Privacy Policy

1. Who we are

Sterling Ledger (“we”, “us”) operates this website and the marketplace at apisterlingledger.co.uk. We are the data controller for the personal data you give us. You can contact us at info@sterlingledger.co.uk.

2. What data we collect

Account data — name, email, phone, postal address, password (stored hashed by our auth provider), profile picture.

Case data — the information you fill in to prepare your return: income, expenses, employer, bank interest, property details, company numbers, documents you upload (payslips, invoices, bank statements, HMRC letters, previous returns, etc.). For limited company clients, this includes your Companies House number and the Companies House authentication code (encrypted at rest).

Payment data — handled by Stripe. We never see your full card details. We retain Stripe charge IDs, amounts, invoice numbers, and payment status.

Communications — messages between you and your accountant through the platform, support messages, and attachments.

Technical data — IP address, device + browser info, pages visited, timestamps. Standard for every website.

3. Why we collect it

We process your data to deliver the service you’re paying us for: match you with an accountant, let you upload documents, let your accountant prepare and file your return, charge you, and send you receipts + reminders. The lawful basis for this is contract — we need the data to perform the service.

Where we send you occasional service emails (e.g. an incident on the platform, policy changes), the lawful basis is legitimate interest. We don’t do marketing emails without your opt-in.

4. Who we share it with

Your assigned accountant — sees everything on your case. Changes if we reassign the case; the previous accountant loses visibility.

Stripe — payment processing. See Stripe’s privacy notice.

Supabase — hosts our database and file storage. See Supabase’s privacy notice.

Vercel — hosts the application. See Vercel’s privacy notice.

HMRC and Companies House — where submitting your return or company accounts, your data is sent to these authorities as required.

We do not sell your data to anyone, ever.

5. International transfers

Stripe, Supabase, and Vercel all involve data stored in or routed through servers outside the UK (primarily in the US and EU). These transfers are protected by standard contractual clauses (SCCs) as required by UK GDPR.

6. How long we keep it

We retain your data for as long as you have an account with us, and for a reasonable period after you close it, so we can meet legal, accounting, and tax recordkeeping obligations. In practice this is 6 years after the last activity, which matches the retention period HMRC expects for tax records.

Payment records are retained for the period our payment processor and tax law require.

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you
• correct inaccurate data
• ask us to delete your data (where we don’t have a legal obligation to keep it)
• object to processing or ask us to restrict it
• receive your data in a portable format
• withdraw consent at any time, where consent is the lawful basis

Email us at info@sterlingledger.co.uk to exercise any of these. We respond within one calendar month.

8. Complaints

If you think we’ve mishandled your data, you can complain to the UK Information Commissioner’s Office: ico.org.uk. We’d rather hear from you first so we can fix it.

9. Cookies

The marketing site uses a single functional cookie set by our hosting provider for basic performance tracking. The application sets authentication cookies when you’re signed in — these are strictly necessary to keep you logged in. We don’t use advertising or cross-site tracking cookies.

10. Children

The service is not for anyone under 18. Don’t register if you’re younger than that.

11. Changes

We update this policy when the service changes materially. The current version is always at this URL. Material changes are emailed to active users.