This policy explains how long ReceiptTidy (operated by [COMPANY_LEGAL_NAME]) keeps your data and how you can ask us to delete it. It supplements our Privacy Policy.
1. Your right to erasure
Under UK GDPR (Article 17) you can ask us to delete personal data we hold about you. We will action valid requests without undue delay and within one month, unless an exemption applies (for example, where we must keep certain records to comply with a legal obligation).
2. How to request deletion
Email [PRIVACY_EMAIL] from the address associated with your account, with the subject "Data deletion request". Tell us whether you want: (a) deletion of specific data, or (b) closure of your account and deletion of associated personal data. We may need to verify your identity before we act, to protect your data.
We aim to add a self-service "delete my account" option in-app in a future release; until then, email is the route.
3. What happens when you delete / close
- Account & profile data: deleted or irreversibly anonymised.
- Uploaded receipts/invoices & extracted data: deleted from the application database and from encrypted object storage.
- Connection tokens (QuickBooks/Xero/etc.): revoked and deleted. This does not delete data already published into your own accounting platform — you control that in the platform itself.
- Backups: deletion propagates to backups within our backup rotation window (see below).
4. Retention schedule
| Data | Retention |
|---|---|
| Account & content while your account is active | For the life of the account |
| After account closure / deletion request | Deleted/anonymised promptly, subject to legal holds |
| Records we must keep by law (e.g. billing/tax) | As required by law (commonly up to 6 years for UK accounting records) |
| Security & audit logs | A limited period for security and abuse-prevention |
| Backups | Until they age out of the backup rotation, then overwritten |
5. Data we may retain after deletion
We may retain limited data where necessary to: comply with legal, accounting or tax obligations; resolve disputes; prevent fraud and abuse; or enforce our agreements. Such data is restricted to what is necessary and is deleted when no longer required.
6. Customer-uploaded third-party data
Where you upload documents containing other people's personal data, you are the controller of that data and we process it on your behalf (see the Data Processing Agreement). On account closure we delete or return it per that agreement.
7. Contact
Data deletion and retention questions: [PRIVACY_EMAIL]. You may also complain to the ICO (ico.org.uk).
Last updated: [LAST_UPDATED].