Privacy policy

The short version

• We use your information only to deliver the accountancy services you have engaged us for and to keep the platform safe.
• We never sell it, never use it for advertising and never let an AI provider train on it.
• Information from HMRC is read only with your authority, is seen only by our team and is never sent to an AI model.
• Our database is in Ireland and our application runs in London. Some of our providers are US companies; the safeguards are explained below.
• You can see, correct, export or ask us to delete your information at any time; you can also complain to us or to the ICO.

Who we are

Sidgrove Intelligence is run by Sidgrove Limited (“Sidgrove”, “we”, “us”), a firm of chartered accountants registered in England and Wales under company number 10649935. Our registered office is 86-90 Paul Street, London, EC2A 4NE. Sidgrove is a member of ICAEW, the Institute of Chartered Accountants in England and Wales.

The platform lives at intelligence.sidgrove.com. Our team uses it to do your work; our clients use it to see their bookkeeping, cashflow, payroll, deadlines, tax and reports.

For the information in this policy, Sidgrove is the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. That means we decide how it is used and we are responsible for protecting it. Where we run payroll or bookkeeping for a business purely on its instructions, that business is the controller for its own staff, customers and suppliers, with Sidgrove acting as its processor under our engagement letter.

We have not appointed a data protection officer, as the law does not require one for a practice of our size. Dave Sellick, our director, is responsible for data protection; you can reach him at dave@sidgrove.com.

Whose information this covers

• Our clients and their people: directors, owners and staff of client businesses who use the platform, as well as individuals we prepare tax returns for.
• People named in client records: employees on a payroll we run, plus customers, suppliers and other contacts who appear in a client’s accounts.
• People we send proposals to before they become clients.
• Our own team, when they sign in and work in the platform.

What we collect and where it comes from

1. Your sign-in details. When you sign in with Google (or, for our team, Microsoft), the provider gives us your name, email address and profile picture. We never see your Google or Microsoft password.
2. What you do in the platform: comments, questions and answers on transactions, sign-offs on reports and returns, notes, uploaded documents and your settings. Important actions are recorded with who did them and when, so there is a clear audit trail.
3. Accounting records from the services you connect. With your authority we read from Xero (transactions, contacts, journals, reports, budgets, fixed assets and attachments), Paycircle (employees, payslips and pay runs), the Google Sheets and Drive folders we work in for you and, where relevant, your Shopify, Recurly or PracticeHub account. Payroll records include employees’ names, pay, tax codes, National Insurance numbers, pension details and statutory payments such as sick or parental pay.
4. Tax information. For Self Assessment we hold what you tell us and the documents you upload, such as your Unique Taxpayer Reference (UTR), income, gains, reliefs and supporting papers. Where you have authorised us as your agent, we also read information from HMRC (see the next section).
5. Public records. We read company details, filing deadlines and officers from Companies House.
6. Proposals. If we send you a proposal we hold your name and email address. When you accept, we record the time along with a scrambled (hashed) form of part of your IP address and of your browser details, as evidence of acceptance, rather than the details themselves.
7. Technical information: a record of the requests the platform makes to other services, page speed measurements and error details, so we can keep it running well and secure.

You do not have to give us any of this, but without it we cannot deliver the services in your engagement letter; some of it (for example a UTR or National Insurance number) is needed by law to file returns.

Information we receive from HMRC

Where you have authorised Sidgrove to act as your tax agent (for example through a 64-8 linked to our HMRC agent services account), we may read information HMRC holds about you through HMRC’s official APIs, using our own agent sign-in. HMRC checks that authorisation on every request; we cannot see anyone who has not authorised us.

• What we read: for the last two completed tax years, your employments, the pay and taxable benefits your employers reported through PAYE, the tax deducted, pension and state benefit amounts HMRC holds (such as Child Benefit) and your National Insurance record. Our access is read-only; we cannot change anything HMRC holds through it.
• Why: only to prepare and check your Self Assessment tax return and the advice that goes with it. Our lawful basis is the contract in your engagement letter.
• Who sees it: only our team. The figures are shown to the accountant working on your return and the platform does not save them; anything we rely on becomes part of the working papers for your return. We do not share it, sell it, use it for marketing or send it to any AI model.
• Fraud prevention data: HMRC requires every request to carry details of the device and connection it comes from, so it can protect your tax records. So the IP address, a device identifier, the time zone, screen and window size and browser details of the team member making the request, along with details of our software and servers, are sent to HMRC. This is a legal requirement for using HMRC’s APIs.
• How it is protected: our connection to HMRC uses HMRC’s own sign-in (OAuth 2.0), so we never handle HMRC passwords to read this information. The access tokens are stored encrypted with AES-256. Only our server can read them.
• Stopping it: you can withdraw your authorisation with HMRC at any time, after which we can no longer read your information, or simply ask us to stop by email.

Sign-in details we hold for other services

To work on your behalf our team signs in to HMRC online services and other accountancy tools. For most tools the password is kept in our team’s browser password manager and never in Sidgrove Intelligence.

We do not store our clients’ HMRC sign-in details. The only HMRC Government Gateway sign-ins held in Sidgrove Intelligence are the practice’s own. They are encrypted (AES-256) before they are stored, only our team can use them, they are never shown to client users and every save, view, copy or use is logged (without the password itself). HMRC’s own security code step is always completed by a person.

Our team uses a private Chrome extension to fill these sign-in pages. It stores no passwords of its own.

How we use your information and why we are allowed to

Data protection law requires a lawful basis for each use. These are ours:

• Delivering our services (contract): bookkeeping, payroll, VAT, management accounts, year-end accounts, Self Assessment and corporation tax, as well as giving you access to your figures in the platform.
• Meeting our legal duties (legal obligation): keeping accounting and tax records, running payroll, reporting to HMRC and meeting our professional and anti-money laundering obligations.
• Running a good, safe practice (legitimate interests): keeping the platform secure and working, preventing misuse, keeping an audit trail, sending you reminders about your work and using AI tools to check and prepare work faster. We have weighed these against your interests; they are what you would expect from your accountant and they do not override your rights. You can object to any of them (see your rights below).
• Proposals (steps before a contract): sending you a proposal you asked for and recording your acceptance.

Payroll records can include health-related information, such as statutory sick pay. We use it only to meet employment and tax law, as UK GDPR Article 9(2)(b) and Schedule 1 of the Data Protection Act 2018 allow. We treat it with extra care.

We do not sell personal information, run advertising or share it for anyone else’s marketing.

How we use AI

We use AI models to speed up routine work: suggesting how a bank line should be categorised, spotting VAT and month-end issues, drafting commentary on payroll and management accounts, reading invoices and documents you upload and suggesting answers for tax returns. To do this, the relevant transactions, figures or documents are sent to the AI provider for that task.

• Our main providers are Anthropic (Claude) and Google (Gemini). Some checks go through Vercel’s AI Gateway, where we only allow providers that keep nothing.
• We use business API services whose terms say your data is not used to train their models. Where a provider keeps data at all, it is for a short period (up to 30 days) for abuse monitoring only.
• Every AI suggestion is a starting point that our team checks. We do not make decisions about you based solely on automated processing.
• Information from HMRC is never sent to an AI model.

Who we share it with

We use a small number of trusted providers to run the platform. Each acts on our instructions under a data processing agreement and may only use your information to provide their service to us.

• Vercel (application servers in London): hosts the platform, runs scheduled jobs and measures page speed without cookies.
• Supabase (database in Ireland): our database and secure file storage.
• Google: sign-in, Gemini AI and the Drive folders and Sheets we work in.
• Microsoft: sign-in for our own team.
• Anthropic: Claude AI, as described above.
• Vercel AI Gateway: access to other AI models, limited to providers that keep nothing.
• Slack: updates, questions and summaries we post to the shared Slack channel we run with your business. These can include figures from your accounts.
• Resend: sending emails from the platform, such as invitations, notifications and receipts you ask us to forward to your bookkeeping inbox.
• Calendly: booking a meeting with us, if you use the booking page.

We also exchange information with services you connect or that we work with on your behalf, including Xero, Paycircle, HMRC, Companies House and the bookkeeping tools you use. When we post journals or transactions to your Xero organisation, we do so as part of the work you have engaged us for.

We may also share information where the law requires it (for example with HMRC or a regulator such as ICAEW), to protect our rights or prevent fraud, or with a buyer if our business were ever sold, in which case this policy would continue to apply.

Where your information is stored

Our database is hosted in Ireland and our application runs in London. Several of our providers (including Vercel, Supabase, Google, Microsoft, Anthropic, Slack, Resend and Calendly) are US companies and may access or process information in the US. Where information leaves the UK, it is protected by UK adequacy regulations (which cover the EU as well as US companies certified under the UK extension to the EU-US Data Privacy Framework) or by the ICO’s International Data Transfer Agreement or Addendum in the provider’s data processing terms. Ask us and we will tell you which safeguard applies to any provider.

How long we keep it

• Accounting records, tax returns and working papers: while you are a client, then normally for six years after the end of the period they relate to, as UK tax, company and anti-money laundering law and our professional rules require. We keep them longer only while an HMRC enquiry, dispute or claim is open.
• Your account: while you have access. When your access ends we remove it; the audit trail of what you did stays with the records it relates to.
• Comments, settings and other platform data we do not need to keep as records: deleted within 90 days of the end of our engagement if you ask, or sooner if you ask us to erase it.
• Connections to Xero, HMRC and other services: the access tokens are deleted as soon as the connection is removed.
• HMRC information: not stored by the platform; what we rely on stays in your working papers for the period above.
• Technical records: kept only as long as they are useful for security, troubleshooting and cost control. Short-lived items, such as sign-in checks, are cleared automatically within minutes to 30 days.

How we protect it

• Everything is encrypted in transit (HTTPS) and at rest. Access tokens for Xero, HMRC, Google and other services are encrypted again with AES-256 before they are stored, as are any passwords we hold.
• Every page and request checks who you are and which client you may see, so one client can never see another’s data. Database rules add a second layer; the most sensitive tables can only be read by our server.
• Client users see only the areas we have given them. They can only change anything in your accounting system if we have switched that on for them.
• Sign-in is through Google or Microsoft, so their security (including two-step verification where you use it) protects your account.
• Alongside security headers, rate limits and audit logs, we review our security regularly.

No system is perfect. If a breach affects your information, we will tell you without delay. Where required we will report it to the ICO within 72 hours; if it involves HMRC data we will report it to HMRC too.

Found a security problem? Please email dave@sidgrove.com with “Security” in the subject. We will look at it straight away and thank you for telling us.

Cookies and storage on your device

We only use cookies the platform needs to work. We do not use advertising or tracking cookies, so we do not ask for cookie consent.

• Sign-in cookies (named authjs): keep you signed in for up to 30 days and protect sign-in from forgery.
• Connection cookies: last 10 minutes while you connect Xero or Google Drive, to make sure the connection is really yours.
• Proposal cookie: keeps a proposal open for you for up to 12 hours.
• Preference cookies: one remembers for up to 30 days whether demo mode (which hides figures) is on; another remembers for six hours that you have seen a welcome animation.

The platform also keeps your display preferences in your browser’s local storage, along with some recently viewed figures so pages load quickly. That stays on your device; on a shared computer, sign out and clear your browser data when you finish. Vercel measures page speed without cookies and without identifying you. If you use our booking page, Calendly may set its own cookies.

Your rights

You have the right to:

• be told how we use your information (this policy);
• get a copy of the information we hold about you;
• have anything inaccurate corrected;
• ask us to delete it, where we do not need to keep it by law;
• ask us to limit how we use it;
• object to uses based on our legitimate interests;
• receive the information you gave us in a format you can take to another provider. If you move to another accountant, we will export your data for you.

To use any of these, email dave@sidgrove.com. It is free and we will reply within one month. We may need to confirm who you are first.

Complaints. If you are unhappy with how we have handled your information, please tell us first at the same address. We will acknowledge your complaint within 30 days and put things right as quickly as we can. You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Children

Sidgrove Intelligence is for adults and is not meant for anyone under 18, though a client’s records may include information about children where tax law needs it (for example for Child Benefit).

Changes to this policy

We update this policy whenever what we do changes; the date at the top shows the latest version. If a change affects how we use your information in a way that matters, we will tell active clients by email before it takes effect. Our Terms of service explain the rules for using the platform.

Contact

Questions, requests or complaints about your personal information: email dave@sidgrove.com or write to Sidgrove Limited, 86-90 Paul Street, London, EC2A 4NE.