Privacy Policy
1. Who we are
Rooby (“we”, “us”, “our”) of 51–59 Rose Lane, Norwich, NR1 1BY is the data controller for personal data processed through this service. To contact us about data privacy: hello@rooby.co.uk.
2. What data we collect
We collect and process the following categories of data:
- Account data: your name, company name, email address, and login credentials (passwords are hashed; we do not store them in plain text).
- Accounting data: read from the Xero or QuickBooks Online account you connect, through that platform’s API: reports (profit & loss, balance sheet, trial balance), sales invoices, bills, expenses and payments (including the names of the customers and suppliers on them), VAT and tax settings, and organisation details.
- Usage data: log data including IP addresses, browser type, pages visited, and timestamps, collected automatically when you use Rooby.
We do not collect payment card details. We do not sell your data to third parties.
3. How we use your data
We use your data to:
- Provide the Rooby service, calculate and display tax deadlines and estimates
- Maintain the security and integrity of the platform
- Comply with legal obligations
4. Legal basis for processing
Under UK GDPR, we rely on the following legal bases:
- Contract: processing necessary to provide the Rooby service to you.
- Legitimate interests: security monitoring, fraud prevention, and service improvement.
5. Data storage and security
Your data is stored in London, UK infrastructure, and all client financial data stays in the UK: it is stored and processed in London and never transferred abroad. We use industry-standard encryption in transit (TLS 1.3) and at rest (AES-256). Xero and QuickBooks access tokens are additionally encrypted in Supabase Vault, using a key held outside the database, so they are never stored in readable form alongside the data they protect. Rooby’s access to your accounting software is read-only: it never creates, changes or deletes anything there. When you disconnect, or delete a client or your account, Rooby revokes its access with Xero or Intuit and deletes the stored tokens.
We keep your data while your account is active. When an account is closed, its data, including all client financial data, is deleted within 30 days. Billing records (invoices and payments) are held by Stripe and kept for 6 years, as UK tax law requires. We also keep a record that the account was deleted, and your email address on our do-not-email list, so we can show the deletion happened and never send you marketing again.
6. Third parties
We share data with the following sub-processors to operate the service:
- Supabase, database, authentication, and file storage (London, UK)
- Vercel, application hosting and serverless processing (London, UK)
- Stripe UK Ltd, payment processing (handles billing data only; no client financial data is shared)
- Brevo, transactional email, account notifications and alerts (France, EU, covered by UK GDPR adequacy)
- Xero, source of client financial data via OAuth read access, processed under Xero’s own data processing terms
- Intuit (QuickBooks Online), source of client financial data via OAuth read access, processed under Intuit’s own data processing terms
- Companies House, UK public company register (director and company data lookup)
We do not sell your data or share it with any other third parties for marketing or advertising purposes.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data (subject to legal retention requirements)
- Object to processing or request restriction
- Data portability
- Withdraw consent for marketing at any time
To exercise any of these rights, email hello@rooby.co.uk. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
8. Cookies and storage on your device
The rules here (PECR regulation 6) cover anything stored on or read from your device, not only cookies, so this section covers both. We have deliberately kept this to the point where no consent banner is required.
This website (rooby.co.uk)
We set no cookies at all on this website, and store nothing in your browser’s local storage either.
Fonts and every script on this site are served from our own domain rather than a font CDN or other third party, so simply reading this site sends your IP address to no one but us and our hosting provider. Links to book a demo or to sign up take you to another site only when you click them.
Analytics
We use Vercel Web Analytics to count page views and see which pages are read. It is cookieless and stores nothing on your device. It does process your IP address and browser type to distinguish one visit from another, which we do on the basis of our legitimate interest in understanding whether the site works. We do not use it to build a profile of you, we do not combine it with anything else, and we do not share it with advertisers. If you object to this, our contact details are in section 1.
We also record which buttons are clicked and how far down a page people scroll, for the same purpose. These events record the control and the section it sits in, never who you are.
The application (app.rooby.co.uk)
Once you sign in, the application sets strictly necessary cookies to keep you signed in and to secure your session. These are required for the service to function and cannot be switched off while you are logged in. We use no tracking or advertising cookies anywhere.
9. Changes to this policy
We may update this policy periodically. The “last updated” date above will reflect any changes. Material changes will be communicated by email.