. Your Rights

Under UK GDPR, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact privacy@cabcount.co.uk.

7. Data Security

We use industry-standard security measures, including encryption in transit and at rest, row-level security on all database tables, and restricted access to sensitive data such as NI numbers and UTRs.

8. International Transfers

Where data is processed outside the UK/EU (for example, by AWS or Anthropic), we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Complaints

If you have concerns about how we handle your data, please contact us first at privacy@cabcount.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Contact

Iinovex Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Email: privacy@cabcount.co.uk.