Skip to content

Privacy Policy

Last updated 7 October 2026

This policy explains what Lekhio collects, why we collect it, and what we do with it. We handle your data under the UK General Data Protection Regulation and the Data Protection Act 2018. We keep this short and plain on purpose.

Who we are

Lekhio provides bookkeeping and tax preparation tools for people running a business or letting property in the UK: sole traders, partnerships, limited company directors and landlords. For data protection law, Lekhio is the data controller for the information described here. You can reach us any time at info@lekhio.app.

What we collect

Why we collect it

We process your data to deliver the service you signed up for, which is performance of a contract. We also process some data to meet our legal duties, such as keeping records.

The notes we send about your own account rely on our legitimate interest in helping you use the service you signed up for. You can stop them any time: each one we email you while you try Lekhio has a link to unsubscribe, and you can turn the weekly summary off in Settings.

If you asked for tips and news

If you ticked the box for occasional money saving tips and news about Lekhio on one of our pages, we email you those, and only after you have confirmed your address with the link we send you. The lawful basis is your consent. You can withdraw it at any time: every one of those emails has a link to unsubscribe, and it works straight away. We keep your address, the words you agreed to and when, for as long as you want to hear from us. If you unsubscribe, we keep a record of it with your address, so that we never email you again.

Tax and HMRC

Lekhio prepares your figures. You always review and approve them. We never submit anything to HMRC without your explicit approval, and we never imply that HMRC endorses Lekhio. You remain legally responsible for your own tax at all times.

HMRC, if you connect it (optional)

This section applies only if you connect Lekhio to HMRC. It is your choice, it is the same whether or not you pay for Lekhio, and if you have never pressed Connect HMRC, we hold none of this about you.

How you connect. You sign in to HMRC on HMRC's own website and tell HMRC to let Lekhio in. We never see your Government Gateway user ID or password.

Your National Insurance number. HMRC finds your tax record by it, so every request we make to HMRC for you names it. We ask for it once. We store it encrypted, and we only ever show it back to you with the middle hidden, like QQ •• •• •• C. It never goes in a Lekhio web address or in our logs. It goes only to HMRC, whose own web addresses carry it.

The keys HMRC gives us. When you connect, HMRC gives Lekhio a pair of keys that let us reach your tax record. We store them encrypted and use them only for what you ask Lekhio to do. We never send HMRC an update or a return without your explicit approval.

What we read from HMRC. The businesses HMRC holds for you, each with HMRC's reference for it and its trading name, so Lekhio reads the right one. We keep that list. If you ask Lekhio to show you something else HMRC holds, such as your deadlines or the figures HMRC already has, we read it to show you and we do not keep it.

Details of your device and connection. HMRC's fraud prevention rules require any software that connects to HMRC to send, with every request, details of the device and the connection the request came from. For Lekhio that is your public IP address and, where your device can report it, the port it used, the time, an identifier Lekhio gives your device, your browser's name and version as it reports them, your screen size, window size and time zone, the reference number of your Lekhio account, and when you signed in, with a scrambled reference to that sign in that cannot be turned back into it. HMRC uses them to protect your tax record from fraud. We keep the last set of device details your device sent us, so we can send them with the requests we make for you. We take them when you press Connect HMRC, before you sign in at HMRC, and if you stop part way they stay until you disconnect HMRC or delete your account. Your IP address is not kept for this: it is read from each request as it happens.

Who sees it. HMRC, and only HMRC. These go to HMRC with each request we make for you, and nowhere else.

Why, and the lawful basis. We use all of this only to connect to HMRC for you and to do there what you ask Lekhio to do. The lawful basis is performance of our contract with you, because you asked us to connect. HMRC's rules require the device details with every request we make for you.

Disconnecting deletes it. You can disconnect HMRC at any time, whatever plan you are on, on the HMRC page in Lekhio, whenever we hold any of this for you, even if you never finished connecting. Disconnecting deletes the keys, your National Insurance number, the list of your businesses and the device details we kept for HMRC, and after that Lekhio cannot reach your HMRC record unless you connect again. It does not change anything HMRC holds. Deleting your account deletes all of it too.

How we store and protect your data

Your data is encrypted in transit and at rest. We store it with trusted infrastructure providers and limit access to the people and systems that need it. We do not sell your data and we never use it to train anybody's AI models.

Reading your receipts and voice notes (AI)

Lekhio uses AI to read a photo of a receipt and to understand what you tell it. One provider does that work for us, under contract, on our instructions and nobody else's. Your voice notes we transcribe ourselves:

Anthropic is the provider. What we send it, and only when you use that part of Lekhio: photos of receipts and invoices you upload or snap, to read the shop, the total, the date and any VAT; the words you type into Ask Lekhio, with figures from your own books when your question is about them, to answer you; a tax return or statement of earnings from an earlier year if you upload one, to read the figures off it; the names of the shops and people you paid, when you ask us to sort a pile of them into headings; and the words of a message you send us on WhatsApp or by email, typed or spoken, when our own rules cannot read it, so the figures in it can be picked out. Nothing on our WhatsApp number replies on its own, so what we read comes back to you as a notification and in the app. Bank statements and CSV files are read by our own code and never go to Anthropic. It is a processor under written terms: it works on our instructions, may not use your data for its own purposes, does not train its models on it, and holds it under the same protections we do, encrypted in transit and at rest. In the Lekhio app we ask your permission on screen before anything is sent, and you can withdraw it at any time under You.

Your voice notes never leave our systems. Turning speech into text is the one thing our AI provider cannot do, so instead of handing your audio to another company, we run the transcription on our own hardware. No third party ever hears your voice note, and the audio is deleted the moment it has been read.

We do not keep the text of your voice notes. A voice note is transcribed, the amount, the vendor, the category and the date are taken from it, and the transcript is discarded. It is not stored and it is not shown back to you in your books. Messages you type yourself are stored, because they are your own words and you can see and correct them.

Health information

A small number of tax allowances depend on a health condition. The Blind Person's Allowance is the one that matters to our users. The law treats health information differently from everything else, and rightly so.

We will never ask you about a health condition over WhatsApp. We ask in the app, on its own, and only after you have said yes to a separate request that explains exactly what we would do with the answer. If you say no, or say nothing, we do not ask and you lose nothing else. If you say yes and later change your mind, you can delete it in the app and it is erased, not hidden. Our lawful basis is your explicit consent, and nothing else.

Your bank payments, read on your phone (optional)

This section applies only if you press Connect your bank in the Lekhio app on your phone, so that your payments arrive on their own instead of you sending each one. It is always your choice and never required, and Lekhio works fully without it. If you have not turned it on, nothing described below applies to you and we hold none of this data about you.

We do not use an open banking provider. No company connects to your bank on our behalf, and we never see your bank login. Your phone does the reading, in one of the two ways below. If we ever engage an open banking provider, we will name it on this page before a single customer can connect through it, so that you know who would see your information before you decide whether to let them.

On iPhone, through Apple Wallet. You add your bank account or card to Apple Wallet, Apple connects to your bank, and you give the Lekhio app permission to read the payments Wallet holds. The app reads them on your phone and sends us each one: the shop or payee, the description your bank gives it, the amount, whether the money went in or out, the date, the category code the card scheme gave it, which account it came from, and an id so the same payment never lands twice. The first time you connect, that includes the past payments Wallet already holds. Lekhio does not read your balance, and your card number is not something we ask for or hold.

On Android, from your notifications. If you switch on notification access for Lekhio, the app reads the payment notifications your banking app or Google Pay shows you, as they arrive. Android lets an app with this permission see every notification, so Lekhio checks which app each one came from first, and only reads those from the banking and payment apps on its list. Every other app's notifications are ignored: not read, not kept, not sent. For each payment the app sends us the shop or payee, the amount, whether the money went in or out, the date and time, which app it came from, and the words of the notification as your bank wrote them. If your bank puts your balance in that notification, Lekhio takes the balance out before those words are stored, and a notification that only tells you your balance is not a payment, so we do not keep it. There is no history on this route: only payments from the day you switch it on, held on your phone until the app sends them.

A bank statement, from any bank. You can also send us a statement file instead. Our own code reads it, and we keep the payment lines in it: the date, the description and the amount. The file itself is not kept once the lines are in, and it never goes to our AI provider.

However they arrive, these payments are used for one purpose: to build your bookkeeping records so your tax figures are right. Each one arrives unconfirmed and counts toward nothing until you say yes, unless it is from a shop you have already told Lekhio how to file. They are never sold, and they are shared only with the providers named on this page.

All of it is read only. Lekhio cannot move money, make a payment, or change anything in your account, because there is no code in it that could.

You can stop at any time. Both ways are permissions on your phone, and you can take them back in your phone's settings whenever you like. You can also disconnect in the app, which asks whether to keep the payments already sent or remove them from your books. The lawful basis is your consent for reading your payments, and performance of our contract with you for the books built from them.

Lekhio Ltd is registered with the Information Commissioner's Office as a data controller, reference ZC198977, which you can check on the public register at ico.org.uk.

Mileage, and your location (optional)

You can claim the miles you drive for work, and there are two ways to record them. You can type a journey in yourself, or send it by message, which involves no location data at all. Or, in the Lekhio app on your phone, you can turn on automatic mileage. This section is about the second one. It is off unless you turn it on, it is never required, and Lekhio works fully without it. If you have not turned it on, nothing below applies to you and we hold none of this data about you.

What the app accesses. With automatic mileage on, the Lekhio app on your phone accesses your device's precise location data, including in the background when the app is closed or not in use, within the counting hours you set. That is what lets it notice a drive you started before you opened the app. Your phone asks for this permission in two steps, while the app is in use and then all the time, and the app tells you what it is for before each ask. Location data is collected for one purpose only: to measure the distance of each journey so you can claim the miles. It is not used for advertising, it is not sold, and it is not shared with anyone. The readings stay on your phone: it keeps only the last position long enough to measure the next stretch of the drive, and only the distance, the start and end times, and the vehicle ever reach us.

What we keep is a distance, not a map. When a journey ends we record how far it was, when it started and when it finished, and the vehicle. If you choose to, you can add a place name in your own words, such as Wickes, or the Henderson job. That is the whole record.

We do not keep your route, and we could not if we wanted to. There is no column in our records for a route, a series of positions along the way, a street address, a postcode, or map coordinates. Your phone works out how far you went; what reaches us is the answer. We never know where your customers live, and we do not need to in order to count your miles.

Journeys wait on your phone until you open the app. They are held on the device and sent to us the next time you open Lekhio and are signed in. They go nowhere else and to nobody else. When they arrive, every one of them is waiting on you: no journey counts as business, and nothing goes anywhere near your figures or a tax return, until you say it was for work. HMRC expects a record behind a mileage claim, and that is what this is.

You can turn it off at any time, in the app or in your phone's own settings, and it stops there and then. The lawful basis is your consent for the tracking itself, and performance of our contract with you for keeping the mileage record your books and your tax figures rest on. Journeys are part of your records like everything else on this page: they come out in a copy of your data if you ask for one, and they are deleted when you delete your account.

If your phone had to throw a journey away, we keep the fact that it happened. Journeys wait on the handset, and there is a limit to how many it will hold, so a phone left off for a long stretch drops the oldest ones. We record how many were lost and the date they were older than, so the app can tell you rather than let them vanish quietly. That record is a count and a date. It is never the journeys themselves, because by then they are already gone. It clears once you have seen it, and it is deleted with the rest of your data when you delete your account.

Where we process your data

Your records are stored in the United Kingdom, in a London data centre run by our database provider. Some processing happens on servers in the United States run by our hosting provider, so the app can run. These transfers to the United States are covered by the UK extension to the EU to US Data Privacy Framework, under which the provider is certified, so your data keeps an equivalent level of protection to the UK. We only use providers that are bound to protect your data and that act on our instructions.

Who we share it with

We do not sell your data. We share it only with the service providers that help us run Lekhio: our hosting, database, payment and messaging providers, and the AI provider above. They act on our instructions and are bound to protect your data. If a recognised tax submission path is used, it only happens after you approve.

If you connect HMRC, HMRC receives the requests we make for you, with your National Insurance number and the device details its fraud prevention rules require.

Our backups. Every night we take a complete copy of the database, so that we can put your records back if something fails. The copy is encrypted before it leaves our machine, using a key that is not kept on that machine, and a second copy is stored in Google Drive so that both copies are never on one disk. Google holds the file and cannot read it. We keep fourteen nights and delete the rest.

Sharing your books with someone (optional)

You can choose to give someone a read only view of your books, for example a mortgage broker, a lender, a landlord, or an accountant if you use one. This is entirely your decision, it is off unless you switch it on, and Lekhio works fully without it.

When you create a link you choose who it is for, which dates it covers, which categories to leave out, and how long it lasts. You can turn it off at any time from the app and the link stops working immediately. Whoever holds it sees only the entries you confirmed, inside the dates you chose, minus the categories you excluded: the date, the merchant, the category and the amount. They cannot see your receipt photos, your voice notes, your WhatsApp messages, your phone number or your bank connection, and they cannot change anything. We show you how many times the link has been opened and when it was last used, so you can see it being used and spot it being used when you did not expect it.

Cookies, and measuring whether our ads work

Lekhio sets one cookie to keep you signed in. That one is necessary and there is no choice about it, because without it the site cannot know it is still you.

We also measure how many people visit, using Vercel Web Analytics. It sets no cookie, stores nothing personal, and cannot follow you anywhere else, which is why we chose it for a product that holds tax records.

Advertising is the one that needs your permission. If we are running ads and you say yes, we load Meta's pixel and Google's ads tag so we can tell whether an ad brought anybody here. Meta and Google then know you looked at that page, and each is a joint controller with us for that. We ask before it loads anything, and if you say no it never loads.

Three things about it are worth saying plainly. It runs only on our public pages, the ones anybody can read without signing in. It never runs where your books, your figures, your invoices or a link you shared with somebody are, and the server refuses to load it there even if we made a mistake in our own code. And we have switched off Meta's automatic collection and Google's enhanced conversions, so neither reads what you type into our calculators or who you are.

You can change your mind at any time, and it takes effect immediately. Saying no also deletes the cookies it set.

One more thing we do, and it is not a cookie. When you finish signing up, and again when your first payment goes through, our server tells Meta that a signup or a sale happened, so we can tell which of our ads are working. It sends a scrambled version of your email address that cannot be turned back into it, for a signup the address of the connection and the kind of device, for a sale the amount paid, and nothing else: not your name, not your trade, not a figure from your books. We do this on the basis of our legitimate interest in measuring our own advertising. If you said no on the cookie bar, we do not send either of them at all.

And one step earlier than that. When you type your email address on our signup page and press the button, and you said yes on the cookie bar, our server tells Meta that somebody started signing up. It sends the same scrambled version of your email address, the address of the connection, the kind of device and which of our pages you were on, and nothing else. We keep no copy of any of it for this. Without that yes it is never sent.

If we wrote to you and you are not a customer

This section is for businesses we have contacted, or may contact, who have never used Lekhio. It is here because we obtained your details from somewhere other than you, and UK GDPR says you are owed a straight answer about that. So here it is.

Where we got it. One of three places, all of them public. The Companies House register, which is where a registered office address comes from and where we check that a company is still trading. The Environment Agency's public register of waste carriers, brokers and dealers, which names the businesses licensed to move waste and states whether each registration belongs to a limited company or to a person. And a business's own website, where a company has published a contact address for customers to use.

What we hold. Your company name and number, the registered office address, the town you trade in, and where one was published, one business email address. Alongside it we keep a note of the exact page or register each of those came from, so this answer can be given about your record specifically and not just in general.

Why. To tell limited companies in the trades that Lekhio exists. The legal basis is our legitimate interests in reaching potential customers, balanced against your interest in not being bothered. That balance is why we write to companies and not to sole traders, why the postal piece says it is the only one we will send, and why one refusal ends it permanently.

Who else sees it. The postal address is passed to the mail house that prints and posts the item, and to nobody else. We do not sell, rent, share or trade any of it, and we never will.

How to make it stop. Email info@lekhio.app and say so. We remove you and keep the bare minimum needed to make sure we never contact you again, which is the only reason we keep anything at all after that. You can also ask for a copy of what we hold, ask us to correct it, or object to the whole thing, and you can complain to the Information Commissioner's Office at ico.org.uk. You do not have to give a reason for any of it.

If you message our WhatsApp number and you are not a customer

A person at Lekhio reads it on our sales desk and may write back to you there, within the 24 hours WhatsApp allows after your last message. We keep your number and the words you sent, so whoever writes back can see the conversation; a photo, a voice note or a file is kept only as a line saying one arrived. The legal basis is our legitimate interests in answering somebody who wrote to us. Send the word STOP and nobody from Lekhio will message that number again, and email info@lekhio.app to ask for a copy of what we hold or for it to be removed. If you already have a Lekhio account, your messages never reach the sales desk.

If you met one of our sellers

Lekhio's sellers are independent, self employed people who introduce Lekhio to people who work for themselves. If you spoke to one and were happy to hear from Lekhio again, the seller may have put your details on Lekhio's sales desk. Lekhio Ltd is responsible for them, and the seller handles them for us, only as we say.

What we hold. Your business name and your name, the kind of business, your trade and area, the phone number and email address you gave, whether you said yes to WhatsApp messages or emails from us, and short notes of what you talked about and when.

Why. To follow up the conversation the way you agreed to and, if you sign up, to know which seller introduced you so that we can pay them. The legal basis is our legitimate interests in following up with somebody who was happy to hear from us, balanced against your interest in being left alone. That balance is why we send a WhatsApp or an email only if you said yes to it, why sellers do not cold call, and why one request ends it.

Who else sees it. The seller who met you, and Lekhio. Our other sellers can see that your business is already somebody's, with your first name and a rough area on a map, so that nobody else knocks on your door. They never see your phone number or email address. To place that rough area we look up the postcode or town you gave on postcodes.io, and nothing else about you goes with it.

How long. Until 12 months after the last contact with you, unless you become a customer, and then we delete it. If you ask us never to contact you again, we keep only your email address, phone number or company number on a list, so that we never do.

Your rights. Tell the seller, reply stop, or email info@lekhio.app, and nobody from Lekhio contacts you again. You can also ask for a copy of what we hold, ask us to correct it or delete it, or object to it, and you can complain to the Information Commissioner's Office at ico.org.uk.

How long we keep it

We keep your financial records for as long as your account is active, and afterwards for the period required by UK tax and accounting rules. When that period ends, we delete or anonymise your data.

Your HMRC connection, your National Insurance number and the details kept with them stay until you disconnect HMRC or delete your account, whichever comes first.

Your rights

You have the right to:

Two of these you can do yourself, right now, without asking us: sign in and go to You. Delete your account, the last row there, deletes your account and what is in it. Your data, under Your documents, gives you a copy of everything we hold in one file. For anything else here, email info@lekhio.app. You can also complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.

Changes to this policy

If we change this policy, we will update the date at the top and, where the change is significant, we will tell you.

Contact

Questions about your privacy. Email info@lekhio.app and we will help.

Read our Terms of Service