Start with sample data. Cuebooks is pre-release. This notice describes the current service and its optional features; it is not a claim that the product is approved for every real-data or filing use. See our business-data arrangements before uploading other people’s personal information.
1. Who is responsible
Twin Origin Ltd (company number 17423129), trading as Cuebooks, is responsible for personal information we use to run accounts, answer enquiries, secure the service and manage our business. Our registered office is 5 Fewston Ave, Bradford, BD6 3WF, United Kingdom. Contact: support@cuebooks.co.uk.
When a business puts its customers’, suppliers’ or staff members’ information into Cuebooks, that business normally decides why it is used and is the data controller. We process those records on the business’s instructions. A privacy notice does not replace the data-processing terms needed for that relationship.
2. Information the service receives
- Account information: your email address, sign-in and verification information, business membership and security settings. Passwords are handled by our authentication service; never send one to support.
- Business records you provide: business identity, customer and supplier contact details, invoices, receipts, uploaded images/PDFs, bank statement entries, payment references, accounting figures and the history of changes.
- Messages: information you choose to send to support, feedback and any attachments. We receive this directly from you or someone authorised to contact us.
- Technical information: request and security logs, device/browser information, IP addresses and errors. Optional browser error diagnostics are described under Cookies and preferences.
- Information about other people: this usually comes from the business or documents it uploads, rather than from those people directly. Ask that business about its own privacy notice.
3. Why we use it
For information where we act as controller, our purposes and lawful bases are:
- Setting up and providing an account: performing our agreement with you, or taking steps you request before that agreement. For employees or representatives of a business customer, our legitimate interest is providing the business with the service it requested.
- Answering enquiries and fixing problems: our legitimate interests in communicating with users and maintaining a useful, reliable service; contractual necessity where needed to deliver the agreed service.
- Security, abuse prevention and necessary operational logs: our legitimate interests in protecting accounts, business records and the service.
- Our own legal, tax and company records: complying with legal obligations. We may also retain information where needed to establish, exercise or defend legal claims.
- Optional browser diagnostics: your consent. These are off unless you choose to allow them; you can withdraw that choice on the Cookies page.
The business customer chooses the lawful basis for the personal information in its bookkeeping records. We do not turn those records into our own marketing database. Creating an account does not sign you up to a marketing mailing list.
Without the information needed for sign-in, we cannot provide an account. You can still browse these public pages or email a general question.
4. Who helps deliver the service
We use service providers for the purposes below. An optional provider only receives information when its feature is configured and used; listing it here does not mean that every integration is live.
| Provider | Purpose and information involved |
|---|---|
| Vercel | Website/application hosting, request handling and operational logs. |
| Supabase | Account authentication, database and private file storage, including the business records you upload. |
| IONOS | Hosting the support mailbox: sender/recipient addresses, messages and any attachments you email us. |
| Microsoft Azure | Document-reading feature, where enabled. Document bytes are sent to extract information from supported images/documents. |
| OpenAI | Purchase-category suggestions, where enabled. Supplier names, relevant extracted descriptions/amounts and available category names/identifiers are sent. This suggestion path does not send the original document file. |
| Resend | Application email, where enabled: recipient details, message content and, for an invoice email, its PDF attachment. |
| Sentry | Configured server diagnostics and optional, consent-based browser error reports. Error content is filtered; this is not a guarantee of anonymous processing. |
Authorised people acting for your business can access records according to their permissions. We may share information with professional advisers, authorities or other recipients where required by law or necessary to handle a legal claim. We do not sell your personal information.
5. AI and document suggestions
Document extraction and AI suggestions help with data entry. They can be wrong. You review and confirm the accounting result; a suggestion does not post an entry or make a legal decision about you on its own.
The OpenAI suggestion request asks not to store the response. That is not a promise of zero provider retention or a substitute for checking the provider’s account settings and terms. Manual category selection is available if you do not want to request an AI suggestion.
6. Processing outside the UK
Using a UK business or a UK application-hosting region does not mean every provider processes data only in the UK. International providers, their support teams and their subprocessors may process data in other countries.
Where UK transfer rules apply, an appropriate transfer mechanism is needed, such as an adequacy regulation or approved contractual safeguards with any required assessment. Provider locations, contracts and transfer arrangements must be confirmed for an agreed real-data pilot. Contact support@cuebooks.co.uk for information about the arrangements applicable to your use; do not assume UK-only storage from the domain name.
7. Keeping and removing information
We keep account information while it is needed to provide and protect access. Business records remain available while a workspace is active or archived. Archiving a business does not erase its records.
After a closure or deletion request, retention depends on the type of information, the business’s instructions, outstanding support/security issues, legal obligations and any genuine legal hold. We assess what can be removed, what needs to be kept, why and for how long. We do not promise an automatic deletion date that the service does not currently enforce.
Support messages are kept while needed to deal with the enquiry and any related dispute. Provider logs, email copies and backups have separate retention arrangements; erasure requests need to consider those copies as well.
The accounting export in Settings is not a complete personal-data export: it does not include every original uploaded file or authentication-provider record. Contact support@cuebooks.co.uk for a personal-information request, original-file needs or an explanation of retention in your case.
8. Your rights and complaints
Depending on the circumstances, you can ask for access, correction, erasure, restricted processing or a portable copy of your information. You can object to processing based on legitimate interests, and withdraw consent where we rely on it. Withdrawing consent does not affect earlier lawful processing.
Email support@cuebooks.co.uk. We may need proportionate identity or authority checks before sharing private data. Requests are normally answered within one month; where the law permits more time, we will explain why. Financial corrections may need a linked correction rather than silently rewriting a posted record.
If the information belongs to a business using Cuebooks, contact that business as controller. We can help direct your request and support its response.
You can complain to the Information Commissioner’s Office (ICO). You do not have to contact us first, although we welcome the opportunity to resolve your concern.
9. Changes to this notice
We will update this notice when the service or its processing changes and give additional notice where required. The date above identifies this version. Material new uses of data are not authorised merely by silently changing this page.