Privacy Policy

Effective Date: August 8, 2026

1. Introduction

Welcome to 2plus1finance (operated by TwoPlusOne Studios Ltd). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (2plus1finance.com) and use our mobile application 2plus1finance app.

2. Information We Collect

To provide our invoicing, expense tracking, and mileage services, we collect the following types of information:

• Personal Information: When you create an account we collect your name, email address, company name and a password (stored only as a secure cryptographic hash). You can also add a phone number and business address to appear on your invoices, and if you join or run a team we record your role and workspace membership.
• Financial & Business Data: We store the data you actively input into the App, including invoice details, client contact information, expense amounts, and custom vehicle rates.
• Bank Statement Data: If you use the bank statement import feature, we store the transactions from the file you upload (date, description, amount and account label) so you can match them against your receipts and records. Transactions you mark as personal are excluded from your business figures but retained as part of your digital tax records.
• User Content (Images & Files): The receipt and statement images you scan (used to extract text and create expense records), and any documents you choose to keep in the Files area, together with basic details such as filename, folder and who uploaded them.
• Location & Vehicle Data: If you use our Mileage Tracker, we process the start, stop and destination points you enter (via Mapbox) to calculate route distances — we never track your location in the background. The journeys you save (the addresses entered, distance and vehicle used) are kept as part of the expense record, along with the vehicle details you provide for HMRC mileage rates (name, registration number, fuel type and engine size).
• Security & Usage Logs: When you use the service we automatically record technical information — your IP address, browser/device type and the action performed — to keep accounts secure, detect fraudulent login attempts and diagnose problems, along with basic feature-usage counts (such as how many receipts you have scanned). We never log the content of what you submit: your passwords, receipts and financial figures are excluded from logs.
• Payment Information: We do not process or store your credit card data on our servers. Subscription payments made via our website are processed by GoCardless, and subscription payments made via the iOS app are processed by Apple through the App Store. We only receive transaction identifiers, subscription status, and renewal dates — never your full card or bank details.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the App's core features (generating invoices, tracking expenses, and calculating profit & loss).
• Authenticate your account and secure it using Two-Factor Authentication (MFA).
• Utilize Optical Character Recognition (OCR) and AI to read and extract data from the receipts you upload.
• Calculate driving routes and mileage claims.
• Send you administrative emails, such as password resets and subscription updates.
• Provide customer support.

4. Our Legal Bases

Under UK GDPR we rely on: Contract — providing the service you signed up for (your account, invoicing, expense tracking, mileage, file storage and subscription billing); Legal obligation — keeping the digital records UK tax law requires (including Making Tax Digital), which is why certain financial records and their audit trail are retained even after deletion; Legitimate interests — keeping the service secure (security logs, fraud and abuse prevention) and telling you about important service changes; and Consent where we ask for it, which you can withdraw at any time.

5. How We Share Your Information

We do not sell your personal data. We only share information with trusted third-party service providers necessary to operate the App:

• Receipt Scanning (Microsoft Azure): When you scan a receipt or statement, the image is sent securely to Microsoft's Azure AI Document Intelligence service in Microsoft's UK South (London) region, which reads it and returns the extracted details (vendor, date, amounts) to us. Microsoft processes images on our behalf as a data processor and does not use your documents to train its AI models.
• Email Delivery: We use trusted email providers (currently Resend, with Brevo as a backup) to send account emails — verification codes, security codes, password resets, billing notices and team invitations — and, when you choose to email an invoice or report, to deliver it with the PDF attached to the recipient you specify. These providers tell us whether an invoice email was delivered, opened or bounced so we can show you its status.
• Mapping Services (Mapbox): Address look-ups and route calculations are sent to Mapbox through our servers to work out driving distances. The map itself loads in your browser or app directly from Mapbox, so — as with any embedded map — Mapbox also receives your device's IP address when maps are displayed.
• Payment Processors: We share necessary account identifiers with GoCardless (for web subscriptions) and Apple (for iOS In-App Purchases) to manage and verify your subscription.
• Hosting: Your account data is stored on our own servers hosted in the United Kingdom (IONOS UK data centres). Our public website is delivered through Cloudflare, which processes visitor IP addresses to serve and protect the site.

6. Your Clients' Information

If you store client details or send invoices, you are entrusting us with your customers' personal data (name, email, address). We process it only on your instructions: to keep your client book, generate invoices, email them to the recipients you choose, and show you each email's delivery status (sent, opened or bounced). We never use your clients' details for our own purposes or marketing. As our customer, you are the data controller for your clients' information and are responsible for using it lawfully — for invoicing an existing customer this is normally straightforward.

7. Data Retention & Deletion

We keep your personal and financial data only for as long as your account is active or as needed to provide you with our services, with the exceptions below.

• Trash: Deleted items move to the Trash first, so you can restore them. You can permanently delete most items from the Trash yourself; deleted files are automatically purged after 30 days.
• Tax records: Because the service keeps digital records for UK tax purposes (Making Tax Digital), some financial records — including imported bank transactions and the audit trail of imports and deletions — are retained even after you remove them from view, in line with HMRC record-keeping requirements (generally at least 5 years after the relevant Self Assessment deadline).
• Security logs: Kept for 90 days and then deleted automatically.
• Account Deletion: You have the right to request the complete deletion of your account and all associated data by contacting us; we will action it promptly, keeping only what tax law requires us to retain.

8. International Transfers

We are a UK company; your account data is stored in the United Kingdom and receipt scanning is processed in Microsoft's UK South (London) region. Some of our service providers process limited data outside the UK — for example our email delivery providers, Apple and Mapbox operate from the United States, and Brevo from the EU. Whenever data leaves the UK we rely on UK adequacy regulations or the UK International Data Transfer Agreement/Addendum with the provider, so your data receives equivalent protection.

9. Data Security

We implement industry-standard security measures to protect your data, including encrypted (HTTPS/TLS) connections to our servers, passwords stored only as salted cryptographic hashes, secure login sessions (JWT) that we can revoke, and optional Two-Factor Authentication (MFA). However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Cookies & Device Storage

We do not use advertising or analytics cookies, so we don't show a cookie banner. The app and website store only what is strictly necessary on your device: your login token (so you stay signed in), cached copies of your own data for speed and offline use (including expenses saved while offline, which sync when you reconnect), and — if you enable Face ID or Touch ID — your login token in your device's secure Keychain/Keystore. Your biometric data itself never leaves your device and is never seen by us. Logging out or uninstalling the app clears this storage.

11. Your Data Protection Rights (UK GDPR)

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request Erasure of your personal data ("Right to be forgotten").
• Restrict or Object to our processing of your data.
• Data Portability — request a copy of your data in a structured, machine-readable format. You can also export your expenses and invoices to CSV yourself at any time from the Summary page.
• Withdraw Consent at any time, where we rely on your consent.
• Complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113 — though we would appreciate the chance to resolve your concern first.

To exercise any of these rights, please contact us using the details below.

Email: [email protected]

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by updating the "Effective Date" at the top of this page and, where appropriate, sending an email notification.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Data Controller: TwoPlusOne Studios Ltd, registered in England & Wales (Company No. 15822091)
Registered office: 4 Laurel Drive, Bulphan, Upminster, England, RM14 3EG
Email: [email protected]
Website: 2plus1finance.com