Last updated: 6 October 2026
OctBooks (“we”, “us”) provides double-entry bookkeeping, invoicing, bank reconciliation, and Making Tax Digital VAT filing for UK sole traders, companies, charities and care homes. This policy explains what we collect through the service, why, and who else sees it.
We are OCY SERVICE LTD, a company registered in England and Wales under company number 10019391, registered office 28 Morefields, Tring, England, HP23 5EU. For anything in this policy, contact privacy@octbooks.co.uk.
Account and business details. Business name, registered address, legal form, sector, VAT number and bank account details (sort code and account number, for identifying incoming payments), entered when you set up your books or looked up from the UK Companies House public register when you give us a company number.
Bank transaction data. With your explicit consent, we connect to your bank through Yapily, a UK open banking provider, to read account balances and transactions for reconciliation. We never see or store your online banking credentials — you authorise access directly with your bank, and that consent can be withdrawn at any time from your settings.
Tax filings. VAT figures you submit are sent to HMRC’s Making Tax Digital service under your instruction, together with the fraud-prevention information HMRC requires of every filing (device and connection metadata, not content of your books).
Ledger and invoicing data. Everything you record directly — journal entries, invoices, customers, suppliers, and documents you upload.
Email. Invoices and account notifications we send on your behalf are delivered through Postmark, which reports back delivery and, via a tracking pixel, whether a message was opened. An open is evidence something fetched the image, not proof a person read it. If we ever send marketing email, it carries a working unsubscribe link, and we keep a suppression list of addresses that have opted out.
Mailbox connection (optional). If you choose to connect a Microsoft mailbox, you authorise that access yourself and it reaches only the one mailbox you signed in with.
Billing. Subscriptions are handled by Stripe. We hold a reference to your Stripe customer record, not your card details.
Support access. OctBooks staff with support (“superuser”) access can look at a business’s account to help with a support request. Every such access is logged — who, when, and what was viewed — and that log is itself reviewable, not hidden in a database only engineers can query.
We use an AI model (Claude, by Anthropic) to suggest how a bank transaction should be categorised. By default a person reviews every suggestion before it reaches your books. You can opt in to let high-confidence, low-value suggestions post automatically; any entry posted this way is marked as machine-posted in your ledger so it is always clear which decisions a person made, and it can only ever be corrected by a reversing entry, never a silent edit.
[Confirm with each supplier’s current data processing agreement whether any data leaves the UK/EEA, and the safeguard relied on, before publishing.]
Accounting and tax records are kept for the period UK law requires records of this kind to be kept for. [Confirm the exact retention period for each record type — ledger entries, filed VAT returns, invoices — with counsel; this varies by record and should not be guessed.]
Under UK GDPR you can ask to see, correct, export or delete personal data we hold about you, and you can object to or restrict some processing. Contact privacy@octbooks.co.uk to exercise any of these. You can also complain to the Information Commissioner’s Office (ico.org.uk).
If this policy changes materially, we will say so here and update the date at the top of the page.