Privacy Policy
Last updated:
Scale Platforms Ltd ("we", "us", "our") operates the TradeDocket and Grocery Tracker applications. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
Scale Platforms Ltd
Email: privacy@scaleplatforms.co.uk
2. Data We Collect
2.1 Account Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Email address | Account login, notifications | Contract performance |
| Name | Display in app | Contract performance |
| Auth0 user ID | User identification and data isolation | Contract performance |
| Authentication method | Passkey or password login | Contract performance |
2.2 Receipt Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Receipt images | OCR extraction and record-keeping | Contract performance |
| Merchant name and address | Expense categorisation | Contract performance |
| Transaction date and time | Tax year assignment | Contract performance |
| Line items and prices | Categorisation and totals | Contract performance |
| VAT amounts | HMRC self-assessment support | Contract performance |
| Category and HMRC category | Tax reporting | Contract performance |
2.3 Bank Statement Data (Trade App)
Bank statement capture is optional. It is only used if you choose to scan or upload a statement, and you can delete a captured statement at any time.
| Data | Purpose | Lawful Basis |
|---|---|---|
| Bank statement file (PDF or photo) you upload | Extracting the transactions on it, and letting you check a line against the original | Contract performance |
| Transaction date, description and amount | Expense recording and tax reporting | Contract performance |
| Bank name shown on the statement | Grouping transactions by the statement they came from | Contract performance |
| Category and HMRC category | Tax reporting | Contract performance |
| Link between a transaction and a matching receipt | Preventing the same expense being counted twice | Contract performance |
What we do not do: we do not connect to your bank, use open banking, or hold any banking credentials. We only read a file you choose to give us. We never use your statement data to train AI models.
A statement may show more than business expenses. It can include personal spending, income, and your account balance. Only the transactions are extracted; anything you have not categorised as a business expense is excluded from your tax figures and exports. You can delete any transaction, or the whole statement, at any time.
2.4 Project Data (Trade App)
| Data | Purpose | Lawful Basis |
|---|---|---|
| Project names | Job costing and organisation | Contract performance |
| Client names | Job tracking | Contract performance |
| Budget amounts | Financial tracking | Contract performance |
2.5 Budget Data (Grocery App)
| Data | Purpose | Lawful Basis |
|---|---|---|
| Budget names and amounts | Household spending tracking | Contract performance |
| Category limits | Spending alerts | Contract performance |
2.6 Technical Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| IP address | Security, abuse prevention | Legitimate interest |
| Browser/device type | Service optimisation | Legitimate interest |
| Application logs | Debugging and service reliability | Legitimate interest |
2.7 Free Receipt Tool (No Account)
Our free receipt-to-Excel tool works without an account. Receipt images you upload are
processed in memory and never stored — no image, and no extracted receipt
content, is retained. To keep the tool free and prevent abuse we keep an anonymous daily
usage count against a one-way salted hash of your IP address (never your raw IP). If you have
accepted analytics cookies, this count is instead keyed to a random browser identifier
(td_anon_id — see our Cookie Policy); if you have not, your
IP hash is used and no browser identifier is stored. These records contain no receipt content
and are deleted automatically after 90 days.
2.8 Optional Account Acquisition Source
After creating a new TradeDocket web account, you may answer "Where did you hear about us?" or skip the question. We keep a fixed choice, its response time and skipped/answered status with your account in UK storage to understand which channels bring accounts and subscriptions. No free-text details or new tracking cookies are required, and your answer does not grant analytics or advertising permission. A Facebook answer is not proof of a paid-ad click. Reporting uses grouped counts. We rely on your voluntary consent for the optional answer; skipped status is kept to respect your choice not to answer.
Your optional answer is retained with your account, included in account export and deleted with the account. To withdraw it, contact privacy@scaleplatforms.co.uk. We do not backfill sources for historical accounts or send these answers to Meta.
3. How We Use Your Data
We use your data exclusively to:
- Provide the service: Process receipt images, extract data via OCR, categorise expenses, and store records.
- Authenticate you: Verify your identity via Auth0 to protect your account.
- Isolate your data: Ensure you only see your own receipts, projects, and budgets.
- Generate reports: Produce CSV exports and summaries for tax returns or household tracking.
- Improve the service: Measure website usage with your optional analytics consent.
- Measure advertising visits: When enabled, use Meta Pixel on selected public marketing pages only after separate advertising consent, as described in our Cookie Policy.
We do not:
- Sell your personal data to third parties.
- Send your account details, receipt contents, financial records or form entries to Meta for advertising.
- Share your receipt images or financial data with anyone.
4. Data Processing and Sub-Processors
We use the following sub-processors to deliver our service:
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Microsoft Azure | Cloud hosting, storage, database | All service data | UK South (London) |
| Azure Document Intelligence | Reading receipts and bank statements | Receipt images, and bank statement files you upload (processed in-memory, not retained) | UK South |
| Azure OpenAI | Expense categorisation, and reading the transaction table on a bank statement | Receipt text, and bank statement transaction lines - date, description and amount (processed in-memory, not retained, never used to train models) | UK South |
| Auth0 (Okta) | Authentication | Email, name, login credentials | EU (UK region) |
| Stripe | Payment processing | Payment details | EU |
All sub-processors are bound by data processing agreements. Azure services are configured in the UK South region to maintain UK data residency.
Separately from these service providers, optional website advertising measurement shares page-view information with Meta Platforms, Inc. (United States) for UK data when enabled and expressly accepted. This can include the visited marketing-page address, permitted campaign/click identifiers, referrer, browser identifiers, device information and IP address. Meta may associate it with your Meta account and combine event data with other data to personalise and deliver advertising and improve its products. We do not supply names, email addresses, receipt data, form contents or purchase/sign-up events, and do not enable advanced matching or Conversions API. See Meta's Privacy Policy for Meta's processing and retention. You can withdraw through Cookie settings in the website footer without losing access to the service.
The Meta Business Tools Terms describe Meta's processor role for measurement and the joint-controller arrangements for collection/transmission for Meta's advertising and other stated purposes. Meta remains responsible as an independent controller for its subsequent processing for those purposes. Its use is not limited to anonymous reports we receive.
5. Sharing With Your Accountant
If you choose to link your account to an accountancy practice, or to create a share link, that practice can see the data you have shared with them. This is entirely optional and off unless you turn it on.
| What they can see | What they can do |
|---|---|
| Your receipts, including images | View, correct a category or amount, export to CSV |
| Your bank statement transactions and the statement files you uploaded | View, correct, delete, export to CSV |
| Your CIS statements and refund estimate, where present | View and export |
- Sharing is opt-in. You are asked to consent before a linked practice sees anything.
- You can withdraw access at any time in the app, which immediately stops further access.
- Share links are time-limited and can be revoked.
- Your accountant is a separate data controller for the data you share with them. How they handle it is governed by their own privacy policy and their engagement with you.
- Practices can only see clients who have linked to them or accepted an invitation. They can never browse other users.
6. Data Storage and Security
6.1 Storage
- Receipt images: Azure Blob Storage (UK South), encrypted at rest (AES-256), access controlled by user ID prefix.
- Receipt data: Azure Cosmos DB (UK South), encrypted at rest, partitioned by user for data isolation.
- Authentication tokens: Stored in browser memory only (not persisted to disk).
6.2 Security Measures
- All data transmitted over TLS 1.2+.
- Authentication via Auth0 with JWT tokens (RS256 signed).
- Managed Identity for service-to-service authentication (no API keys in code).
- All database queries filtered by authenticated user ID.
- Passkey support (FIDO2) for phishing-resistant authentication.
7. Data Retention
| Data Type | Retention Period | Justification |
|---|---|---|
| Receipt data and images | Until you delete them, or account closure + 30 days | HMRC requires 5-year record keeping; we leave retention to you |
| Account data | Until account closure + 30 days | Contract performance |
| Application logs | 30 days | Debugging and operational support |
| Authentication logs | 90 days (Auth0) | Security monitoring |
You can delete individual receipts at any time via the app. Deleted data is permanently removed from our database and blob storage.
8. Your Rights (UK GDPR)
You have the following rights under UK GDPR:
| Right | How to Exercise |
|---|---|
| Access | Export your data via CSV export in the app, or email us |
| Rectification | Edit receipt details directly in the app |
| Erasure | Delete receipts in the app, or request full account deletion |
| Data Portability | Use CSV export to download your data |
| Restrict Processing | Email us to restrict processing |
| Object | Email us to object to processing |
| Withdraw Consent | Where consent is the basis, withdraw at any time |
To exercise any right, contact: privacy@scaleplatforms.co.uk
We will respond within 30 days (extendable to 90 days for complex requests).
9. International Transfers
Your data is processed and stored in the United Kingdom (Azure UK South region). Authentication data is processed by Auth0 in the EU region.
Optional advertising measurement is separate from the UK-hosted receipt service. If enabled and accepted, Meta may process browser and page-view information outside the UK/EEA, including in the United States. For UK data, the UK Data Transfer Addendum is incorporated into Meta's Business Tools Terms. It incorporates the ICO's approved UK addendum to the EU standard contractual clauses for controller/processor transfers as applicable; it is not a promise of UK-only processing. Meta's Privacy Policy describes its international processing. No receipt or financial records are supplied through this integration.
10. Children's Data
Our service is not directed at individuals under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last Updated" date at the top of this page indicates when the policy was last revised.
12. Complaints
If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Phone: 0303 123 1113
13. Contact Us
For any privacy-related questions or requests:
Email: privacy@scaleplatforms.co.uk