Privacy information
Early access · Updated 12 October 2026
Information in your workspace
The existing preview uses ChatGPT sign-in. On the independent website, Business HQ verifies your email using a one-time sign-in code delivered by its email provider. It stores an account identifier, verified email, session records, security request limits, and the IP address and browser information used to protect sign-in. Codes expire after 10 minutes and are stored as hashes; they are not saved with your business records. Session cookies are essential to keeping you signed in and last up to seven days. The independent background maintenance process removes expired authentication entries when it is enabled. It stores your business profile, customers, transactions, documents, saved invoice layouts, account settings, accounting entries and reports that you choose to create. If you use the relevant tools, it also stores property addresses and allocations, tax sources and qualifying income, employer references, subcontractor UTRs and payment records, provider-reported employee pay and deductions, reviewed preparation packs and externally obtained filing receipts. These records are included in your private data export. Signed-in activity includes account creation, plan details and recent access time. Administrators can view account email, role, plan, trial dates and recent activity to manage access. The owner dashboard also shows account-level creation counts, monthly allowances, active recurring schedule counts, add-ons and receipt storage totals, alongside aggregate registration trends. It does not display the contents of customer invoices, transaction descriptions or original files. Anonymous demo visitors are not identified by this dashboard.
Why information is used
The website uses these records to run your workspace, prepare the documents and reports you request, manage access and maintain an activity history. It does not automatically submit tax returns, decide credit eligibility or run payroll.
The operator still needs to document the lawful bases for account administration, billing and security, and the respective responsibilities for customer and employee information entered by businesses.
Sharing and optional services
Your business records are separated by signed-in account. A customer invoice link is an exception: anyone you share that link with can view that invoice until the link expires or you revoke it. Take care when sharing it.
If subscription payments are enabled and you choose checkout, Stripe handles the payment details; Business HQ stores billing identifiers and subscription status, not card numbers. If direct invoice email is enabled and you press Send, the email provider receives the recipient, message and invoice link. Opening an email-app draft uses your chosen email application instead.
The operator must confirm the hosting and authentication providers, optional payment and email providers, any international transfers and the relevant safeguards before completing this notice.
Retention and deletion
Retention periods, account-closure arrangements and deletion handling have not yet been confirmed. The operator must publish a policy they can carry out before opening the service beyond testing.
You can download your workspace records from Settings or Plan & access, including after a trial expires. This produces a dated copy. Private recovery archives of business records are stored separately from the working database on the website’s hosting provider. A copy is kept before the first business change each UTC day and the latest daily copy is updated after successful changes. Up to 60 recovery copies are retained per workspace; older copies are removed after another copy is successfully saved. This count-based policy does not guarantee deletion after a fixed number of days for inactive accounts. Customers can preview and restore supported records from these server-created copies. Restoring uploaded exports is not supported. Account permissions, subscription state, service credentials and invoice-link tokens are excluded from recovery archives. Existing audit and filing evidence is retained during recovery.
Your choices and rights
Contact the operator to request access, correction or deletion of personal information, or to ask about restriction, portability or objection where applicable. Where processing relies on consent, you can withdraw it. You can object to processing based on legitimate interests. Rights may be subject to legal exceptions and the nature of the records involved.
You can also raise a concern with the Information Commissioner’s Office. The ICO explains the privacy information you should receive.
Device settings and changes
The app stores display preferences and demo choices on your device. Its sign-in and hosting services may use information needed to provide their services; the operator must document their use in the provider policy above. This version does not add advertising trackers. Material changes to data use need an updated notice before they take effect.
Customer support
Support questions, replies, request status and timestamps are stored with your account. Business HQ administrators can read these conversations and reply to investigate an issue. Support remains available after trial expiry and your conversations are included in your private data export. The public help preview is temporary and does not create a support request.
Guide answers do not use an external AI provider. If AI support is enabled and you choose it, the recent support conversation is sent to OpenAI to prepare a reply. Account identifiers and workspace financial records are not added to that request. OpenAI processes the submitted text under its API data policies; disabling response storage is not a promise of zero provider retention. Avoid passwords, payment card numbers, tax identifiers and other sensitive information in support messages. The operator must include support records and the optional AI provider in the published retention and provider arrangements.
Operational reporting
The service records server-error categories, endpoint names, status codes, timestamps, counts and diagnostic references so administrators can investigate faults. Reports exclude request bodies, query strings, customer messages and raw exception details. Backup status timestamps are stored with your workspace. These reports appear in the administrator area; no external monitoring or alert-email provider is connected.
Receipt scanning and shop imports
Receipt text recognition happens on your device and is not sent to an OCR provider. We save the expense details you review and approve. If you choose to save the original receipt, or attach a photo to an existing expense, we store the original JPG, PNG or WebP file privately with your account and expense reference, filename, type, size, integrity digest and upload status. Original image metadata is retained. Closing the scanner discards its local photo and recognised text, but does not delete an original you have uploaded. You can download or permanently delete originals from the receipt library in Settings, including after your trial expires. Moving an expense to the recycle bin or restoring older records does not delete or restore receipt files. JSON exports and workspace recovery copies include no original images; download those separately. Minimal deletion records remain to prevent a delayed upload from recreating a deleted receipt. Shop CSV files are sent to Business HQ for the requested preview or import; approved records, shop labels and payment IDs are retained for matching and duplicate checks. The raw CSV is not stored as a file.
Contact the operator
The operator’s public name, business address and contact email have not been supplied yet.