Privacy Policy

1. Who we are

FiloApp is operated by Bitharmony Limited (“we”, “us”, “our”), a company registered in England and Wales, company number 17129740, with its registered office at Greenacres, Bittams Lane, Chertsey, Surrey, KT16 9QX.

For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Bitharmony Limited is the data controller of the personal data described in this Privacy Policy. We are registered with the Information Commissioner's Office under registration reference ZC195668

This Privacy Policy explains what personal data we collect when you use FiloApp, why we collect it, how long we keep it, who we may share it with, and the rights you have in relation to your personal data. If you have any questions about this Privacy Policy or how we process your personal data, please contact us at contact@filoapp.co.uk.

2. Data we collect

• Account information — your name, email address, password (stored only as a secure cryptographic hash), account settings, and subscription status.
• Business records — income, expenses, mileage trips, transaction categories, receipt images you scan or upload, bank statements and other files you import, and any notes you choose to add.
• HMRC data — where you authorise FiloApp to connect to HMRC, we store the authorisation tokens issued by HMRC, your Making Tax Digital (MTD) obligations and deadlines, information retrieved through HMRC’s approved APIs, and a history of submissions made through FiloApp.
• Banking data — where you upload bank statements, we receive the statement files together with transaction information such as dates, descriptions and amounts. We do not ask for, receive or store your online banking credentials.
• Device and usage data — information such as your IP address, device type, operating system, app version, log files and crash reports, which help us maintain the security, reliability and performance of FiloApp.

3. Why we use your data and our legal bases

We process personal data only where we have a lawful basis under UK data protection law.

• To provide FiloApp’s services — including keeping your digital records, generating summaries, and preparing and submitting information to HMRC at your request.Legal basis: Performance of our contract with you.
• To provide AI-assisted transaction categorisation suggestions when you request them. This processing happens only when you actively choose to use the feature.Legal basis: Performance of our contract with you.
• To import and process bank statements that you choose to upload.Legal basis: Performance of our contract with you.
• To provide customer support and respond to your enquiries.Legal basis: Performance of our contract with you.
• To protect FiloApp, prevent fraud and unauthorised access, maintain security, investigate technical issues, fix errors, and improve the reliability of the service.Legal basis: Our legitimate interests in operating a secure and reliable service.
• To comply with legal and regulatory obligations, including applicable tax, accounting and other legal requirements.Legal basis: Legal obligation.

Where we rely on your consent, for example for optional notifications, you may withdraw that consent at any time through the app settings or by contacting us.

4. HMRC data

FiloApp connects to HMRC only after you authorise us through HMRC’s own authentication and authorisation process.

We access only the information necessary to provide the services you request, including your Making Tax Digital obligations, the information required to prepare quarterly updates, and confirmation of submissions made through FiloApp.

We do not access your HMRC account unless you have authorised us to do so.

HMRC requires all software that connects to its Making Tax Digital APIs to send technical information about the device and connection being used, so that HMRC can detect and prevent fraud. This is a mandatory condition of HMRC's API terms of use and applies to every MTD-compatible product, not only FiloApp. This information is sent each time FiloApp communicates with HMRC on your behalf. It includes your public IP address, local IP addresses, a device identifier generated by FiloApp, your device model, operating system and screen size, your timezone, and the version of FiloApp you are using. It does not include any of your records other than the information you have asked us to send. Legal basis: performance of our contract with you. We cannot submit information to HMRC on your behalf without sending this data

You can revoke FiloApp’s access at any time through your HMRC online account or by disconnecting HMRC within the app. Once access has been revoked, we will no longer be able to retrieve information from HMRC on your behalf unless you authorise a new connection.

5. Banking data

FiloApp imports banking information only from the bank statement files that you choose to upload.

We do not connect directly to your bank account, and your bank does not provide transaction data to us directly.

You remain in control of the statement files you upload. Once transactions have been imported into your records, they remain part of your accounting records unless you choose to delete them.

6. Automatic categorisation and receipt scanning

To provide AI-assisted transaction categorisation suggestions when you request them, FiloApp may send limited transaction information, such as the transaction description, amount and date, to an AI service provider (Anthropic or OpenAI) for processing. This processing happens only when you actively choose to use the feature. Legal basis: performance of our contract with you.

When you upload receipt images, FiloApp uses optical character recognition (OCR) technology to extract information from those images and help populate your records.

These service providers process personal data on our behalf only for the purpose of providing the requested functionality. We require them to implement appropriate technical and organisational security measures and to process personal data only in accordance with our instructions.

7. Who we may share data with

We share personal data only where necessary to provide FiloApp or to comply with legal obligations, including the fraud prevention data described in section 4.

We require our service providers to process personal data only on our instructions, implement appropriate security measures, and use the data only to the extent necessary to provide their services.

We may share data with:

• HMRC — when you ask us to retrieve information or make a submission.
• Anthropic and OpenAI — to generate AI-assisted transaction categorisation suggestions when you request them.
• Our hosting and database providers — to run the app and store your records.
• Postmark — to send you transactional emails such as verification and receipts.
• Apple, Google and RevenueCat — to manage subscriptions and billing.
• Expo — o deliver push notifications and app updates.
• Crash reporting providers — to help detect and fix errors.

We do not sell personal data, and we do not share your records with advertisers. We may disclose data where required by law, or as part of a business sale or restructuring, in which case this Privacy Policy will continue to apply to the handling of your personal data.

8. How long we keep your data

We keep personal data only for as long as it is necessary to provide FiloApp, comply with legal obligations, resolve disputes and enforce our agreements.

• Business records — We keep your business records while your account remains active so they remain available to you. HMRC requires taxpayers to retain certain business records for specified periods, and you remain responsible for meeting those record-keeping obligations.
• Account information — We keep your account information while your account is active and delete or anonymise it within a reasonable period after your account is permanently closed, except where we are required to retain limited information to comply with legal or regulatory obligations, such as accounting or taxation requirements.
• Account deletion requests — If you request deletion of your account, we deactivate it immediately and schedule it for permanent deletion after a 14-day grace period. If you sign back into your account during that period, your deletion request is cancelled and your account is restored.

Where required by applicable law, we may retain certain financial records, submission history, billing information or other information for longer periods.

Before closing your account, we recommend using FiloApp’s export feature to download a copy of your records. Deleted information may remain in secure encrypted backups for a limited period before being permanently removed in accordance with our backup retention processes.

9. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration and disclosure.

These measures include encrypted data transmission, secure storage of sensitive credentials such as HMRC authorisation tokens, cryptographically hashed passwords, access controls, authentication, monitoring, logging and other security practices designed to protect the confidentiality, integrity and availability of your information.

Access to personal data is limited to authorised personnel and systems that require it to operate and support FiloApp.

Although no method of transmitting or storing information is completely secure, we continually work to protect personal data and collect only the information necessary to provide our services.

10. Your rights

Under UK data protection law, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data in certain circumstances;
• request restriction of certain processing;
• object to certain processing based on our legitimate interests;
• receive a copy of certain personal data in a portable format;
• withdraw your consent where processing is based on consent.

FiloApp also provides an export feature that allows you to download a copy of your business records at any time.

FiloApp does not make decisions that produce legal or similarly significant effects based solely on automated processing.

To exercise any of your rights, please contact us at contact@filoapp.co.uk.

If you believe we have not handled your personal data appropriately, you also have the right to complain to the Information Commissioner’s Office (ICO). We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

11. International transfers

Your personal data is primarily stored on servers located in the United Kingdom or the European Economic Area (EEA).

Some of our service providers, such as email delivery and AI service providers, may process personal data in countries outside the UK.

Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with UK data protection law. Depending on the destination and service provider, these safeguards may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, the UK’s International Data Transfer Agreement (IDTA), or the UK’s approved Standard Contractual Clauses.

12. Children

FiloApp is intended for individuals aged 18 and over and is not directed at children.

We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected personal data from a child, we will take reasonable steps to delete that information.

13. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes to FiloApp, changes in the law, or changes to the way we process personal data.

Where changes are significant, we will notify you through the app or by other appropriate means before the changes take effect where reasonably practicable.

The most recent version of this Privacy Policy will always be available within FiloApp and on our website, together with the version number and the date it was last updated.

14. Contact us

Bitharmony Limited
Greenacres, Bittams Lane, Chertsey, Surrey, KT16 9QX
contact@filoapp.co.uk