Start with sample data. Cuebooks is pre-release. This notice describes the current service and its optional features; it is not a claim that the product is approved for every real-data or filing use. See our business-data arrangements before uploading other people’s personal information.
1. Who is responsible
Twin Origin Ltd (company number 17423129), trading as Cuebooks, is responsible for personal information we use to run accounts, answer enquiries, secure the service and manage our business. Our registered office is 5 Fewston Ave, Bradford, BD6 3WF, United Kingdom. Contact: support@cuebooks.co.uk.
When a business puts its customers’, suppliers’ or staff members’ information into Cuebooks, that business normally decides why it is used and is the data controller. We process those records on the business’s instructions. A privacy notice does not replace the data-processing terms needed for that relationship.
2. Information the service receives
- Account information: your email address, sign-in and verification information, business membership and security settings. Passwords are handled by our authentication service; never send one to support.
- Business records you provide: business identity, customer and supplier contact details, invoices, receipts, uploaded images/PDFs, bank statement entries, payment references, accounting figures and the history of changes.
- Messages: information you choose to send to support, feedback and any attachments. We receive this directly from you or someone authorised to contact us.
- Requests for an invitation: if you ask for an invitation, your name, email address, the few words you give about your business, how it is set up, whether you asked for news, and when you asked. To stop misuse of the form we also keep, for 7 days, a scrambled code made from your network (IP) address, not the address itself.
- Technical information: request and security logs, device/browser information, IP addresses and errors. Optional browser error diagnostics are described under Cookies and preferences.
- Information about other people: this usually comes from the business or documents it uploads, rather than from those people directly. Ask that business about its own privacy notice.
3. Why we use it
For information where we act as controller, our purposes and lawful bases are:
- Setting up and providing an account: performing our agreement with you, or taking steps you request before that agreement. For employees or representatives of a business customer, our legitimate interest is providing the business with the service it requested.
- Answering enquiries and fixing problems: our legitimate interests in communicating with users and maintaining a useful, reliable service; contractual necessity where needed to deliver the agreed service.
- Answering a request for an invitation and inviting you: taking steps you ask for before an agreement. A copy of each request, up to 50 a day, goes to our support mailbox so we can answer it.
- Occasional news about Cuebooks: your consent, given only if you tick the news box when you ask for an invitation. You can ask us to stop at any time by emailing support@cuebooks.co.uk.
- Security, abuse prevention and necessary operational logs: our legitimate interests in protecting accounts, business records and the service.
- Our own legal, tax and company records: complying with legal obligations. We may also retain information where needed to establish, exercise or defend legal claims.
- Optional browser diagnostics: your consent. These are off unless you choose to allow them; you can withdraw that choice on the Cookies page.
The business customer chooses the lawful basis for the personal information in its bookkeeping records. We do not turn those records into our own marketing database. Creating an account does not sign you up to a marketing mailing list, and asking for an invitation does so only if you tick the news box.
Without the information needed for sign-in, we cannot provide an account. You can still browse these public pages or email a general question.
4. Who helps deliver the service
We use service providers for the purposes below. An optional provider only receives information when its feature is configured and used; listing it here does not mean that every integration is live.
| Provider | Purpose and information involved |
|---|---|
| Vercel | Website/application hosting, request handling and operational logs. |
| Supabase | Account authentication, database and private file storage, including the business records you upload. |
| IONOS | Hosting the support mailbox: sender/recipient addresses, messages and any attachments you email us. |
| Microsoft Azure | Used to read receipt photos until 9 October 2026; no longer used. |
| OpenAI | Optional Setup and bookkeeping suggestions. Depending on the feature you request, this can include your confirmed business description, legal form, industry, sales channels and typical costs; limited supplier, product or bank-merchant wording and counts; relevant extracted descriptions or amounts; and the available Cuebooks category names/identifiers. These suggestion paths do not send the original document or bank-statement file. |
| OpenAI, through CueDocs | Reading receipt photos and scans, only for a business that chose “Read it for me”: one photo with its hidden camera details removed, or one PDF Cuebooks can’t read itself, sent as it is. OpenAI is a company based in the United States and may read it in the United States or in other countries where it runs its service. Not used to train OpenAI’s models. OpenAI may keep it and what it read for up to 30 days to check its service is not being misused, then deletes them, unless the law requires, or it needs to keep them longer to protect people from harm. |
| Resend | Application email, where enabled: recipient details, message content and, for an invoice email, its PDF attachment. It also carries a copy of each request for an invitation, up to 50 a day, to our support mailbox. |
| Sentry | Configured server diagnostics and optional, consent-based browser error reports. Error content is filtered; this is not a guarantee of anonymous processing. |
Authorised people acting for your business can access records according to their permissions. We may share information with professional advisers, authorities or other recipients where required by law or necessary to handle a legal claim. We do not sell your personal information.
5. AI and document suggestions
Document extraction and AI suggestions help with data entry. They can be wrong. You review and confirm the accounting result; a suggestion does not post an entry or make a legal decision about you on its own.
The OpenAI suggestion request asks not to store the response. That is not a promise of zero provider retention or a substitute for checking the provider’s account settings and terms. Manual category selection is available if you do not want to request an AI suggestion.
Reading photos and scans (CueDocs)
Cuebooks reads PDFs that contain text itself; they are not sent anywhere. If a business chooses “Read it for me”, a photo of a receipt, or a PDF Cuebooks can’t read itself (such as a scan), is sent to OpenAI through CueDocs, Cuebooks’ reading tool, so that its details (such as the supplier, date and amounts) can be filled in for the business to check before anything is recorded. Only that one file is sent, nothing else from the business’s records.
Before a photo is sent, its hidden camera details, such as where and when it was taken, are removed. A PDF is sent as it is, including any details saved inside it, such as its author, the software that made it, or the camera details of a photo saved inside it.
OpenAI, a company based in the United States, reads the file as our processor, in the United States or in other countries where it runs its service, under its data processing addendum, which includes the UK Addendum to the EU Standard Contractual Clauses for transfers from the UK. OpenAI does not use the file to train its models. Cuebooks asks OpenAI not to store the request, but under OpenAI’s standard terms it may keep the file and what it read in its abuse-monitoring logs for up to 30 days to check its service is not being misused, then deletes them, unless the law requires it to keep them longer or keeping them is reasonably needed to protect its service or other people from harm. OpenAI’s automatic safety checks may keep a file they flag as possibly illegal for review.
Cuebooks keeps the original file and the details the business confirms with its other records (see section 7), and a record of each file sent, without its content. A business that chooses “I’ll type the details” sends nothing, and can change its choice at any time in Settings.
6. Processing outside the UK
Using a UK business or a UK application-hosting region does not mean every provider processes data only in the UK. International providers, their support teams and their subprocessors may process data in other countries.
Where UK transfer rules apply, an appropriate transfer mechanism is needed, such as an adequacy regulation or approved contractual safeguards with any required assessment. Provider locations, contracts and transfer arrangements must be confirmed for an agreed real-data pilot. Contact support@cuebooks.co.uk for information about the arrangements applicable to your use; do not assume UK-only storage from the domain name.
7. Keeping and removing information
We keep account information while it is needed to provide and protect access. Business records remain available while a workspace is active or archived. Archiving a business does not erase its records.
After a closure or deletion request, retention depends on the type of information, the business’s instructions, outstanding support/security issues, legal obligations and any genuine legal hold. We assess what can be removed, what needs to be kept, why and for how long. We do not promise an automatic deletion date that the service does not currently enforce.
A request for an invitation is kept for 12 months after you last asked, then deleted automatically, or sooner if you ask us to delete it. Its network code is deleted after 7 days. The copy in our support mailbox is kept while needed to deal with your request.
Support messages are kept while needed to deal with the enquiry and any related dispute. Provider logs, email copies and backups have separate retention arrangements; erasure requests need to consider those copies as well.
The accounting export in Settings is not a complete personal-data export: it does not include every original uploaded file or authentication-provider record. Contact support@cuebooks.co.uk for a personal-information request, original-file needs or an explanation of retention in your case.
8. Your rights and complaints
Depending on the circumstances, you can ask for access, correction, erasure, restricted processing or a portable copy of your information. You can object to processing based on legitimate interests, and withdraw consent where we rely on it. Withdrawing consent does not affect earlier lawful processing.
Email support@cuebooks.co.uk. We may need proportionate identity or authority checks before sharing private data. Requests are normally answered within one month; where the law permits more time, we will explain why. Financial corrections may need a linked correction rather than silently rewriting a posted record.
If the information belongs to a business using Cuebooks, contact that business as controller. We can help direct your request and support its response.
You can complain to the Information Commissioner’s Office (ICO). You do not have to contact us first, although we welcome the opportunity to resolve your concern.
9. Changes to this notice
We will update this notice when the service or its processing changes and give additional notice where required. The date above identifies this version. Material new uses of data are not authorised merely by silently changing this page.