Privacy
Plain English about what AccounTap stores and who else might see a piece of it. This is not legal advice — it describes how this product works today.
Who runs this
AccounTap is operated by VistaHos LTD. Your bookkeeping data is yours; we hold it so you can use the service.
What we store
- Your account email and sign-in details (via Supabase Auth), including optional two-step sign-in with an authenticator app (TOTP). We do not see the codes your phone generates.
- Your profile (name, business name, trade, VAT status, chosen tax year, accountant email if you add one)
- Money-in and money-out lines you enter or import (amounts, dates, categories, notes, personal flags), including figures suggested from receipt photos or PDF invoices you choose to upload
- Accessibility and reminder preferences
- A short security activity log (sign-in, password or two-step changes, exports, account download) without amounts or secrets
- Hashed two-step backup codes if you create them. AccounTap never stores the readable codes after they are shown once
We do not ask for bank login details or full card numbers. If paid plans are open, Stripe takes the card payment on their page. AccounTap stores whether the plan is active, not the card number. If a receipt photo shows card digits, treat that photo carefully — see AI below.
Where it is stored
Signed-in books are stored in a Supabase (Postgres) database with row-level security so each user only sees their own rows. Traffic between your browser and the service uses HTTPS. Disk encryption on the database host applies as part of that provider's platform.
When the operator turns on field encryption, free-text notes, VAT number, and accountant email are encrypted on the AccounTap server before they are written (AES-256-GCM). The encryption key is not sent to your browser. Amounts and dates stay readable so summaries and filters still work. Without that server key, those fields are stored as plain text protected by row-level security and HTTPS.
Ask Pal and document reading (AI)
These features are optional and only run when the operator has turned AI on for this deployment. When they are on:
- Ask Pal sends your typed question, plus your first name and trade from your saved profile, to Anthropic's Claude API so Pal can reply.
- Photo / PDF import sends the image or PDF you choose to Anthropic so we can suggest amounts, dates, and categories. You review every suggested line before it is saved. Documents can include personal shopping, addresses, or card digits — only upload files you are willing to send to that provider.
We do not send your full transaction list or password to Anthropic. You can keep books without using Ask Pal or document reading.
If you use “Send to my accountant”, we email a CSV of your books for the selected tax year to the accountant address already saved in Settings, via Resend. We also email you when that address changes, when books are exported, and when your password or two-step settings change. Deadline reminders (if you leave them on) go to your account email the same way.
Your choices
- Do not use Ask Pal or receipt photos if you prefer nothing to leave our servers for AI.
- Turn reminder emails off in Settings.
- Download a copy of your data or close your account from Settings. You can also contact VistaHos LTD at contact@accountap.co.uk.
How long we keep leftovers
Rate-limit counters older than 7 days, security events older than 2 years, and used backup-code hashes older than 30 days are removed by the daily maintenance job. Closed accounts delete the auth user and cascaded book rows. Backups follow the database host's own schedule.