IA
Invisible Accountant Back to Home

Privacy Policy

Last updated: September 2026

HMRC Audit & Sandbox Notice

This application is currently operating in a Sandbox / Pre-Production environment for testing and HMRC auditing purposes. While current testing infrastructure utilizes secure EEA-based cloud processing, upon receiving HMRC production credentials, our entire architecture will be migrated exclusively to a UK-based data center (e.g., AWS London) to permanently fulfill the UK-exclusive data processing clauses outlined below.

1. Introduction & How Our Product Works

Invisible Accountant ("we", "our") is a commercial software service that enables UK sole traders to manage their business expenses via WhatsApp. When you send a message or photo of a receipt, our AI extracts the vendor, amount, and category, and subsequently files this data with HM Revenue & Customs (HMRC) via their official Making Tax Digital (MTD) APIs.

2. Data We Collect & Legal Basis

To provide this service, we collect and process:

  • WhatsApp Phone Number: Used as your unique identifier and to communicate with you.
  • HMRC OAuth Tokens: Used strictly to authenticate and transmit your data to HMRC APIs on your behalf. These tokens are granted for an 18-month duration.
  • Financial Data: The amounts, categories, and vendors of the expenses you submit to us.

Our legal basis for processing this data under UK GDPR is the performance of our contract with you to deliver the Invisible Accountant service.

3. Data Security & Encryption

We implement rigorous security controls to protect your data. All personally identifiable information (PII) such as National Insurance Numbers (NINO) and Unique Taxpayer References (UTR) are actively masked and redacted before being saved to our databases. Your HMRC OAuth tokens and identity data are encrypted at rest using AES-256-GCM encryption, mathematically bound to your specific identity to ensure strict customer data separation.

We process and store all customer data exclusively on secure cloud servers located within the United Kingdom (London region).

4. Your Data Rights (Portability, Access & Deletion)

Under UK GDPR, you maintain full control over your data. You have the right to access, amend, export, or permanently delete your data if you choose to move to another provider or stop using our service.

You can exercise your "Right to be Forgotten" or request a data export at any time by texting "DELETE MY DATA" or "EXPORT MY DATA" to the Invisible Accountant WhatsApp bot, or by emailing our Data Protection Officer at privacy@invisibleaccountant.co.uk.

5. Third Parties & Data Sharing

We use Twilio Inc. exclusively to route your WhatsApp messages to our servers. We transmit your finalized tax data directly to HM Revenue & Customs (HMRC). We never sell or share your personal data with third parties for marketing purposes.

6. Security Incident Reporting

If we become aware of a personal data breach, we will notify the Information Commissioner's Office (ICO) and HMRC within 72 hours, and we will inform affected users without undue delay. If you wish to report a security vulnerability, please email security@invisibleaccountant.co.uk.