Privacy notice

Vedas plays two roles under UK GDPR.

• We're the controller for the data we use to run Vedas itself: the accounts of the people at accounting firms who use it, people who visit our website, and people who contact us.
• We're a processor for the client documents and data that accounting firms upload. The firm is the controller. We process that data only on the firm's instructions, under our Data Processing Agreement. If you're a firm's client and want to use your rights over that data, contact the firm. We'll help them.

As controller:

• People at accounting firms: name, work email address, firm name and role, sign-in records (the time, IP address and browser of each session), and what you do in Vedas, such as the jobs you create and the answers you give. We keep an audit record of important actions.
• Client link users: the email address you sign in with, and what you upload or answer.
• Website visitors: the server records requests (IP address, browser and the page asked for) to keep the service running and secure. We use no advertising tools and no analytics provider. We count visits ourselves, without cookies: for each page we keep its address without personal identifiers, the website that linked to it and any campaign tags, with a code that changes every day, made from a one-way hash of your IP address, browser and the date under a secret key. We keep no IP address or browser details with these records, the stored records cannot be linked from one day to the next, and they are deleted after 400 days.
• People who contact us or use the Feedback button: what you send us, the page you sent it from and, if you give it, your email address. For a firm's own people, the feedback form also carries the firm and job references, never client names or figures.
• Help search questions: the question you type. We log questions without digits, email addresses or web links, to find gaps in our help pages.
• Terms acceptance: when a firm's Partner accepts our Terms and DPA, we record their name as typed, their role, the time, their IP address and browser.

As processor for accounting firms, we handle data about:

• The firm's own clients: sole traders, partners, company directors and shareholders, landlords and individuals whose returns or accounts the firm prepares.
• People named in those clients' documents: customers, suppliers, employees, tenants, payers and payees on bank statements, invoices and receipts.
• The firm's clients who use a client link to answer questions or upload files.

That data can include:

• Names, addresses, email addresses and phone numbers printed in the documents.
• Financial data: bank transactions, invoices, receipts, payslips, P60s, pension, interest, dividend and rent statements, and the figures worked out from them.
• Tax references, such as VAT registration numbers, Unique Taxpayer References and company numbers.
• Answers and notes the firm's people or their clients type into Vedas.
• Any other personal data the firm chooses to upload. Special category data is not needed, and firms should not upload it on purpose.

• To provide Vedas to your firm, including sign-in, sending sign-in links and invitations you ask for, and keeping each firm's data apart: performance of our contract with your firm, and our legitimate interest in providing a working service to the people at that firm.
• To keep Vedas secure, prevent abuse and fix faults, including rate limits and audit records: our legitimate interest in a secure, reliable service.
• To answer your questions and feedback, and to improve our help pages: our legitimate interest in supporting users and improving the service.
• To keep a record of who accepted our terms for a firm: our legitimate interest in being able to show the agreement, and to meet legal obligations.
• To process client documents for a firm: on the firm's instructions, as its processor. The firm decides its own lawful basis.
• To email you occasional news about Vedas: your consent. We send marketing emails only to people who opted in, and anyone can stop at any time in Settings or with the unsubscribe link in any marketing email.

We do not sell personal data, and we do not use it for advertising.

Vedas uses AI models to read documents and draft work, such as sorting files, reading lines and figures, suggesting codes and wording questions. Code computes every figure. The firm's accountant reviews the work and signs it off. Read more in AI use.

No decision with a legal or similarly significant effect on anyone is made by automated means alone. The firm decides what to file and what to tell its clients.

Every request to an AI model is sent with zero data retention, and the model providers are told not to use the data for training. A check in our code refuses any request that does not meet both rules.

We use a small number of companies to host Vedas, run the AI models and send email. They act on our instructions. The Subprocessors page lists each one, what it does and where.

We also look up public facts at Companies House and GOV.UK. We send them only a company's name or a fixed guidance topic, never documents, amounts, dates or personal details.

We may share data where the law requires it, or to protect our rights, or with a buyer of our business under the same protections.

Documents and the database are stored in London. The app runs in the Netherlands, in the EU. The models that read documents run in the EU. The UK treats the EU as giving adequate protection.

Some requests pass outside the UK and EU: requests to the AI models pass through a routing service in the United States, which keeps nothing, and the model that sorts files at upload and the Help search are not limited to the EU. Where data leaves the UK and the EU, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or on the UK-US data bridge where the recipient is certified under it.

• Uploaded client documents: kept while the job is open. Once a job is marked final or cancelled, its documents are deleted after the firm's retention period: 7, 30 or 90 days, as the firm chooses. A job that finished but was never unlocked has its documents deleted 30 days after it finished. Pages read from scans and page images go with them.
• Outputs, such as working papers and packs, and the lines and answers behind them: kept while the firm's account is open, so the firm can go back to its work. A firm's documents and outputs are deleted after 60 days with no sign-in or use, after 14 days' notice to its Partners.
• Account data: while the account is open. When a firm closes its account, we delete its data as our Terms and DPA set out.
• Terms acceptance records: for as long as the firm's agreement lasts, and six years after it ends.
• Feedback and emails to us: as long as needed to deal with them.

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to have it moved to another service. Some rights depend on the lawful basis. Email us to use them. We reply within a month.

For a firm's client data, contact the firm, which decides what happens to it. If you contact us, we'll pass your request to the firm.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd like the chance to help first, so please contact us.

Vedas sets only cookies it needs to work: one that keeps you signed in, one that remembers your light or dark theme, and short-lived ones used during some sign-ins. We use no analytics, advertising or tracking cookies, so we ask for no consent.

The Feedback button opens a form from our feedback provider in a frame. That form is covered by the provider's own notice, and it opens only when you press the button.

How we protect data is set out on Security and data.

We update this notice when how we handle data changes. The version and date are at the top.