Privacy policy

ProfitM8 is sold to accountancy and bookkeeping practices, who use it for their own clients. That means responsibility is split, and it matters:

So if you are a business whose accountant set you up, and you want to know why your pay rate is in here or want it removed, ask your accountant first — it is their decision, and we will help them act on it. The terms we work to for them are in the data processing agreement.

People who sign in

• Name and email address — to identify the account and send invitations and password links.
• A one-way hash of the password — so sign-in works. The password itself is never stored and we cannot see it.
• When you last signed in — so a practice can see who is actually using it.
• Single-use invitation and password links, which expire and are cleared once used.

A business set up by a practice

• The business — trading name, address, trade, VAT position, country.
• Its people — names, pay rates, National Insurance rates, chargeable and non-chargeable hours, whether they are a director, and whether they take a wage or drawings. This is what makes the overhead rate real, and we know it is sensitive information about real people.
• Its standing costs, and its logo.

That business's own customers

• Name and email address on a quote or invoice, so the document can be sent.
• What was quoted, at what price, and whether it was accepted, with the time it happened.

Everyone

• A record of every email we send — who to, the subject, and whether it arrived. We keep this so that “did it send?” has an answer; once it didn't, and somebody waited a week for a link that never came.
• Visit counts on our public pages, but only if you accepted analytics cookies. See the cookie policy.
• Mailing list — name, email, organisation, the exact wording you agreed to and when, and a one-way hash of the IP address used, to stop the form being abused.

• No bank details. Direct Debit is set up on GoCardless's own pages; we receive only a reference.
• No card details.
• No special category data — nothing about health, ethnicity, beliefs or anything similar. We never ask.
• No advertising or cross-site tracking, and no IP addresses in our analytics.
• We do not sell data to anyone, and we never will.

• To perform our contract with a practice — their account, their billing, the service itself.
• Our legitimate interests — keeping the service secure, keeping records of what was sent, and understanding how our public pages are used. We have considered whether this is fair to you, which is why the analytics is anonymous, first-party and off by default.
• Your consent — for the mailing list and for analytics cookies. You can withdraw either at any time.
• Legal obligation — keeping business records such as invoices.

Only the suppliers we need to run the service:

We will tell practices before adding a new supplier that handles their clients' data. If any supplier processes data outside the UK or EEA, we rely on the UK International Data Transfer Agreement or the equivalent standard clauses.

Deleting something removes it from the live service straight away. Backups are taken daily and kept on a rolling cycle, so a deleted record may persist in a backup for a short period before ageing out. We do not restore a backup to recover deleted data except to recover from a failure.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable form. You can withdraw consent at any time — unsubscribe links are in every marketing email, and cookie settings are in the footer of every page.

If a practice set you up, ask them first: they decide what happens to that data. We will help them answer you.

We answer requests within one month. If you think we have got something wrong, please tell us so we can fix it — and you have the right to complain to the Information Commissioner's Office at ico.org.uk.

• Everything travels over HTTPS.
• Passwords are stored only as a one-way hash, never in a readable form.
• Access to a client's data is checked on every request, not just hidden in the interface.
• Where a platform administrator views an account as another user, it is recorded in an audit trail that cannot be bypassed.
• Connections to accounting packages store their access tokens encrypted.
• Backups are taken daily and held off-site.