Privacy Policy

This policy explains what personal data Docquo handles, why, and your rights under the UK GDPR and the Data Protection Act 2018.

Who we are

Docquo ("we") provides software that helps UK accounting and bookkeeping firms collect quarterly records from their clients. [Company name, registered address and ICO registration number to be added.]

Two roles

• Firm accounts and the waitlist: we are the controller of data about firm users (name, work email, firm name) and waitlist sign-ups.
• Client records: for documents and details accountancy firms collect from their clients, the firm is the controller and we are its processor. See our Data Processing note. If you are a firm's client, contact your accountant first about your data.

What we collect

• Firm users: name, email, password (stored hashed by our authentication provider), role, activity in the app.
• Client records uploaded by firms or their clients: names, emails, phone numbers, financial documents.
• Waitlist: name, firm name, work email, client band and any message you give us.
• Technical: basic server logs needed to run and secure the service, plus attempt counters keyed by a hashed upload token and a keyed hash of the IP address. Raw IP addresses are not stored in these counters; expired counters are removed hourly. We don't put personal data in web addresses, except the random upload link token.

Why we use it (lawful basis)

• To provide the service under our contract with the firm.
• To contact waitlist sign-ups about early access, based on their consent (you can withdraw it at any time).
• To keep the service secure and prevent abuse (legitimate interests).

Automated document checks

Uploaded files may be analysed automatically by an AI model to suggest which checklist item they belong to and to flag possible problems (for example, a bank statement that doesn't cover the whole quarter). These checks are advisory only: they never block an upload and no decision with legal or similar effects is made about anyone. We only keep the extracted statement period, account name and the last 4 digits of an account number.

Where data is stored and who we share it with

Data is stored with our hosting and database providers in the UK/EU and encrypted in transit and at rest. We use sub-processors for hosting, email delivery and AI document checks; a list will be published here. We never sell personal data.

How long we keep it

Firms choose how long client files are kept (default 24 months after each quarter). Firm accounts can be deleted by the owner; everything is erased 30 days after the request. Waitlist data is kept until launch or until you ask us to remove it.

Cookies

We only use storage that is strictly necessary: keeping firm users signed in and remembering upload links on the device that created them. We don't use advertising or analytics cookies, so no cookie banner is needed. If that changes we'll ask for consent first.

Your rights

You can ask for access, correction, deletion, restriction, portability, or object to processing. Email [privacy contact email]. You can also complain to the Information Commissioner's Office (ico.org.uk).