AccountsOS

Privacy Policy

Last updated: August 2026

1. Introduction

AccountsOS ("we", "our", or "us") is operated by Thrive Venture Labs Ltd, a company registered in England & Wales (company no. 16871566), registered office 3rd Floor, 86-90 Paul Street, London EC2A 4NE. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our accounting software service.

Where we process personal data on your instructions as a processor (for example financial records and client data you store in AccountsOS, including practice multi-client data), that processing is also governed by our Data Processing Agreement.

2. Information We Collect

Personal Information

  • Name and email address
  • Company name and registration number
  • Contact information
  • Payment information (processed securely by Stripe)

Financial Data

  • Bank transaction data (from uploaded statements or directly connected bank accounts)
  • Receipts and expense documentation
  • Invoice and payment records
  • Tax filing information

Technical Data

  • IP address and browser type
  • Device information
  • Usage patterns and preferences

3. How We Use Your Information

  • Provide and maintain our accounting services
  • Process your transactions and tax calculations
  • Categorize expenses and generate financial reports
  • Send deadline reminders and important notifications
  • Improve our AI-powered features
  • Comply with legal and regulatory requirements
  • Respond to your support requests

4. Data Security

We implement industry-standard security measures to protect your data:

  • 256-bit SSL/TLS encryption for all data transmission
  • Encrypted data storage using AES-256
  • Continuous security monitoring via Sentry
  • Strict access controls and authentication
  • EU-based data centers (Supabase infrastructure)

5. Data Breach Notification

In the event of a data breach involving your personal or financial data, we follow strict notification procedures in compliance with UK GDPR and HMRC requirements:

  • HMRC notification: We will notify HMRC within 72 hours of becoming aware of any breach involving customer data, by contacting SDSTeam@hmrc.gov.uk with a breach contact name and telephone number.
  • ICO notification: We will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of any personal data breach, as required by UK GDPR.
  • User notification: We will notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
  • Incident response: Our incident response team can be reached at finn@accounts-os.com for any security concerns.

6. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

  • Contract performance: Processing necessary to provide our accounting services to you, including transaction management, financial reporting, and deadline tracking.
  • Legal obligation: Processing required for UK tax compliance, including HMRC requirements, Companies House filings, and record-keeping obligations.
  • Legitimate interest: Service improvement, fraud prevention, and security monitoring, where these interests are not overridden by your data protection rights.
  • Consent: Marketing communications, which you can withdraw at any time by contacting us or using the unsubscribe link in any marketing email.

7. Third-Party Integrations and Bank Data

Direct Bank Connections (Revolut Business, Starling)

AccountsOS connects directly to your bank's own API for automatic transaction import: no data aggregator sits in between. When you connect a bank account:

  • The connection uses read-only permissions, AccountsOS can never move your money
  • We receive your account balances, transaction history, and account details directly from your bank
  • Your bank login credentials are never seen or stored by AccountsOS, you authorise the connection inside your own bank's app or website
  • Connection credentials (certificates and access tokens) are stored encrypted (AES-256-GCM), and transaction data sits under the same security controls as all other financial data (encryption at rest, row-level security)
  • You can disconnect at any time from Settings or from your bank's own settings, which revokes our access

Stripe (Payment Processing)

If you connect your Stripe account, we sync your charges, fees, and refunds for bookkeeping purposes using a read-only API key that you provide. We do not process payments on your behalf through Stripe.

Uploaded Documents

When you upload bank statements, receipts, or invoices to AccountsOS:

  • Files are encrypted during upload and at rest
  • AI extracts transaction data in isolated, secure environments
  • Your data is never used to train AI models
  • You can delete uploaded documents at any time

AI Services

AccountsOS uses AI services (Anthropic Claude, Google Gemini) to power chat, document extraction, and transaction categorisation. Your financial data is sent to these services only as needed to provide the feature you are using. None of these providers use your data to train their models.

Finn Chrome Extension

The Finn browser extension (Chrome Web Store listing: "Finn — your AI accountant") is a side panel that can read a screenshot of the tab you choose and answer accounting questions about it. It is optional and user-triggered only.

  • Screenshots: only when you tap "Check this screen" (after an in-extension disclosure and consent). Finn captures a still image of the visible active tab, not your whole desktop and not other tabs. It does not run in the background and does not record continuously.
  • Hostname context: the hostname of the active tab (for example go.xero.com) may be sent with your question so Finn can refer to the tool naturally. No full browsing history is collected.
  • Login token: if you choose "Log in", AccountsOS mints a short-lived signed token (user id + expiry, HMAC with our session secret) after you authenticate on accounts-os.com. The token is stored in the extension's local storage and sent as a Bearer header so we can lift the anonymous free-message cap. It does not grant the extension access to your connected company books in this release.
  • AI processing (Anthropic): your question text, optional screenshot, and optional hostname are sent over HTTPS to accounts-os.com and processed by Anthropic Claude solely to generate the reply. Screenshots are not stored by AccountsOS after the reply is produced. Anthropic does not use this content to train models under our agreement.
  • Limited Use: data obtained via the Chrome extension is used only to provide or improve user-facing features of Finn / AccountsOS that are prominent in the extension's UI. We do not sell this data, do not use it for advertising profiling, and do not transfer it to third parties for purposes unrelated to providing the feature, except as required by law or with your direction.
  • You can revoke capture consent by removing the extension (or clearing its extension storage). You can log out from the panel at any time, which deletes the local login token.

Finn Plugin for Codex and ChatGPT

If you connect the Finn plugin, AccountsOS uses OAuth 2.1 to let Codex or ChatGPT request read-only accounting information on your behalf. Only records needed for the tool you invoke are returned to the OpenAI service you are using. The initial public plugin cannot create, change, send, file, pay, or delete accounting records.

  • AccountsOS never shares your password or API keys with the plugin host
  • OAuth access is limited to your active AccountsOS company and verified on every request
  • Tool responses exclude authentication secrets and unnecessary debug information
  • You can revoke the connection from your AccountsOS authorization settings
  • Your use of Codex or ChatGPT is also governed by the OpenAI terms and privacy settings for your account

Email Open Tracking

Emails you choose to send from the sales pipeline include a first-party tracking image that tells you when the recipient opens the message. This is served from our own domain, no third-party tracker is involved, and the open data (timestamp and count) is visible only to your company.

8. Your Rights (GDPR)

As a UK/EU resident, you have the following rights:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data
  • Portability: Export your data in a standard format
  • Objection: Object to certain processing
  • Restriction: Limit how we use your data

To exercise these rights, contact us at finn@accounts-os.com

9. Data Retention

We retain your data for as long as your account is active. For financial records, we retain data for 7 years to comply with UK tax regulations (as required by HMRC). After account deletion, we anonymize or delete your personal data within 30 days, except where legal retention is required.

10. Cookies

We use essential cookies for authentication and security. We use analytics cookies (with your consent) to improve our service. You can manage cookie preferences in your browser settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of our service after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions or concerns:

  • Email: finn@accounts-os.com