Privacy Policy

Ledger AI (“we”, “us”, “our”) is committed to protecting your privacy and the confidentiality of the financial records you entrust to us. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights you have over it.

This policy covers our website at ledgerai.backoffice.digital and the Ledger AI application. It should be read alongside our Cookie Policy and our GDPR Compliance statement.

1. Who we are

Ledger AI provides AI-powered bookkeeping and accounting automation. Our platform ingests invoices, receipts and bank statements, extracts and categorises the transactions within them, and produces trial balances and reports.

For information you give us directly — your name, email address, firm details and marketing preferences — we act as the data controller. For the client records you upload and process through the platform, you (or the accounting firm you work for) remain the controller and we act as your data processor, handling that data only on your documented instructions. See our GDPR Compliance page for the detail of that relationship.

2. Information we collect

Information you provide

We collect personal information you give us voluntarily when you:

• Create an account or request a demo
• Submit a contact, booking or newsletter form
• Try the free document upload tool
• Contact our support team
• Take part in a survey, trial or promotion

This typically includes your name, work email address, company or firm name, telephone number, job role, and anything else you choose to include in a message to us.

Document and transaction data

When you use the platform, you upload documents such as bank statements, invoices and receipts. These files, and the transaction data extracted from them, may contain personal information about you, your firm’s clients, and third parties named in those documents — for example account names, sort codes and account numbers, supplier names, payment references and transaction amounts.

We process this content solely to deliver the service to you: to extract and categorise transactions, to generate trial balances, reports and alerts, and to make the results available in your account.

Information collected automatically

When you visit our website or use the platform, we automatically collect technical information including your IP address, browser type and version, device type, operating system, time zone, referring URL, the pages you view and the links you click. Some of this is collected through cookies and similar technologies — see our Cookie Policy for the full list and how to control them.

3. How we use your information

We use the information we collect to:

• Provide, operate and maintain the Ledger AI platform
• Process the documents you upload and return the extracted results
• Authenticate you and keep your account secure
• Respond to enquiries, demo requests and support tickets
• Send service messages such as processing alerts and product updates
• Send marketing communications where you have opted in, which you can withdraw at any time
• Analyse usage so we can improve accuracy, performance and features
• Detect, prevent and investigate fraud, abuse and security incidents
• Meet our legal, accounting and regulatory obligations

4. Legal bases for processing

Where UK GDPR and EU GDPR apply, we rely on the following legal bases:

• Performance of a contract — to provide the platform and support to you under our Terms of Use
• Legitimate interests — to secure and improve the service, to understand how it is used, and to market to business contacts, balanced against your rights and freedoms
• Consent — for non-essential cookies and for marketing emails where consent is required; you may withdraw consent at any time
• Legal obligation — where we must retain or disclose information to comply with the law

5. AI and automated processing

Ledger AI uses machine learning models to read documents and suggest transaction categories. These suggestions are a decision-support tool, not a final determination: extracted data and categorisations are presented for review and can be corrected before they are used.

We do not make decisions producing legal or similarly significant effects about individuals by automated means alone. We do not sell your data, and we do not use customer documents or the client data within them to train models for other customers.

6. Sharing your information

We do not sell personal information. We share it only in these circumstances:

• Service providers — hosting, storage, email delivery, analytics, error monitoring and payment processing partners who act on our instructions under written contracts, and who may only use the data to provide their service to us
• Professional advisers — auditors, lawyers and insurers where necessary and subject to confidentiality
• Business transfers — in connection with a merger, acquisition, financing or sale of assets, where the recipient is bound to honour this policy
• Legal requirements — where we are required to disclose by law, regulation, court order or a valid request from a public authority
• With your consent — where you have asked or agreed that we do so

7. International transfers

We host and process data in the United Kingdom and the European Economic Area wherever possible. Where a supplier processes data outside the UK or EEA, we put appropriate safeguards in place — such as the UK International Data Transfer Agreement, the UK Addendum, or the European Commission’s Standard Contractual Clauses — so that your information continues to receive an equivalent level of protection.

8. Data retention

We keep personal information only as long as we need it:

• Account and contact data — for the life of your account and up to 24 months afterwards, so that we can reactivate an account and answer queries
• Uploaded documents and extracted transactions — for the period set in your account, and deleted on request or on account closure, subject to your instructions as controller
• Enquiry and support correspondence — up to 24 months from the last contact
• Billing and tax records — for at least six years, as required by UK tax law
• Backups and logs — for a limited rolling window, after which they are overwritten

9. Security

We apply technical and organisational measures appropriate to the sensitivity of financial records, including encryption in transit and at rest, access controls and least-privilege permissions, network segregation, logging and monitoring, regular patching, and staff confidentiality obligations and training.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the Information Commissioner’s Office and affected customers without undue delay and, where required, within 72 hours of becoming aware of it.

10. Your rights

Depending on where you are located, you have the right to:

• Access — obtain a copy of the personal information we hold about you
• Rectification — have inaccurate or incomplete information corrected
• Erasure — ask us to delete your personal information in certain circumstances
• Restriction — ask us to limit how we process your information
• Object — object to processing based on legitimate interests, and to direct marketing at any time
• Portability — receive your information in a structured, machine-readable format, or have it sent to another provider
• Withdraw consent — where our processing relies on consent, without affecting processing carried out beforehand

To exercise any of these rights, contact us at [email protected]. We will respond within one month. If your request concerns data we process on behalf of an accounting firm, we will refer you to that firm as the controller and support them in responding.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk. We would appreciate the chance to address your concerns first.

11. Children’s privacy

Ledger AI is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Third-party links

Our website and platform may link to third-party sites and integrations that we do not control. We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of any site or service you use.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and we will give you prominent notice of material changes — by email or an in-app notice — before they take effect.

14. Contact us

For any question about this policy or about how we handle personal information:

• Email: [email protected]
• Support: [email protected]
• Online: Book a demo or send us a message