Privacy Policy

Last updated 26 July 2026

This policy explains what Lekhio collects, why we collect it, and what we do with it. We handle your data under the UK General Data Protection Regulation and the Data Protection Act 2018. We keep this short and plain on purpose.

Who we are

Lekhio provides bookkeeping and tax preparation tools for people running a business or letting property in the UK: sole traders, partnerships, limited company directors and landlords. For data protection law, Lekhio is the data controller for the information described here. You can reach us any time at info@lekhio.app.

What we collect

Why we collect it

We rely on two legal bases. We process your data to deliver the service you signed up for, which is performance of a contract. We also process some data to meet our legal duties, such as keeping records.

Tax and HMRC

Lekhio prepares your figures. You always review and approve them. We never submit anything to HMRC without your explicit approval, and we never imply that HMRC endorses Lekhio. You remain legally responsible for your own tax at all times.

How we store and protect your data

Your data is encrypted in transit and at rest. We store it with trusted infrastructure providers and limit access to the people and systems that need it. We do not sell your data and we never use it to train anybody's AI models.

Reading your receipts and voice notes (AI)

Lekhio uses AI to read a photo of a receipt and to understand what you tell it. One provider does that work for us, under contract, on our instructions and nobody else's. Your voice notes we transcribe ourselves:

Anthropic reads receipt photos and messages, and works out what you are asking. It is a processor: it may not use your data for its own purposes and does not train its models on it.

Your voice notes never leave our systems. Turning speech into text is the one thing our AI provider cannot do, so instead of handing your audio to another company, we run the transcription on our own hardware. No third party ever hears your voice note, and the audio is deleted the moment it has been read.

We do not keep the text of your voice notes. A voice note is transcribed, the amount, the vendor, the category and the date are taken from it, and the transcript is discarded. It is not stored and it is not shown back to you in your books. Messages you type yourself are stored, because they are your own words and you can see and correct them.

Health information

A small number of tax allowances depend on a health condition. The Blind Person's Allowance is the one that matters to our users. The law treats health information differently from everything else, and rightly so.

We will never ask you about a health condition over WhatsApp. We ask in the app, on its own, and only after you have said yes to a separate request that explains exactly what we would do with the answer. If you say no, or say nothing, we do not ask and you lose nothing else. If you say yes and later change your mind, you can delete it in the app and it is erased, not hidden. Our lawful basis is your explicit consent, and nothing else.

Connecting your bank (optional)

This section applies only if you connect a bank account to Lekhio, so that your transactions arrive on their own instead of you sending each one. Connecting one is always your choice and never required, and Lekhio works fully without it. If you have not connected an account, nothing described below applies to you and we hold none of this data about you.

Today there is no bank connection to make. We are not naming an open banking provider here, because we do not have one, and naming a company that handles none of your data would be worse than saying nothing. When one is engaged we will name it on this page before a single customer can connect, so that you know who would see your information before you decide whether to let them.

Whoever it turns out to be, they will be authorised and regulated by the Financial Conduct Authority to provide account information services, you would give consent in your bank's own screens rather than ours, and we would never see your bank login details. The access would be READ ONLY: account information, balance and transactions. It could not move money, make payments, or change anything in your account.

That data would be used for one purpose: to build your bookkeeping records so your tax figures are right. Incoming transactions would arrive as unconfirmed entries and count toward nothing until you confirm them, exactly like a receipt you send us. Access tokens are encrypted and stored on our servers only. You would be able to disconnect at any time, in the app or by emailing info@lekhio.app, and to withdraw consent with your bank directly. The lawful basis would be your consent, and performance of the contract to deliver the service.

Lekhio Ltd is registered with the Information Commissioner's Office as a data controller, reference ZC198977, which you can check on the public register at ico.org.uk.

Where we process your data

Your records are stored in the United Kingdom, in a London data centre run by our database provider. Some processing happens on servers in the United States run by our hosting provider, so the app can run. These transfers to the United States are covered by the UK extension to the EU to US Data Privacy Framework, under which the provider is certified, so your data keeps an equivalent level of protection to the UK. We only use providers that are bound to protect your data and that act on our instructions.

Who we share it with

We do not sell your data. We share it only with the service providers that help us run Lekhio: our hosting, database, payment and messaging providers, and the AI provider above. They act on our instructions and are bound to protect your data. If a recognised tax submission path is used, it only happens after you approve.

Sharing your books with someone (optional)

You can choose to give someone a read only view of your books, for example a mortgage broker, a lender, a landlord, or an accountant if you use one. This is entirely your decision, it is off unless you switch it on, and Lekhio works fully without it.

When you create a link you choose who it is for, which dates it covers, which categories to leave out, and how long it lasts. You can turn it off at any time from the app and the link stops working immediately. Whoever holds it sees only the entries you confirmed, inside the dates you chose, minus the categories you excluded: the date, the merchant, the category and the amount. They cannot see your receipt photos, your voice notes, your WhatsApp messages, your phone number or your bank connection, and they cannot change anything. We show you how many times the link has been opened and when it was last used, so you can see it being used and spot it being used when you did not expect it.

How long we keep it

We keep your financial records for as long as your account is active, and afterwards for the period required by UK tax and accounting rules. When that period ends, we delete or anonymise your data.

Your rights

You have the right to:

Two of these you can do yourself, right now, without asking us: sign in and go to You, then Your data. You can take a copy of everything we hold in one file, and you can tell us to delete your account and what is in it. For anything else here, email info@lekhio.app. You can also complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.

Changes to this policy

If we change this policy, we will update the date at the top and, where the change is significant, we will tell you.

Contact

Questions about your privacy. Email info@lekhio.app and we will help.

Read our Terms of Service