Privacy

Privacy policy

Last updated 21 August 2026. This is the privacy policy for brassbooks.co.uk.

Brass is a digital books product for UK sole traders. It is operated from the United Kingdom. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have. We do not sell your data. We do not use the lines in your books to target ads. We do not send marketing emails.

If you only want the short version: we keep the details needed to run your account and your books, we use Stripe to take payment, Mailgun to send transactional email, Google Analytics to see which pages people use, and a Meta Pixel to measure Facebook and Instagram ads. You can delete your account in Settings.

Who we are

The data controller is Brass, trading as brassbooks.co.uk, United Kingdom. Write to hello@brassbooks.co.uk about anything in this policy.

This site is not HMRC and is not an accountant. This policy is about your data, not tax advice.

What we collect

When you create an account or use Brass we may store:

Your email address, and a name if you add one.
A hashed password. When you start we email a temporary one, then you choose your own. We cannot read the password back.
A login link token until you use it or it expires, and a password reset token if you ask for one.
The date you signed up, and when your 14 day trial ends.
Your trade name, and the lines in your books: date, description, category, amount in pence, and miles and vehicle type if you log mileage.
Receipt photos you attach to a line. Those files are in private storage, not on a public URL.
Text needed to fill a line after you photograph a receipt. Reading the date, amount and shop happens on your device. We only receive what is needed to suggest the fields. You check it before you save.
Rows from a bank CSV you import, while you review them, then as lines if you confirm. We do not keep the original file after that.
An accountant share token and optional note, if you create a read-only link.
A Stripe customer id, card brand and last four digits, and subscription status, so we can bill you. We do not store the full card number. Stripe does.
Session data so you stay logged in, including IP address and browser user agent.
How you use the site (pages, device, and approximate location), collected by Google Analytics. That is not tied to the lines in your books.
Page views and whether you started an account or a trial, sent to Meta so we can measure Facebook and Instagram ads. We do not send Meta your books, receipt photos, or the contents of your pack.

If you email us, we will also have whatever you put in that message.

Why we use it

We use this data to:

Create and run your account, including log in, password reset, and Settings.
Keep your books, receipt photos, mileage, imports, exports, and accountant pack.
Take payment, run the 14 day trial, and show billing status. That is Stripe.
Email you transactional messages that are part of the product.
Keep the service secure, including rate limits and session cookies.
See which pages people use, so we can improve Brass. That is Google Analytics.
Measure Facebook and Instagram ads, including whether someone who saw an ad started an account or a trial. That is the Meta Pixel.
Reply if you write to us.

Under UK GDPR the main lawful bases are: contract (to provide Brass to you), legitimate interests (security, stopping abuse, reminding you the trial is ending, measuring ads), and legal obligation (records of our own sales). We do not use your books to profile you, train a public model, or sell advertising.

Emails we send

Brass sends transactional email only. That means messages you need for the product, not newsletters and not promotions. We currently send:

A welcome email with a temporary password when you start.
A login link when you ask for one.
A password reset if you forgot it.
A reminder a few days before each of the four HMRC dates (5 July, 5 October, 5 January, 5 April), with running totals and a link to the books.
A nudge three days before the trial ends.

Those emails go through Mailgun, which is our email provider. We give Mailgun your email address and the content of the message so it can be delivered. We do not buy lists. We do not send unsolicited bulk email. If you delete your account, we stop emailing that address from Brass.

Who we share it with

We share personal data with the companies that actually run the product for us:

Stripe (Stripe Payments UK Ltd / Stripe, Inc.) processes cards, invoices, tax at checkout if we are registered to collect it, and the customer portal. See Stripe's privacy policy.
Mailgun (a Sinch service) sends the transactional emails listed above. See Mailgun's privacy policy.
Google (Google Ireland Limited / Google LLC) runs Google Analytics on this site. See Google's privacy policy.
Meta (Meta Platforms Ireland Limited / Meta Platforms, Inc.) receives Pixel events so we can measure Facebook and Instagram ads. That includes page views, a complete registration when you start an account, and a start trial after Stripe checkout. See Meta's privacy policy. The accountant pack does not load this Pixel.
The host that runs brassbooks.co.uk and stores the database and private receipt files. We keep that in the United Kingdom or the European Economic Area.

If you create an accountant link, anyone with that URL can see this trade's books and receipt photos until you stop sharing. That is you choosing to share, not us selling access. You are responsible for who you send it to.

We may also disclose data if the law requires it, or to protect Brass, our users, or other people from serious harm or crime. We will not sell your email list.

Where it is stored

Brass is operated from the United Kingdom. Account data, books, and receipt photos are stored in the UK or the EEA. Stripe, Mailgun, Google, and Meta may process data in the United Kingdom, the EEA, and the United States. Where that happens they use contracts approved for international transfers, such as the UK International Data Transfer Addendum or EU standard contractual clauses.

How long we keep it

Your account, books, and receipt photos stay until you delete the account, or we close it under the terms.
Login links expire after 30 minutes. Password reset tokens follow Laravel's usual short window.
Session records last for the session lifetime, then drop out.
If you delete the account we remove your user, trade, lines, receipt files, and accountant link. Stripe may still hold invoices and payment records because they have to, for their own legal duties. Mailgun may retain delivery logs for a limited time on their side.
We may keep a minimal record that an account existed if we need it for a dispute, fraud, or tax, and no longer than we need it.

Cookies

Brass uses a session cookie to keep you logged in, and a token to stop cross-site form abuse. Google Analytics sets its own cookies so we can see which pages people use. The Meta Pixel sets cookies so we can measure Facebook and Instagram ads. We do not use those cookies to retarget you from the contents of your books.

Your rights

Under UK GDPR you can ask us to:

See the personal data we hold about you.
Correct it if it is wrong.
Delete it (you can also do this yourself in Settings).
Download a copy of your books. PDF and CSV export are in the product.
Restrict or object to certain processing, where that right applies.

Change your email or trade name in Settings, or delete the account there. Deleting the account cancels a paid plan immediately and removes the books. You can also write to hello@brassbooks.co.uk. We will respond within a month.

If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Brass is for self-employed adults. It is not aimed at anyone under 18. Do not create an account for a child.

Changes

If this policy changes we will update this page and the date at the top. If the change is material we will email the address on the account. The current policy lives at brassbooks.co.uk/privacy.

Contact

Brass · United Kingdom · hello@brassbooks.co.uk