1. Who is responsible for your data
The company named at the top of this page operates NeatBeans and is the controller of personal data about our users, website visitors and trial and paying customers. Our contact details are on this page. Our ICO registration number is to be confirmed.
We are responsible for protecting the personal data we hold about you. Every connection to NeatBeans is encrypted with HTTPS, our hosting provider encrypts the disks and backups that store your records, receipt photos are kept in private storage that only your own account can reach, and strict access rules mean each account can only ever see its own records. Your records are held as one document per company and are not encrypted a second time inside the database, so we rely on the access controls above and on our provider's platform security to keep them private. Only people who need access to run the Service can reach it, and they are bound by confidentiality.
For personal data you put into NeatBeans about other people, such as your customers, suppliers, directors or staff, your company is the controller and we act as your processor under the data processing terms in our Terms and Conditions.
This policy applies to every version of NeatBeans: the website, the web app on desktop and mobile, trial and paid plans. We have not appointed a Data Protection Officer because we are not required to, but you can contact us about anything in this policy at the email address above.
2. What personal data we process and why
Here is the personal data we process, with a short note on why we need it. Section 3 sets out the lawful basis for each use.
Account details: your name, email address and password (stored only in scrambled form), so you can sign in and we can contact you about your account.
Company details: company name, number, registered office, SIC codes, incorporation date, officers, VAT number, UTR, bank details for invoices, logo and settings. Some of this comes from Companies House public records.
Your business records: quotes, invoices, customers, suppliers, expenses, receipt photos, mileage, bank statement lines, loans, dividends, assets and notes you enter or import. These may include personal data about other people.
Payment details: your chosen amount, subscription status and payment history from Paddle. Paddle handles your card or other payment details; we do not see or store them.
Support and feedback: messages you send us and any reason you give if you close your account.
Phone support calls: the phone number you call from, the time and length of the call, your account number and whether the support PIN was accepted, so we can connect you safely and stop misuse. We do not record the content of calls.
Technical data: IP address, browser and device type, log-in times, error logs and security events, needed to keep the Service working and safe.
We do not intentionally collect special category data (such as health or religion). Please do not put it into NeatBeans unless you genuinely need to.
3. Our lawful basis for processing personal data
UK GDPR says we must have a lawful basis for every use of your personal data. We rely on these: contract (we need it to provide the Service you signed up for), legal obligation (the law requires it, for example tax and accounting records), legitimate interests (it is reasonably necessary for running a fair and safe business and does not override your rights) and consent (you have said yes, and you can change your mind at any time).
To create and run your account and provide the Service: performance of our contract with you.
To take payments, manage your trial, grace period and read-only status, and keep financial records: contract and legal obligation.
To look up your company on Companies House and fill in details for you: legitimate interests in making setup quick, using public information.
To keep the Service secure, prevent fraud and abuse, fix faults and back up data: legitimate interests and, where relevant, legal obligation.
To send service messages, such as trial reminders, payment problems and changes to our terms: contract and legitimate interests. You cannot opt out of essential service messages while you have an account.
To send tips and product news: your consent or, for existing customers, our legitimate interests under the soft opt-in in the Privacy and Electronic Communications Regulations. You can unsubscribe at any time.
To understand why people leave and improve NeatBeans: legitimate interests. Feedback you give when leaving is optional.
To comply with law, respond to lawful requests and defend legal claims: legal obligation and legitimate interests.
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
4. Automated decisions
We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Your account moves to read only automatically after a failed payment and the 10-day grace period, and you can contact us at any time to review it.
5. Who we share it with
We share personal data only with trusted service providers who help us run NeatBeans, under contracts that require them to protect it and use it only on our instructions (or, where they act as an independent controller, under their own privacy policy). Each provider's privacy policy is linked below.
Lovable Cloud and its infrastructure partners: our cloud hosting, database, sign-in and file storage provider.
Paddle: our payment gateway and merchant of record. Paddle is an independent controller for payment data.
Resend: our system and marketing email provider. It sends the quotes, invoices and reminders you choose to send, showing your company name as the sender and your company email for replies, as well as our own service and marketing emails.
Google Workspace: our business email, document sharing, calendar and meetings.
Click4Assistance: our live chat tool, used when you chat with us on our website.
Less Annoying CRM: our sales and customer service CRM, where we keep records of our conversations with prospects and customers.
Google Analytics and Microsoft Clarity: tools that help us understand how customers and visitors use our website and app, so we can improve it. These only run if you accept analytics cookies in our cookie banner.
Facebook, Instagram and LinkedIn: our social media platforms. If you follow, message or interact with us there, those platforms process your data under their own privacy policies.
Companies House, when we look up a company number, and Twilio, our telephone provider, which connects phone support calls.
We may also share data with professional advisers, with a buyer if NeatBeans is sold (who will be bound by this policy), and with HMRC, the police, regulators or courts where the law requires it. We never sell personal data. We will update this list before adding a new provider that handles your data.
- Paddle privacy policy
- Resend privacy policy
- Google privacy policy (Google Workspace and Google Analytics)
- Click4Assistance privacy policy
- Less Annoying CRM privacy policy
- Microsoft privacy statement (Microsoft Clarity)
- Meta privacy policy (Facebook and Instagram)
- LinkedIn privacy policy
- Twilio privacy notice
6. International transfers
Some of our providers store or access data outside the UK, including in the European Economic Area and the United States. Where data leaves the UK, we make sure it is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
Account and business records: while your account is open. When you close it, we delete them within 30 days, and they leave our backups within a further 90 days.
Payment and billing records: 6 years after the end of the financial year they relate to, because tax law requires it.
Support messages and leaving feedback: up to 2 years, so we can follow up and learn from it.
Phone support call logs: up to 12 months.
Security and error logs: usually up to 12 months.
Receipt photos are stored in private cloud storage linked to your company and are deleted when you delete them, close the company or close your account.
Remember that your company has its own legal duty to keep accounting records, usually for at least 6 years. Please export your records before closing your account.
8. How we protect it
We encrypt every connection with HTTPS and HSTS, so plain web addresses are redirected and browsers are told to use the encrypted address only. Our hosting provider encrypts the disks and backups that hold your data, and the database sits behind strict access rules so each account can only see its own companies. Passwords are stored hashed rather than as text, receipt photos sit in private storage, HMRC access and refresh tokens are kept by our servers and are not sent to your browser, and staff access is limited to the people who need it. Each member of our team has a named account with only the access their role needs, every staff action is logged in a record that can't be changed, and nobody at NeatBeans can see your invoices, expenses or bank lines unless you switch on time-limited, read-only support access in Settings. We run regular backups and watch for unusual activity. No system is completely secure, so please use a strong, unique password and keep your devices up to date.
If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it where required, and tell affected users without undue delay. Where we hold the data as your processor, we will tell you so you can meet your own duties.
If a security breach affects your tax records or our connection to HMRC services, we will also report it to HMRC within 72 hours of becoming aware of it. We keep a written record of every breach, reported or not, so we can show what happened and what we did about it.
9. Your rights
Under UK data protection law you have the right to: be informed about how we use your data; access a copy of it; have it corrected; have it erased; restrict how we use it; object to processing based on legitimate interests and to direct marketing at any time; data portability, which you can do yourself with the export in Settings; and withdraw consent where we rely on it.
To use any right, email us. We will reply within one month, which can be extended by two months for complex requests. It is usually free. We may need to confirm who you are first. Some rights have limits, for example we may need to keep payment records for tax law.
If you are a customer or supplier of one of our users and want to use your rights over data held in their records, please contact that business first. We will help them respond.
10. Children
NeatBeans is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
11. Cookies and local storage
We only use strictly necessary cookies. Section 15 is our full cookie policy and explains each one.
12. Links to other sites
Our site links to services such as Companies House, HMRC and Paddle. Their own privacy policies apply when you visit them.
13. Complaints
If you are unhappy with how we handle your data, please contact us first and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
14. Changes to this policy
We will update this policy when our services or the law change, and change the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.