1. Controller and scope
Volodymyr Nesin, acting as a UK sole trader, is the controller for Sole Trader Receipt Copilot. Privacy enquiries may be sent to volodymyrnesin@me.com.
This notice covers a private, single-user service used only for the controller’s own sole-trader QuickBooks company. It is not a public accounting service.
2. What the service does
The service connects to one authorised QuickBooks Online company through Intuit OAuth. During initial production commissioning it operates read-only: it can retrieve company information, accounts, tax information, suppliers, customers, purchases, bills, invoices and supported financial reports. Production accounting writes and payment initiation are disabled.
3. Data processed
- QuickBooks company identity and authorised accounting records needed for the requested workflow;
- OAuth access and refresh tokens;
- security, approval, audit and diagnostic records; and
- technical information such as timestamps, provider request identifiers and network metadata.
The public legal website does not collect QuickBooks credentials or accounting records and uses no analytics or advertising cookies.
4. Purposes and lawful bases
Data is processed to operate and secure the controller’s accounting workflow, authenticate authorised access, retrieve and review accounting information, prevent unauthorised or duplicate actions, investigate failures and maintain necessary records. The applicable UK GDPR bases are the controller’s legitimate interests in operating and securing the sole-trader business and, where relevant, compliance with legal accounting and tax obligations.
5. Automated processing and human control
The service may extract, organise or propose accounting information automatically. It does not make legal or similarly significant decisions about other individuals. It does not provide legal, tax, lending, investment or insurance advice and does not move money. Outputs may be wrong and require human review.
6. Service providers and disclosures
Data may be processed by Intuit/QuickBooks Online and by Amazon Web Services in the United Kingdom region used to host the private service. Public legal pages may be delivered by a website-hosting provider that receives ordinary web-request metadata.
Superstrata provides technical hosting infrastructure only. It has no ownership of, or accounting authority over, the sole-trader books. Personal data is not sold.
Some providers may process limited data outside the United Kingdom under their contractual and legal transfer safeguards.
7. Security
Controls include encrypted transport, separate operating-system identities, private token custody, least-privilege access, entity-bound configuration, audit logging, restricted network exposure and fail-closed OAuth validation. No system can be guaranteed completely secure.
8. Retention and deletion
OAuth tokens are retained only while the QuickBooks connection remains authorised and are revoked or deleted following a verified disconnect. Security, diagnostic and audit records are kept only for as long as reasonably necessary to operate, secure and evidence the private workflow, and are reviewed for deletion when no longer required. Source accounting records remain in QuickBooks and are managed under the controller’s applicable accounting and tax obligations.
9. Rights and complaints
Subject to applicable law, an individual may request access, correction, deletion, restriction, portability or objection by contacting the controller. An individual may also complain to the UK Information Commissioner’s Office at ico.org.uk.
10. Changes
Material changes to this notice will be reviewed before deployment and shown by an updated date.