Privacy policy

1. Who is responsible

Ant vs Bear Ltd ("we") is responsible for protecting the personal data described here. There are two roles:

• Controller for your account: your mobile number, sign-in activity, the businesses you connect, the decisions and approvals you make in the app, and your messages to us.
• Processor for the content of your books that we read from QuickBooks or Xero (and, once available, from your bank): transactions, supplier and customer names, invoices and bills. You decide why that data is used; we use it only to provide HatchSolo to you, under our data processing agreement. If it contains personal data about other people, such as a supplier who is a sole trader, you are the controller of it.

We have no data protection officer. Questions go to the contact address at the top of this policy.

2. What personal data we process, and why

For the content of your books (QuickBooks or Xero, and once available your bank account) we are a processor, so the legal basis for that processing is yours as controller. We do not use it for any purpose of our own.

We do not use advertising, analytics or tracking scripts or pixels on HatchSolo, and we do not use your data for marketing. We do not use your books to train AI models. If we ever add any of these, we will update this page and ask for your consent first where the law requires it.

3. HMRC sign-in and fraud prevention data

When you send a return to HMRC you sign in on HMRC's own page with your own Government Gateway account. We never see or store your Government Gateway user ID or password. HMRC gives us a temporary access token, which we keep only in an encrypted cookie in your browser for up to 30 minutes. We discard the refresh token as soon as we receive it, so we cannot act for you at HMRC later. Each submission needs a fresh sign-in and a declaration from you.

HMRC requires software that sends returns to include details about the device and connection in each request: your browser type and version, screen size and colour depth, window size, time zone, an identifier for your browser, your IP address and when it was seen, and a user identifier. We send them to HMRC with the request and do not keep a copy.

4. Who we share it with

We do not sell your data, rent it, or share it for anyone's marketing. We share it only with:

• HMRC, to make a submission you have approved.
• Intuit (QuickBooks) or Xero, to read your books after you connect them. Your bank and our open banking provider will be added here before bank connection is available.
• Our providers, who process data for us only to run HatchSolo (the table of providers).
• Anyone the law requires us to tell, or to protect our rights.

Each provider is bound by a written data processing agreement. We will list any new provider here before we start using it.

5. Moving data outside the UK

Your database and application functions are in London. Some data reaches providers outside the UK: your mobile number goes to Twilio in the United States to send a sign-in code, an email address you add goes to Resend in the United States to send a reminder, and our delivery network and bot check are global.

Each provider's published data processing terms include a UK transfer safeguard: Twilio's includes the UK International Data Transfer Agreement; Cloudflare's includes the UK Addendum and the UK-US data bridge; Vercel's includes the UK international data transfer addendum; Supabase's includes the UK Addendum; Resend's includes the UK Addendum to the standard contractual clauses and the UK extension to the EU-US Data Privacy Framework. We rely on those safeguards.

6. How long we keep it

7. Deleting your data

Email the contact address at any time. We will acknowledge within 5 working days and, within 30 days, delete or anonymise everything we are not legally required to keep, then confirm in writing what we deleted and what we kept and why. You can disconnect QuickBooks or Xero inside the app at any time. In Settings you can download everything we hold about your business with one click (your decisions, approvals, figures, receipts, transactions and filing history) as a JSON file, and your transactions as a CSV file; the file and the HMRC receipt for each return can also be downloaded where it appears. If you would rather we prepare the export, or you need something else, email the contact address; we will send it within 30 days and normally much sooner.

8. How we protect it

Data is encrypted in transit and at rest. Your VAT number and your connection tokens are encrypted before they are stored. Records of what was filed cannot be edited or deleted in place. Access to production systems is limited to what is needed to run the service. HMRC credentials are never stored (section 3).

If personal data is ever put at risk we will tell you without undue delay where the risk to you is high, and tell the Information Commissioner's Office and HMRC within 72 hours of becoming aware where required. You can report a security problem to the contact address or through our security.txt.

9. Cookies

We use only cookies the service needs to work. We do not use advertising or analytics cookies, so there is no cookie banner.

10. Your rights

Under UK GDPR you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests you can object, and we will stop unless we have a compelling reason that overrides your interests. For the content of your books, where we are a processor, we will help you answer a request from the person it concerns. Email the contact address.

11. Complaints and changes

Tell us first at the contact address and we will try to put it right. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We will tell you by email or in the app before a material change to this policy takes effect.

QuickBooks and Intuit are trademarks of Intuit Inc. HatchSolo is not endorsed by or affiliated with Intuit or HMRC.