Privacy Policy

1. Who is responsible for your data

Syntaxion Ltd(“we”, “us”, “Syntaxion”) is the data controller for the personal data processed in Bookkeep. We decide what data is held and why.

Syntaxion Ltd is a company registered in England and Wales, company number 12604886, with its registered office at Lytchett House, 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, Dorset, BH16 6FA.

For any question about this policy, or to exercise any of the rights described in section 10, contact us at info@syntaxion.co.uk or by post at the address above.

2. What data we hold

Bookkeep holds the following categories of personal data.

Account and sign-in data

• Email address and display name of each user.
• A password hash (Argon2). We never store your password itself.
• A two-factor authentication (TOTP) secret and recovery codes, stored encrypted and hashed respectively.
• Sign-in records: the time of each sign-in, the IP address the request came from, and the browser user-agent string. These are kept for the life of the session record and in the audit log.

Business and accounting records

• Company details: registered name, Companies House number, VAT registration number, registered address, VAT scheme and return period.
• Bank accounts, transactions, invoices, bills, categories and reconciliation data.
• Names, email addresses, phone numbers and addresses of customers and suppliers entered as contacts, and any personal data included in invoice or transaction descriptions.
• Computed VAT return figures (boxes 1–9) for each accounting period.

Payroll data

Where payroll is used, Bookkeep holds employment records that include National Insurance numbers and dates of birth. Specifically: name and title, date of birth, National Insurance number, gender as recorded for RTI, home address, employment start and leaving dates, payroll ID, tax code, student loan plan, pay frequency, salary, pension contributions, and the gross pay, tax, National Insurance and net pay calculated for each pay period.

HMRC connection data

• OAuth client credentials and the access and refresh tokens issued by HMRC when a user authorises Bookkeep to file VAT returns. Tokens and secrets are encrypted at rest.
• Government Gateway user IDs and passwords used for PAYE RTI submissions, held per employer and encrypted at rest.
• A log of every HMRC API request and response — the URL, status code, headers and body — so that submissions can be evidenced and problems diagnosed. Access tokens and other credentials are redacted from these logs before they are written.

Bank feed data

If a user connects a bank account through open banking (currently Monzo), Bookkeep stores the access and refresh tokens for that connection, encrypted at rest, and the transactions retrieved from the accounts the user has explicitly ticked. Accounts are never adopted automatically — a user must select each account before any of its transactions are imported. Open banking consent lapses after 90 days, as required by the regulations, and must be renewed.

Audit log

Every change to a tracked record is written to an append-only audit log capturing who made the change, when, what the record looked like before and after, and the IP address and user-agent of the request. Sensitive columns — password hashes, encrypted secrets and token hashes — are redacted before the entry is written.

3. Data sent to HMRC for fraud prevention

HMRC requires every application that submits VAT returns through the MTD API to send a set of Gov-Client-* and Gov-Vendor-* HTTP headers with each call. These headers help HMRC detect fraudulent submissions and identify compromised credentials. Sending them is a condition of using the API — it is not optional, and it is not something we do for our own purposes.

The information transmitted in these headers includes:

• The public IP address and port your device connected from, and the timestamp of the connection.
• A device identifier — a random UUID stored in a long-lived cookie in your browser (see section 7), which lets HMRC recognise repeat submissions from the same device.
• The operating-system account name of the user performing the submission.
• Your browser's user-agent string, screen and window dimensions, colour depth, timezone, installed plugins and Do Not Track setting.
• Local (private) network IP addresses of the device.
• The time you last confirmed your identity with two-factor authentication.
• Identifying information about the software itself: product name, version and build.

This data is transmitted to HMRC over TLS at the moment of submission. HMRC’s own handling of it is governed by the HMRC Developer Hub privacy notice and HMRC’s privacy notice. The full specification of the headers is published in HMRC’s fraud prevention guidance.

4. Why we process it, and our lawful basis

5. Who we share data with

We do not sell personal data, we do not share it for advertising, and we do not use it to train machine-learning models. Bookkeep runs no third-party analytics, tracking pixels or advertising scripts of any kind. Data leaves the application only in these cases:

• HM Revenue & Customs — VAT return figures, the VAT registration number, PAYE and employee data in RTI submissions, and the fraud-prevention headers described in section 3.
• Your bank (currently Monzo) — only where you have connected an account, and only to authenticate and retrieve your own transactions.
• Our hosting and backup providers — who store the encrypted database and its backups on our behalf and do not access the contents.
• Our outbound email provider — where an invoice, reminder or account invitation is emailed to a recipient you have specified.
• Our accountants, auditors, or a regulator or court, where we are required or permitted by law to disclose records.

6. How we protect it

• All traffic to the application is served over HTTPS with certificates provisioned automatically; there is no unencrypted access.
• Passwords are hashed with Argon2 and are never recoverable, by us or by anyone else.
• Two-factor authentication (TOTP) is required for user accounts.
• Secrets held on behalf of users — HMRC OAuth tokens and client secrets, Government Gateway passwords, bank feed tokens and TOTP secrets — are encrypted at rest with libsodium authenticated encryption, under a key held outside the database.
• Access is restricted to named internal users with role-based permissions, and every record is scoped to a single company so that one company's data is never returned to another.
• All state-changing requests carry CSRF protection.
• Records included in a finalised VAT return are locked and cannot be altered or deleted, preserving the integrity of what was filed.
• The database is backed up nightly. Backups are encrypted before they leave the server and are stored encrypted off-site.

No system is perfectly secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell affected individuals where required to do so.

7. Cookies

Bookkeep sets only the cookies it needs to function. There are no analytics, advertising or third-party tracking cookies, so no cookie consent banner is required.

You can delete these cookies through your browser at any time. Deleting the session cookie signs you out; deleting the device identifier causes a new one to be generated on your next submission.

8. How long we keep it

• VAT records and the digital links behind them are kept for at least 6 years from the end of the accounting period, as HMRC requires.
• Payroll records are kept for at least 6 years after the end of the tax year they relate to.
• Audit log entries and HMRC API request/response logs are retained alongside the records they evidence, so that a submission can be reconstructed and explained years later.
• Session records expire and are cleared automatically; user accounts are disabled rather than deleted where deleting them would break the audit trail on records they changed.
• Encrypted backups are retained for 30 days on the server and are held off-site beyond that for disaster recovery.

Where a statutory retention period applies, we cannot delete the underlying record before it expires, even on request — see section 10.

9. Where your data is stored

Bookkeep is self-hosted. The application, its database and its backups are held on servers located in the United Kingdom and the European Economic Area. We do not transfer personal data outside the UK or EEA, other than the submissions made to HMRC (which are within the UK) and any transfer inherent in a bank feed you have chosen to connect.

10. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Ask what personal data we hold about you and receive a copy of it.
• Have inaccurate data corrected.
• Ask us to delete data, where we are not required to keep it for tax, accounting or legal reasons.
• Ask us to restrict processing, or object to processing carried out on the basis of legitimate interests.
• Receive data you gave us in a portable, machine-readable format.
• Withdraw consent, where processing is based on consent — for example by disconnecting a bank feed.

Email info@syntaxion.co.uk to exercise any of these. We will respond within one month.

We do not carry out automated decision-making or profiling that produces legal effects. VAT figures are calculated from the records you enter, and no return is submitted to HMRC until a user reviews and confirms it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to resolve it first.

11. Changes to this policy

We may update this policy as the software changes or as HMRC’s requirements change. The date at the top of this page shows when it was last revised. Material changes affecting how personal data is used will be communicated to affected users directly.