This policy explains what personal data PencePal holds about you, why, who helps us look after it, how long we keep it, and your rights. It covers the PencePal app for iPhone, iPad and Android, and the website at pencepal.com.
Who we are
PencePal is made by Eight Mile, company number 15938227, registered in England and Wales, VAT number 524 5402 16, based in London. We are the controller of the personal data described here. You can reach us about anything in this policy at [email protected].
What we hold
- Your account: your email address, your name, the business name you choose to print on PDFs, and your password, which is stored only as a salted scrypt hash that cannot be turned back into the password.
- Sign in with Apple or Google, if you use them: the provider's identifier for you and the email address it shares, which with Apple may be a Hide My Email relay address. For Apple we also keep the token Apple issues, encrypted, solely so that we can revoke it when you delete your account.
- Your records: your expenses (date, details, amount, payment type, category, and whether a receipt is needed), the receipt files you attach (photos or PDFs, with their file names), your saved docs (titles and date ranges), your mileage trips (date, vehicle, miles, purpose, and the start and end places if you enter them), and your categories and payment types.
- Your devices: for each signed-in browser or app, a device name and its user agent (the browser or app version and the operating system), and when it was signed in and last used. We do not store your IP address with your account.
- AI connectors you create: their name and expiry. The connector's token is stored only as a hash.
- Your subscription, if you buy PencePal Pro: which plan, which store, whether it is a free trial, and when it renews or ends, as RevenueCat reports it. We never see your card or bank details: the App Store or Google Play takes payment.
- Emails: the one-time codes we send (kept for 10 minutes, and only as a keyed hash), and anything you write to us.
- Security records: a count of sign-in attempts and code requests for each email address, kept for 15 minutes to stop password guessing, and the servers' request logs (the time, the address requested and the outcome).
Why we use it, and our lawful bases
- To provide PencePal to you: to create and secure your account, keep and show your records, make your PDFs, keep the app and the website in step, send your codes and account emails, and provide PencePal Pro. The lawful basis is that this is necessary for our contract with you (UK GDPR Article 6(1)(b)).
- To keep PencePal secure: the sign-in lockouts, the request logs, and looking into misuse. The lawful basis is our legitimate interest in protecting your account and the service (Article 6(1)(f)). You can object to this; see Your rights below.
- When the law requires it, for example a court order, we use the data to comply (Article 6(1)(c)).
We do not sell your data, use it for advertising, or make decisions about you by automated means that have legal or similar effects.
Who processes it for us
These companies process personal data for us, only on our instructions and under terms that include data protection obligations:
- Our hosting provider runs the servers and the database PencePal is served from. Where they are is being confirmed, and will be stated here.
- Cloudinary stores your receipt files and delivers them through their links.
- Resend sends the sign-in codes and account emails.
- RevenueCat keeps track of PencePal Pro subscriptions bought through the App Store and Google Play.
- Apple and Google confirm who you are when you choose Sign in with Apple or Sign in with Google. When you buy PencePal Pro, the App Store or Google Play sells it to you and takes payment as the seller. For both, their own privacy policies also apply.
Where a provider processes data outside the UK, the transfer is made under the safeguards UK data protection law requires, such as an adequacy decision or the ICO's international data transfer agreement.
Receipt links
Every receipt file you attach gets a link with a long random part (128 bits), so it cannot be guessed. The link itself is the key: anyone who has it can open that one file without signing in. That is what lets your accountant open the receipts listed in a PDF you send them. We never publish these links; they appear only in your own records, your data download, and the PDFs you choose to share. Treat a PDF or a download as you would the receipts themselves. Deleting a receipt, its expense or your account deletes the file, and its link stops working.
Scanning receipts
The app's scan and auto-fill reads a receipt on your device: the text recognition runs on your phone or tablet, and the image is not sent to us or to anyone else to be read. Only the receipt files you choose to attach are uploaded.
No tracking, and the one cookie
PencePal has no advertising, no analytics, no crash-reporting tools and no tracking across other apps or websites, and it sends no push notifications: reminders are local notifications your device sets for itself. The only third-party code in the app that handles data is RevenueCat's, for subscriptions.
The website sets one cookie, which keeps you signed in (for up to 90 days). While you sign in with Apple or Google it sets a second, for 10 minutes, that ties the sign-in to your browser. Both are strictly necessary for the service you asked for, so the law does not require your consent for them, and there is no cookie banner. These public pages set no cookie at all.
How long we keep it
- Your account and everything in it: until you delete your account. Deleting it removes your records from the database at once; your receipt files are then deleted from Cloudinary, usually within a minute and retried until it is done; your Sign in with Apple grant is revoked and your RevenueCat record deleted; and we email you to confirm.
- Background jobs (sending an email, deleting a file) hold your email address or a file's identifier only until they run. Then those details are erased, and the empty record is deleted after 7 days.
- Signed-in sessions end after 30 days unused on the website (90 days at most) and 90 days unused in the app (a year at most), and are then deleted. Codes last 10 minutes, and the lockout counts 15 minutes.
- Server logs and backups: how long request logs are kept is being confirmed, and will be stated here. If the database is backed up, a deleted account remains in those copies until they expire; how long that is will be stated here.
- Emails you send us are kept for as long as we need them to deal with what you asked.
Your rights
Under UK data protection law you have the right to:
- get a copy of your data, and have it in a form you can take elsewhere: use Download my data on your account page, or Export in the app;
- have it corrected: edit it in the app or on the website;
- have it deleted: delete your account in the app or on the website (how to delete your account);
- restrict how we use it, or object to our use of it for security;
- complain, as below.
For anything you cannot do yourself, email [email protected], ideally from the address on your account. We may need to check that the request comes from you, and we answer within one month.
Complaints
Please tell us first, and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Children
PencePal is for adults keeping business records. It is not meant for anyone under 18.
Changes to this policy
When this policy changes we update the date at the top. If a change affects how we use your data in a way that matters, we tell you in the app or by email first.