Privacy policy

Version 1.0 · 17 October 2026

Ledgr Hub (ledgrhub.co.uk and the Ledgr Hub apps) is provided by ANNMAR LIMITED, company number 16014219, registered office 111 Bedford Way, Scunthorpe, DN15 8GF ("we", "us"). Contact: our support page (topic “Data protection request”) or info@annmarlimited.co.uk.

Who is responsible for which data

Accountancy practices decide why and how their clients' bookkeeping records are processed. For those records (bank transactions, receipts, mileage, invoices, messages) the practice is the data controller and we act as its data processor under the data processing terms in our Terms. If you are a client of a practice, please contact your accountant first about your records.

We are the controller for account data we need to run the service: your name, e-mail address, sign-in records, practice billing details and support conversations.

What we collect

• Account details: name, e-mail address, and — if you choose Google sign-in — the basic profile Google shares (name, e-mail, account ID).
• Business records you or your accountant add: bank statement files and transactions, receipt and invoice images, mileage trips, sales invoices, notes and messages.
• Technical data: sign-in sessions (a secure cookie), IP address in server logs for security, and the audit log of actions taken in each business.

We do not connect to anyone's bank account and we never ask for bank passwords.

How we use it

• To provide the service: storing records, reading receipts and statements automatically, matching receipts to payments, calculating mileage allowances and deadlines, producing exports (contract / processor instructions).
• To keep the service secure and prevent abuse (legitimate interests).
• To send service e-mails such as sign-in codes and invitations (contract). We do not send marketing without consent.

Automatic reading of receipts and statements is done by an AI model running on Cloudflare Workers AI. It only extracts the details shown on the document; it does not make decisions about anyone. Your documents are not used to train models.

Who we share it with

Only the sub-processors needed to run Ledgr Hub: Cloudflare (hosting, database, file storage, Workers AI), Resend (e-mail delivery), Google and Apple (only if you use their sign-in), Apple Push Notification service (reminders on iPhone) and, once card payments are switched on, Stripe (payments). Some providers may process data outside the UK under UK-approved safeguards. Within Ledgr Hub, a business's records are visible only to that business's invited users and to the practice it belongs to.

How long we keep it

Business records are kept for as long as the practice account exists. HMRC expects limited companies to keep records for at least 6 years and sole traders for at least 5 years after the 31 January filing deadline, so we never delete records automatically because a payment failed. A practice owner can download everything and schedule deletion; deletion happens after a 30-day cooling-off period. Sign-in codes expire after 15 minutes and sessions after 60 days.

Your rights

You can ask for access to, correction of, or deletion of your personal data, object to or restrict processing, and ask for a copy in a portable format (every business can also download all its data from its settings page). Where we process data for an accountant, we will pass your request to them. You can complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is encrypted in transit (HTTPS) and at rest. Access is checked on every request, files are served only to signed-in users with access, and every change is written to an audit log that cannot be edited.

Changes

We will post updates here and tell practice owners by e-mail about important changes.