Privacy & Cookie Policy

1Who we are

Keelaris is operated by Maven Labs Ltd, a company registered in England and Wales, company number 13294893, trading as Keelaris ("Keelaris", "we", "us").

Registered office: Ground Floor, Synium House, Shallowford Court, R/O 94-96 High Street, Henley-in-Arden, B95 5FY.

Contact us about anything in this policy at [email protected].

We are the data controller for the personal data described here. Where an accounting firm uses Keelaris to serve its own clients, that firm is the controller of its clients' personal data and Maven Labs Ltd acts as the firm's processor under a written agreement.

2What we collect

• Account details. Your name, email address, phone number and login credentials.
• Tax and financial information. What is needed to keep your records and prepare your figures: income, expenses, property details, bank transactions where you connect an account, tax references such as your UTR and National Insurance number, and prior filings.
• Documents. Anything you upload, such as statements, receipts and returns.
• Firm and client data. If you are an accounting firm, the client details you add to Keelaris.
• Usage data. How you use the service, plus device and log information. See section 10 for cookies.

We do not ask for special category data such as health, religious or political information. Please do not upload it.

3What we use it for, and why we are allowed to

Each purpose below is paired with our lawful basis under UK GDPR.

• Running your account and providing the service. Performance of a contract.
• Keeping your records, tracking your deadlines, and preparing your figures and draft returns. Performance of a contract.
• Submitting filings to HMRC on your instruction. Performance of a contract. Keelaris is connected to HMRC's test environment only. Nothing you enter reaches HMRC until we have production access and you approve a submission.
• Sharing a draft with a qualified accountant, if you choose a plan that includes a review. Performance of a contract. This is not offered yet.
• Keeping the service secure, preventing fraud and abuse, and improving how it works. Legitimate interests.
• Meeting our own legal duties, including record keeping and, once we start them, anti-money-laundering checks. Legal obligation.
• Connecting your bank account through Open Banking. Consent, which you can withdraw at any time.
• Setting non-essential cookies. Consent, which you can withdraw at any time.

4AI and automated decisions

Keelaris uses software, including AI models, to read documents, classify transactions and draft figures. Two limits apply.

• A person approves every filing. Nothing is submitted to HMRC automatically.
• We do not make decisions about you that produce legal effects by automated means alone. If you disagree with how something was classified, ask us and a person will look at it.

We do not sell your data. Where we use third-party AI services, we use them under terms that prohibit training on your data.

5Who we share it with

We share your data only where it is needed to run the service:

• HMRC, when you instruct us to file and once we hold production access.
• An accountant you choose, or the firm whose client you are.
• Service providers acting on our instructions, each under a written contract. Today these are Cloudflare, Inc. for website hosting, DNS and email routing, and Google Cloud for application hosting, the database and file storage.
• Where the law requires it, or to establish or defend legal claims.

We have not engaged a payments, e-signature, identity-checking or Open Banking provider. We will name any such provider here before it starts processing your data.

6Where your data is held

Your account data, the database, uploaded documents, backups and stored secrets sit in Google Cloud's London region (europe-west2).

The public website is served from Cloudflare's global network and holds no account data. Email sent to [email protected] is routed by Cloudflare and delivered to a Google mailbox.

Where a provider processes data outside the UK, that transfer is covered by the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation.

7How long we keep it

• Account data. While your account is open, then deleted within 30 days of closure, apart from what is listed below.
• Tax records. HMRC requires the self-employed and landlords to keep records until at least five years after the 31 January filing deadline for that tax year, and companies to keep records for six years from the end of the accounting period. We keep your records for those periods so you can meet that duty. You can export or delete them sooner, but the duty stays with you.
• Anti-money-laundering records, once we start those checks. Five years from the end of our business relationship, as the Money Laundering Regulations 2017 require.
• Technical logs. 12 months.

After those periods data is deleted or anonymised.

8Security

Data is encrypted in transit and at rest. Access is limited to the people who need it. Secrets are held in Google Secret Manager in London, and sensitive actions are logged.

No system is perfectly secure. If a breach puts your rights at risk we will report it to the ICO within 72 hours as the law requires, and tell you directly where the risk to you is high.

If you think you have found a security or data-protection problem, email [email protected] with "Security" in the subject line and we will prioritise it.

9Your rights

Under UK data protection law you can ask us to:

• give you a copy of your data, or a portable export of it;
• correct it if it is wrong;
• delete it, where we are not required to keep it;
• restrict or object to how we use it;
• stop relying on consent, where consent is the basis.

Email [email protected]. There is no charge, and we will answer within one month. If a request is complex we may take up to two further months, and we will tell you within the first month if that happens.

You can also complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you gave us the chance to put it right first.

10Cookies

Keelaris sets essential cookies only: the ones that keep you logged in and remember your cookie choice. They are needed for the service to work, so they are always on.

We set no analytics or advertising cookies today. If we add analytics, the banner will ask first and you can change your answer at any time. Declining non-essential cookies will not stop you using Keelaris.

11Children

Keelaris is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email us and we will delete it.

12Changes and contact

We may update this policy. The new version goes here with a new date, and we will tell account holders directly about any change that materially affects them.

For any question about your privacy, or to exercise your rights, email [email protected].