Legal
Effective from 17 July 2026

Privacy Policy

Last updated: 17 July 2026
This Privacy Policy explains how Bookfolio handles personal data.
Bookfolio is provided by BOOKFOLIO LTD, a company registered in England and Wales with company number 17260970 and registered office at 26 John Hogan V C Road, Manchester, England, M40 7QU.
For privacy questions, requests, or complaints, contact hello@bookfolio.net.

1. Controller

BOOKFOLIO LTD is the controller for personal data we process for our own purposes, such as account administration, security, billing, support, product improvement, and marketing.
When a customer uploads or creates accounting records that contain personal data about their own staff, suppliers, customers, contacts, directors, shareholders, or other people, the customer is normally the controller for that content and Bookfolio processes it to provide the service.

2. Data we collect

We collect and process the following types of data where relevant:
•
account data, such as name, email address, password authentication data, and user role;
•
business data, such as company name, book type, income sources, registered address, accounting settings, VAT settings, and team membership;
•
customer content, such as transactions, ledgers, contacts, invoices, bills, receipts, uploaded documents, notes, comments, imports, reports, and audit history;
•
support data, such as messages you send us, feedback, screenshots, and issue details;
•
billing data, such as plan, subscription status, invoices, payment status, and billing contact details;
•
technical data, such as IP address, device type, browser, operating system, session identifiers, request logs, crash data, security events, and usage events;
•
marketing data, such as email preferences, consent records, campaign events, and website interaction data.
We do not intentionally collect special category data. If you upload documents or records that contain special category data, we process that content only as needed to provide, secure, support, and maintain Bookfolio.
Bookfolio is not intended for children, and we do not knowingly collect data from anyone under 16.

3. Where data comes from

We collect personal data:
•
directly from you when you create an account, use the product, contact us, or subscribe to updates;
•
from other users in your organisation when they invite you, assign roles, or add business records involving you;
•
from files, imports, and integrations you or your organisation choose to use;
•
automatically from your device, browser, and use of the service;
•
from service providers that help with hosting, security, email, billing, support, analytics, app distribution, or error reporting.

4. How we use data and lawful bases

We use personal data for these purposes:
•
to provide Bookfolio, authenticate users, manage sessions, keep accounts secure, and operate customer workspaces. The lawful basis is contract;
•
to process accounting records, imports, reports, uploaded documents, audit events, and product workflows. The lawful basis is contract, and in some cases the customer's legitimate interests;
•
to send service emails, security alerts, password resets, invites, billing notices, and important product notices. The lawful basis is contract or legitimate interests;
•
to manage subscriptions, payments, invoices, debt prevention, and accounting. The lawful basis is contract and legal obligation;
•
to monitor, debug, protect, back up, and improve the service. The lawful basis is legitimate interests;
•
to meet legal, tax, accounting, security, fraud-prevention, and regulatory obligations. The lawful basis is legal obligation or legitimate interests;
•
to send marketing where permitted. The lawful basis is consent or legitimate interests, depending on the message and relationship.
Our legitimate interests include running a secure SaaS product, preventing fraud and misuse, supporting customers, improving product reliability, understanding feature use, and developing Bookfolio for UK accounting workflows.
You have an absolute right to object to direct marketing at any time.

5. UK hosting

Customer account, business, accounting, and uploaded document data is stored on UK servers. The current production infrastructure stores application database records and uploads in Google Cloud's London region, europe-west2.
Backups, audit records, logs, and security records are kept as needed to operate, protect, and restore Bookfolio. Cloudflare may process technical request metadata at the edge to deliver and protect the public website, but Bookfolio does not use Cloudflare as the system of record for customer content.

6. Sharing data

We share personal data only where needed for the purposes in this policy. Recipients may include:
•
cloud hosting, database, storage, backup, monitoring, and security providers;
•
email delivery and communication providers;
•
payment, invoicing, subscription, and tax providers if paid plans are used;
•
app store, mobile release, and device notification providers;
•
analytics, error reporting, and product diagnostics providers, including PostHog (PostHog Inc.) for product analytics with EU hosting, which receives data only where you have given analytics consent;
•
professional advisers, insurers, auditors, banks, and accountants;
•
HMRC, Companies House, courts, regulators, law enforcement, or public authorities where required or reasonably necessary;
•
another organisation involved in a merger, acquisition, financing, restructuring, or sale of our business, subject to appropriate safeguards.
We require service providers to protect personal data and use it only for the services they provide to us.

7. International transfers

Customer content in the Bookfolio application is stored on UK servers. Some service providers may process limited account, support, email, billing, security, or website metadata outside the UK.
Where an international transfer is needed, we use safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

8. Retention

We keep personal data only for as long as needed for the purposes in this policy, including providing the service, meeting legal obligations, resolving disputes, enforcing agreements, maintaining backups, and protecting security.
Accounting records and VAT-related records may need to be kept by customers for at least six years. Bookfolio therefore allows customer accounting records to remain available while the customer account is active unless deletion controls are used or a separate agreement says otherwise.
When an account is closed, we may retain limited records where required for tax, accounting, legal, fraud-prevention, security, backup, or dispute purposes. We delete or anonymise data when it is no longer needed, subject to backup and legal-retention constraints.

9. Your rights

Depending on the circumstances, you may have the right to:
•
access your personal data;
•
correct inaccurate or incomplete personal data;
•
ask us to delete personal data;
•
restrict how we use personal data;
•
object to processing based on legitimate interests;
•
object to direct marketing;
•
receive certain data in a portable format;
•
withdraw consent where processing is based on consent;
•
complain to the Information Commissioner's Office.
These rights are not absolute. For example, we may need to keep some records to meet legal obligations, protect security, resolve disputes, or maintain accounting records.
To exercise rights, contact hello@bookfolio.net. We may need to verify your identity before acting on a request.
If your data is in a customer workspace controlled by your organisation, we may refer your request to that organisation or ask you to contact them directly.

10. Cookies and similar technologies

Bookfolio uses essential cookies, local storage, secure storage, and similar technologies to keep you signed in, remember settings, secure sessions, prevent fraud, and operate the service.
Analytics cookies and similar technologies are used only with your consent. Bookfolio uses PostHog, hosted in the EU, to understand how the website and product are used so we can improve them. On the website you can accept or reject non-essential cookies when you first visit and change your choice at any time from the Cookie settings link in the footer. Signed-in users can also change product analytics at any time from Settings → Privacy, and the same control is available in the mobile app. No analytics data is collected before consent, and turning analytics off stops collection immediately.
Advertising and non-essential marketing cookies are not currently used. If they are introduced, we will ask for consent where required and provide controls to withdraw that consent.
You can also control cookies through your browser or device settings, but blocking essential storage may stop parts of Bookfolio from working.

11. Automated decisions

Bookfolio may use automation to classify, organise, suggest, reconcile, or summarise accounting information. These features are intended to support user review.
We do not use solely automated decision-making that produces legal or similarly significant effects about individuals without appropriate notice, controls, and a lawful basis.

12. Security

We use technical and organisational measures designed to protect personal data, including access controls, session controls, audit records, backups, monitoring, and secure cloud infrastructure.
No online service is perfectly secure. You should protect your devices, passwords, email accounts, and invited-user access.
If you believe personal data or an account has been compromised, contact hello@bookfolio.net promptly.

13. Changes to this policy

We may update this policy as Bookfolio, our providers, or legal requirements change. If a change is material, we will take reasonable steps to notify you, such as by email or an in-product notice.
The latest version will be available at /privacy.

14. Contact and complaints

For privacy questions or requests, contact:
BOOKFOLIO LTD (company number 17260970) 26 John Hogan V C Road Manchester England M40 7QU
Email: hello@bookfolio.net
You can complain to the Information Commissioner's Office if you are unhappy with how we handle personal data. The ICO is the UK data protection regulator.