Privacy Policy

1. Who we are

HonestBooks is operated by HonestSoftware LTD ("we", "us", "our"). We are the data controller responsible for your personal data.

Contact: [email protected]
Address: Lytchett House, Poole, Dorset, BH16 6FA

If you have any questions about how we handle your data, please contact us at the above email address.

2. What data we collect and why

2.1 Account data

When you register for the Service, we collect your email address and your password (stored as a one-way cryptographic hash — we cannot see it). Lawful basis: contract (necessary to provide the Service).

2.2 Business profile data

When you set up your business profile, we collect your business name, address, phone number, email address, VAT registration number (if applicable), logo (if uploaded), and preferred invoice settings. Lawful basis: contract.

2.3 Client data

When you add clients, we store the name of your contact, their company name, email address, phone number, address, VAT number, and any notes you add. You are the data controller for your clients' data; we process it on your behalf as a data processor. You are responsible for ensuring you have a lawful basis to store your clients' personal data in our system. Lawful basis: contract and legitimate interests.

2.4 Invoice and financial data

We store the invoices, quotes, line items, time entries, and expense records you create. Note: we are also required by law to retain certain financial records for 6 years (a requirement of His Majesty's Revenue and Customs (HMRC)). Lawful basis: contract.

2.5 Payment data

When you subscribe to a paid plan, your payment is processed by Stripe. We do not store your full card number, expiry date, or CVV. Stripe stores this data under their own privacy policy and PCI DSS compliance. We receive and store only a payment token and basic billing information (last 4 digits, card type, billing country). Lawful basis: contract.

2.6 Usage data

We collect limited technical data including pages visited and features used (without personally identifiable content), device type, browser type, and operating system, IP address and approximate location (country/region), and date and time of access. Lawful basis: legitimate interests.

2.7 Email communications

We store records of emails sent through the Service (invoice delivery, reminders) including send status and whether an invoice has been viewed. Lawful basis: contract.

2.8 Push notification subscriptions

If you enable browser push notifications, we store your push subscription token. Lawful basis: consent. You can withdraw consent at any time by disabling notifications in your browser settings.

3. How we use your data

We use your data to provide, maintain, and improve the Service; process your subscription payments; send you invoices and service notifications (not marketing); respond to your support requests; comply with our legal obligations (including HMRC record-keeping requirements); detect and prevent fraud and abuse; and enforce our Terms of Service.

We do not sell your data to third parties, use your data to train AI models, send you marketing emails without your explicit consent, or share your data with any third party except as described in section 4.

4. Who we share your data with

We share your data only with the following trusted third parties, who process it on our behalf as data processors:

We have data processing agreements in place with each of these processors. We may also disclose your data where required by law, court order, or to cooperate with law enforcement or regulatory authorities.

5. International data transfers

Some of our processors are based outside the UK (see table above). Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), to ensure your data receives the same level of protection as it does under UK law.

6. How long we keep your data

7. How we protect your data

• Encryption at rest: All data in our database is encrypted using AES-256
• Encryption in transit: All connections to the Service use TLS 1.3
• Access controls: OAuth tokens are encrypted before storage using AES-256-GCM
• Infrastructure security: We use managed, regularly patched cloud infrastructure
• Access limitation: Only essential personnel have access to production systems, and all access is logged
• No plain-text passwords: Passwords are hashed using bcrypt before storage

Despite these measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Your rights under the UK General Data Protection Regulation (GDPR)

You have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you. We will respond within one month.
• Right to rectification: Correct inaccurate data. Most of your data can be corrected directly within your account settings.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data. You can delete your account at any time from your account settings.
• Right to data portability: Request your data in a machine-readable format (CSV or JSON).
• Right to restriction: Ask us to restrict processing of your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.
• Rights related to automated decision-making: We do not make any decisions about you based solely on automated processing.

To exercise any of these rights, contact us at [email protected]. We will respond within one month. We may need to verify your identity before processing a request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use a small number of essential cookies required for the Service to function (session management, security). These cannot be disabled. We do not use advertising or tracking cookies. See our Cookie Policy for full details.

10. Children's privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 30 days before they take effect. The "last updated" date at the top of this page will always reflect the current version.

12. Contact and complaints

HonestSoftware LTD
Lytchett House, Poole, Dorset, BH16 6FA
Email: [email protected]

Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113