Draft · not legal advice
Privacy notice
This draft describes how UBL HOLDINGS LTD (company 11940647), registered office Henge Barn, Pury Hill Business Park, Alderton Road, Towcester, Northamptonshire, NN12 7LS, United Kingdom, operates QuarterClose. It should be reviewed by a solicitor before a paying practice is onboarded, and the £52 ICO data protection fee should be paid before live client data is processed.
Who is responsible
For the practice account (your name, email, password and invoices) UBL HOLDINGS LTD is the controller. For receipts, client names and the tax records inside them, the accounting practice is the controller and UBL HOLDINGS LTD is the processor. Clients of the practice do not have QuarterClose accounts. A processing schedule should sit in the practice agreement before real records are loaded.
What we hold
Practice contact details and a hashed password. Client name, email, mobile number, trade and notes, and whether they have opted in to WhatsApp. Inbound emails and WhatsApp messages, receipt photos, PDFs and voice notes, the transcript of a voice note, and the date, supplier, amount, VAT and category extracted from them. Clarification replies. Chase messages. An audit log of who did what, including STOP and opt-in. Invoice references. We do not take card numbers. Bank details for a manual invoice are sent with the invoice and are not stored in the app.
Why
To run the practice account and to collect, chase and categorise records for Making Tax Digital quarterly updates, on the practice’s instructions. The practice account is handled for the contract. Client records are handled as a processor. We do not sell data and we do not use it to train a public model.
Retention and deletion
Each practice sets how long receipt files are kept. The default is 72 months, which covers the usual duty to keep self-assessment records for 5 years after the 31 January filing deadline. A purge deletes the file, the extracted line and the clarification. The audit log is kept so the deletion itself is recorded. You can also ask us to erase a practice by writing to the registered office.
Security
Receipt files and the raw email body are encrypted at rest with AES-256-GCM. Passwords are hashed with scrypt. The session cookie is httpOnly. The database file should sit on an encrypted disk as well. Access by the practice is limited to its own clients.
Other companies
In the default mock mode, extraction and WhatsApp stay on the server you host. If you set an inbound provider, Postmark or Mailgun will receive the client’s email. If WHATSAPP_PROVIDER is meta, message content, media and phone numbers are processed by Meta Platforms under the WhatsApp Business Cloud API, which is outside the UK. Voice notes sent to OpenAI for transcription, and receipt text sent to OpenAI or Anthropic, likewise leave the UK. A transfer assessment is then required. If billing is switched to Square, invoice name, email and amount are sent to Square. No provider is called unless its environment variable is set. A client who replies STOP is not sent further WhatsApp templates.
Cookies
One session cookie, qc_session, so the practice stays signed in. No analytics cookies.
Rights
People can ask for access, correction, erasure, restriction and objection, and can complain to the Information Commissioner’s Office at ico.org.uk. Client requests about their receipts should go to their accountant first, because the practice decides the records. Practice account requests can be sent to the registered office of UBL HOLDINGS LTD.