This policy explains how long ReceiptTidy, operated by JnDee Tech Limited, keeps information and how to request deletion. It supplements our Privacy Policy.
1. Requests
You may ask us to delete personal data where the UK GDPR right to erasure applies. Send the request to [email protected] or our postal address. No particular form, account email address or subject line is required, although enough detail to identify the account and data will help us respond.
We may ask for information reasonably needed to verify identity and prevent unauthorised deletion. We act without undue delay and normally within one month. Where the law permits, the time limit may be affected by necessary identity checks, may pause while we await clarification of an access request, or may be extended by up to two further months for a complex or multiple request. We will explain any applicable pause or extension and the response deadline. Legal exemptions may require us to retain limited information.
2. Account closure and member removal
An account administrator removing a member is an access-control action; it is not automatically a completed data-subject erasure assessment. A verified deletion request is reviewed across account records, customer content, connected services, communications, AI records, audit history and relevant suppliers.
On full account closure, we remove or anonymise live account and customer content unless the customer asks us to return it or an identified legal reason requires retention. Data already published into a customer's accounting platform remains under that customer's control.
You can also request deletion yourself, in-app or on the web, without contacting support first — see How to delete your account. A self-service request takes effect immediately (your login stops working); deletion begins 28 days after your request and completes within one month of it — the 28-day period is a cooling-off window during which you can contact support to cancel it.
3. Retention schedule
| Category | Normal period or decision rule | End-of-period action |
|---|---|---|
| Account/profile and organisation membership | While the account or customer relationship is active | Delete or irreversibly anonymise after verified closure, subject to necessary audit/legal records |
| Receipts, invoices, bank statements, attachments and extracted bookkeeping data | While the customer retains the record in ReceiptTidy or until account closure | Delete live database records and associated document objects |
| Inbound email and WhatsApp capture data | Only as needed to route, validate, import and support the receipt record | Remove transient copies; retain the resulting receipt record under the row above |
| Accounting-platform tokens | While the connection is active | Revoke where supported and delete when disconnected or the account closes |
| Support and sales conversations | While needed to answer the enquiry, support the relationship, resolve disputes and maintain service history | Delete or anonymise when those purposes end or after a valid request |
| AI suggestion and feedback records | While the account is active and the records remain useful for accuracy evaluation | Exclude new records after opt-out; delete or anonymise through a valid deletion request or on closure |
| Security, session and audit records | Only for the period reasonably needed to secure the Service, investigate abuse, demonstrate actions and defend legal claims | Delete, aggregate or pseudonymise when no longer needed; preserve a restricted minimum where integrity of an audit record requires it |
| Billing, tax and company records | For the statutory period applying to the record, commonly six years for UK company/accounting records | Secure deletion after the legal period |
| Production backups | Rolling backup cycle, normally no more than 30 days | Overwritten automatically; deletion instructions are reapplied if a backup is restored |
Customer bookkeeping-retention duties are separate from our retention of our own billing and company records. Customers decide how long their records must be retained in ReceiptTidy and connected accounting platforms.
4. Suppliers and backups
Where a supplier holds customer data on our behalf, we send deletion instructions where the data is not already removed by the supplier's normal lifecycle. Backup copies are isolated from ordinary use and age out through the rotation above. If a backup is restored, deletion requests recorded during the backup period are reapplied before normal access resumes.
5. Data that may remain
We may retain the minimum information necessary to comply with law, establish or defend legal claims, prevent fraud or preserve the integrity of an audit trail. Access is restricted, the information is not reused for unrelated purposes and it is deleted or anonymised when the reason ends.
6. Customer-controlled data
For personal data in documents uploaded by a business customer, that customer is normally the controller. We refer the request to the customer where appropriate and assist it under our Data Processing Agreement.
7. Complaints and contact
Contact [email protected]. If you are dissatisfied, you may also complain to the Information Commissioner's Office.
Revision 2026-09-23.1, published 23 September 2026.