Privacy Policy

Account Information

When you create a Fyled account, we collect your name, email address, and authentication credentials. Account creation is managed through our authentication provider (Clerk), and we receive a unique user identifier to link your account to your data.

Financial Data

To provide our tax calculation and filing services, we collect the financial information you enter into the platform. This includes income records (cash fares, card fares, platform income, tips), expense records (amounts, dates, categories, vendor names), mileage logs (dates, distances, purposes), and receipt images uploaded via the platform or WhatsApp.

Usage Data

We automatically collect certain information when you use our platform, including your IP address, browser type, device information, pages visited, and the date and time of your visits. This data helps us improve the performance and usability of our service.

Clerk (Authentication)

Clerk handles user authentication, including sign-up, sign-in, and session management. Clerk processes your email address and authentication credentials. We do not store your passwords directly.

Convex (Database & Backend)

Convex is our real-time cloud database where your income, expense, mileage, and receipt data is stored. Convex provides enterprise-grade security and data encryption.

HMRC APIs (Tax Filing)

When you use our MTD or Self Assessment filing features, we submit your tax data to HMRC via their official APIs. This data is transmitted securely and only with your explicit authorisation. HMRC's processing of this data is governed by their own privacy policy.

Plaid (Open Banking)

When you choose to connect your business bank account, we use Plaid Financial Ltd. to retrieve transaction history through your bank's Open Banking interface. Plaid receives your bank login credentials directly from your bank — Fyled never sees or stores them. Plaid then shares transaction data (date, amount, description, account name) with us so we can automatically categorise your income and expenses for tax filing. You can revoke access at any time from your bank or by disconnecting in Settings; we will delete the linked account and stop fetching new transactions. We retain transaction data for the duration of your account plus the HMRC-mandated record-keeping period (currently five years after the relevant tax year). Plaid's handling of your data is governed by Plaid's end-user privacy policy.

Stripe (Payments)

Subscription payments are processed by Stripe Payments Europe. Your card details are entered directly on Stripe and are never seen or stored by Fyled. We receive only a customer reference, last 4 digits of your card, and billing status.

Twilio (WhatsApp Messaging)

If you opt in to receipt capture or reminders via WhatsApp, Twilio Inc. transmits your messages and any photos you send between WhatsApp and Fyled. Phone numbers are processed only to route messages.

Resend (Transactional Email)

Resend delivers account, billing, and reminder emails on our behalf. They process your email address and message content solely for delivery.

Anthropic & OpenRouter (AI Categorisation)

We use Anthropic's Claude models (and, for some workflows, OpenRouter as a routing layer) to extract data from receipt photos and to suggest expense categories for bank transactions. Only the minimum data required for the task is sent (e.g. a single receipt image, or a transaction description and amount). These providers do not train models on your data.

PostHog (Product Analytics)

We use PostHog (EU region) to understand how users navigate Fyled so we can improve the product. Analytics are loaded only after you accept cookies. We do not send financial amounts, receipt content, or HMRC submission data to PostHog.

Sentry (Error Tracking)

Sentry captures application errors so we can fix bugs. Personal information in error reports is scrubbed before transmission.

Right of Access

You can request a copy of all personal data we hold about you.

Right to Rectification

You can request that we correct any inaccurate or incomplete data.

Right to Erasure

You can request that we delete your personal data, subject to legal retention requirements.

Right to Restrict Processing

You can request that we limit how we process your data in certain circumstances.

Right to Data Portability

You can request your data in a structured, machine-readable format to transfer to another service.

Right to Object

You can object to the processing of your data for certain purposes, including direct marketing.