ReceiptTrack
Privacy Policy
How ReceiptTrack collects, uses, protects, and manages personal information for service delivery and compliance.
Last updated: 23 July 2026
ReceiptTrack Privacy Policy
This Privacy Policy explains how ReceiptTrack and GRIMSOFT LTD process personal data when you use our marketing website, dashboard, support channels, billing features, and Making Tax Digital preparation workflows.
Data controller
GRIMSOFT LTD (trading as ReceiptTrack)
Support route: log in and open the Help section to send a support ticket.
Website: receipttrack.co.uk
1. Scope and key principles
We process personal data to operate ReceiptTrack, secure user accounts, provide support, process subscriptions, and support tax workflow preparation, including Making Tax Digital features where available.
We apply data minimisation, least-privilege access, encryption controls, and restricted operational access to reduce unnecessary exposure of personal information.
2. Categories of personal data we process
| Data category | Examples | Purpose | Lawful basis |
|---|---|---|---|
| Identity and account data | Name, email, profile photo, provider identifier | Authentication, user profile and account access | Contract |
| Workspace and business profile | Business names, registration/VAT fields, address fields, account type | Bookkeeping setup and tax workflow configuration | Contract |
| Receipt and transaction data | Receipt images, merchants, dates, totals, category/tax fields | Expense tracking, analytics, reporting and export | Contract |
| Business Hub documents and evidence | Customer and supplier details, invoice lines, source files, payment allocations and manual mileage records | Prepare and review business documents, record settlement and support explicit accounting actions | Contract |
| Income and planning data | Income entries, schedules, budgets, account-level settings | Financial planning and dashboard functionality | Contract |
| Making Tax Digital preparation data | Workspace tax profile, quarterly review status, and connection/submission status where supported | Prepare records for Making Tax Digital workflows and future supported submissions | Contract and legal obligation (where applicable) |
| Support and contact data | Support ticket messages, attachments, contact profile context | Customer support and issue resolution | Contract and legitimate interests |
| Billing and subscription data | Plan tier, Stripe customer/subscription references, billing status | Subscription provisioning and service entitlement management | Contract and legal obligation |
| Security and telemetry data | IP address, user agent, logs, event traces, anti-abuse signals | Security monitoring, fraud prevention and service reliability | Legitimate interests and legal obligation |
| Marketing and product engagement | Name, email, source, and IP for product update requests | Product communication and service updates | Consent and legitimate interests |
3. Making Tax Digital preparation statements
ReceiptTrack is working toward Making Tax Digital support. Live HMRC connection and submission actions may be unavailable until approval is complete. We do not ask for or store users' Government Gateway passwords.
Where a supported connection is enabled, authorisation data is handled securely and used only for user-requested tax workflow actions.
We retain tax workflow events and submission-related records where needed for auditability, troubleshooting, statutory duties, or customer support.
4. Sources of personal data
We collect data directly from you, from connected services you authorise, and from system-generated telemetry.
Sources include: account registration and profile updates, uploaded receipts/documents, support forms, Stripe billing events, Firebase authentication metadata, Making Tax Digital workflow data where supported, and technical logs generated by the platform.
5. Data sharing and processors
We share personal data only when necessary to provide the service, satisfy legal obligations, or protect users and the platform.
Processor categories currently used by the platform include:
- Identity and authentication services (Firebase / Google identity tooling).
- Cloud data hosting and object storage services used by ReceiptTrack environments.
- Payment processing services (Stripe) for subscriptions and billing status.
- AI receipt-data extraction — uploaded receipt images are processed by OpenAI (our processor, under a signed Data Processing Agreement) to extract merchant, date, totals and VAT; this processing may take place in the United States.
- HMRC systems only where a supported user-authorised tax workflow is available.
We do not sell personal data. We do not permit marketing re-use of your bookkeeping records by third parties.
6. International transfers
Where processing includes cross-border transfers, we rely on appropriate safeguards such as contractual protections and equivalent transfer mechanisms required under UK GDPR.
In particular, receipt images processed by our AI extraction provider (OpenAI) may be transferred to and processed in the United States. This transfer is covered by a Data Processing Agreement that incorporates the applicable Standard Contractual Clauses.
7. Security controls
We apply technical and organisational controls including transport encryption, encryption-at-rest where configured, access restrictions, audit logging, and incident response procedures.
No internet system is guaranteed to be fully secure, but we continuously improve controls and investigate reported vulnerabilities.
8. Data retention
We retain personal data only as long as necessary for the purposes set out in this policy, including service operation, legal obligations, tax workflow requirements, and dispute handling.
Configured receipt-retention windows in current service logic:
- Free tier: rolling 90-day receipt retention.
- Starter tier: 365-day receipt retention.
- Pro and Advanced tiers: 6-year retention windows.
Canceled paid plans can enter post-cancellation grace windows before purge. Legal or regulatory exceptions may require longer retention for selected records.
9. Your rights
Subject to applicable law, you can request access, rectification, restriction, objection, portability, and erasure of personal data.
To submit a rights request, log in and use the Help section ticket system with subject line "Privacy Request". We may require identity verification before completing requests.
You may also complain to the UK Information Commissioner's Office (ICO) if you believe data protection law has been breached.
10. Cookies, local storage, and similar technologies
We use essential browser storage and session mechanisms for authentication, security, and user experience continuity. Marketing preference flags may also be stored in browser storage.
Where non-essential analytics or marketing technologies are introduced, we will update this policy and provide appropriate consent controls.
11. Children's privacy
ReceiptTrack is intended for adult users and business/tax record management. It is not designed for children under 18.
12. Changes to this policy
We may update this policy from time to time. Material changes will be published on this page with an updated effective date.