Data Retention Policy

Accounting and tax records may need to be retained for statutory periods.

Deletion requests are assessed against legal, accounting, tax, security and contractual retention duties.

Uploaded receipts, supplier invoices and transaction attachments are retained only as long as the record they evidence, and are erased from storage — not just the database — on deletion.

Customer account records are retained while the account is active and for a reasonable period after closure for legal, audit, security, billing and dispute purposes.

Business records, filing evidence, invoices, bills, payroll and tax records may be retained according to UK accounting and tax obligations, unless export/deletion is supported and lawful.

Uploaded documents (receipts, supplier invoices and transaction attachments) are held in access-controlled object storage as opaque, non-public keys, viewable only through short-lived signed links after an ownership check. They follow the retention period of the accounting or tax record they evidence — typically the same statutory period as the record itself — and are erased from object storage, not only from the database, when a document is individually removed or when the account is deleted.

Security logs and audit logs are retained for accountability, investigation and regulatory purposes. Retention periods should be reviewed periodically.

Backups may retain deleted data for a limited period until normal backup rotation removes it.