Kept Books is bookkeeping software operated by Pulse Technology Advisory Limited. Accountancy practices use it to keep the books of their clients, and some businesses use it directly. This policy explains what personal data Kept Books handles, why, who is responsible for it, and what your rights are. It applies to everyone who uses Kept Books and to clients whose books are kept in it, including anyone who connects a bank account.
Who we are
Pulse Technology Advisory Limited is a company registered in England and Wales, company number [company number], registered office [registered office address]. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
Contact us about anything in this policy at [privacy contact email].
Who is responsible for your data
Data protection law gives each organisation a role. For Kept Books the roles are these:
- Your accountancy practice (for example Pulse Accountants & Tax Advisers Ltd) is the controller of your bookkeeping records and your bank data. It decides what is kept and why, under the engagement letter you have with it.
- Pulse Technology Advisory Limited is the processor of that bookkeeping and bank data. We handle it only to run Kept Books for your practice, on its instructions, and we do not use it for our own purposes.
- Pulse Technology Advisory Limited is the controller of account and platform records: the details of people who sign in, security and audit records, billing records, and the waiting list on our website.
- Where a business uses Kept Books directly, with no accountancy practice in between, that business is the controller of its own books and we are its processor.
If you are a client of a practice and have a question about your books, your practice is the first place to ask. We will help it answer.
Open banking bank feeds
Bank account information services are provided through Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority as an Authorised Payment Institution (firm reference number 925695) to provide account information services under the Payment Services Regulations 2017. Pulse Technology Advisory Limited acts as an agent of Finexer Ltd for those services.
A bank feed brings statement lines from your bank into your books automatically, so nobody has to download and upload a file. Connecting a bank account is always your choice. This is how it works.
- What we obtain. With your consent we retrieve, for each account you choose to connect, the account details (name, sort code, account number and currency), the balance, and the transactions. Nothing else. We cannot move money and we never ask for payment permissions.
- How you give consent. Your accountant (or you, if you run your own books) asks for a connection from the Bank screen in Kept Books. Finexer sends you a link by email, or the link opens in the browser in front of you. The link takes you to a consent page hosted by Finexer. It shows who is asking for access, what will be shared, and for how long. You then choose your bank and sign in at your bank, using your bank’s own security steps. Neither Kept Books nor Finexer ever sees or stores your bank login details.
- How long consent lasts. Your bank sets the consent period. It is usually 90 days. Kept Books shows when a consent is due to renew. After it ends, the feed stops until you give a new consent in the same way. A connection request that is not answered expires after seven days.
- How to stop it. You can revoke consent at any time, in three ways: press Stop next to the feed on the Bank screen in Kept Books; revoke the access at your bank; or ask your accountant to stop it. Retrieval stops immediately. Statement lines that were already imported stay in your books, because they are part of your accounting records.
- What it is used for. Retrieved bank data is used only for your bookkeeping and the accountancy services your practice provides: reconciliation, VAT and tax work, accounts, and reports. It is kept as part of your accounting records for as long as those records must be kept by law.
- How it is stored. The credentials that keep a feed running are encrypted at rest with AES-256-GCM, under a key held separately from every other secret. Finexer holds its own records of your consent, under its own privacy policy, which it shows you on its consent page.
What we process and why
- Financial records such as ledgers, bank statement lines, invoices, bills, receipts and tax figures, to keep your books and prepare what your practice files for you. Legal bases: contract, and legal obligation.
- Contact details of people who use Kept Books and of your customers and suppliers, such as names, email addresses and phone numbers, so that invoices, reminders and documents can be sent. Legal bases: contract, and legitimate interests.
- Receipts and documents you upload or email in, including the text read from them, so that they can be matched to your books. Legal basis: contract.
- Account and security records such as sign-in details, two-factor settings and an audit trail of significant actions, kept so that the books are safe and every change can be traced. Legal bases: contract, legitimate interests, and legal obligation.
- Billing records for the practice or business that pays for Kept Books. Legal bases: contract, and legal obligation.
- Waiting list details from our website, used only to tell you when Kept Books is open to you. Legal basis: consent, which you can withdraw by asking us.
Where data lives and who sees it
Kept Books runs on Vercel, in its London region, with its database hosted by Supabase in [database region, for example London (UK)]. All connections are encrypted in transit. Access to your books is limited to the people your practice has invited, each with their own account and permissions, and significant actions are written to an audit log.
We share data only with the service providers we need to run Kept Books, each under a written contract, and only for the purpose named:
- Hosting and database: Vercel and Supabase.
- Open banking connectivity: Finexer Ltd, as described above.
- Email delivery, in and out: Resend.
- Reading receipts and documents with AI: Anthropic. Only the document is sent, never your whole books.
- Billing: Stripe.
- Where your practice chooses to connect them: Xero, to bring books across from Xero, and Google Drive, to keep a copy of your receipts.
We also share data where the law requires it, for example a return your practice files with HMRC on your instruction. We do not sell personal data, and we do not use your books to train AI models.
How long we keep data
Bookkeeping records, including bank data, are kept for as long as your practice instructs us to, which is normally the period UK law requires for accounting records. When a practice ends its use of Kept Books, its data is deleted or returned according to its agreement with us. Account records are kept while an account is open and for a short period after it closes. Audit and security records are kept for [audit retention period].
Your rights
You have the right to ask for access to your personal data, to have it corrected, to have it deleted (subject to the records your practice must keep by law), to restrict or object to how it is used, and to receive a copy of it in a portable form. You can withdraw open banking consent at any time, as described above.
For bookkeeping and bank data, please ask your accountancy practice, which is the controller. For account and platform records, or if you are not sure, contact us at [privacy contact email]. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes to this policy
We may update this policy. The date at the top shows the current version. If a change affects how bank data is handled we will tell your practice before it takes effect.
See also our Terms of Use. Finexer Ltd, FCA firm reference number 925695, is listed on the Financial Services Register at register.fca.org.uk.