Privacy Policy

1. Who we are

ZyroBooks is operated by Supply Solutions, a business registered in Pakistan. For the personal data described below, Supply Solutions is responsible for protecting it. Contact: hello@zyrobooks.uk.

2. Our role: controller and processor

For your own account details (name, email, company, sign-in and usage data) we are the controller. For the business records you enter into ZyroBooks, such as customers, suppliers, employees, invoices and VAT records, you are the controller and we are your processor, acting only on your instructions under our Data Processing Agreement.

3. What personal data we process, why, and our lawful basis

• Account data (name, email, company, password stored as a secure hash): to create and run your account. Lawful basis: performance of a contract.
• Business records you enter (invoices, transactions, VAT records, and details of your customers, suppliers and employees): to provide the accounting service to you. Lawful basis: performance of a contract (you decide what to enter; you are the controller).
• Usage and security data (login times, IP address, features used, audit logs): to keep the service secure, prevent fraud and fix faults. Lawful basis: legitimate interests in running a secure service.
• Tax filing data (for example VAT submissions to HMRC and fraud-prevention headers HMRC requires): to submit what you ask us to submit. Lawful basis: performance of a contract and legal obligation.
• Optional AI features: only if you switch them on. Lawful basis: your consent, which you can withdraw by switching them off.
• Website analytics: privacy-friendly analytics without advertising cookies. Lawful basis: legitimate interests in understanding how the website is used.

4. How we use your data

Your data is used to provide and improve our accounting services. We do not sell your data. If you switch on the optional AI features, the relevant data is sent to the AI provider whose API key you enter (Google Gemini or Groq) to produce the answer. We never use your financial data to train AI models.

5. Storage, security and sharing

All data is encrypted in transit using TLS. API keys and other credentials are stored encrypted. Data is stored on secure cloud infrastructure with strict access controls. Our application servers are hosted with Vultr in Bangalore, India, so your data is stored and processed outside the UK. We share data only with the service providers listed on our sub-processors page, and with tax authorities when you ask us to file on your behalf. See also our security page. Where data leaves the UK or EEA, it is protected as described in our Data Processing Agreement.

6. Your rights

• Access your data and receive a copy
• Correct data that is wrong
• Ask us to delete your account and associated data (erasure)
• Export your data in standard formats (portability)
• Object to or restrict some processing, and withdraw consent where we rely on it

To use these rights, email hello@zyrobooks.uk. If you are not happy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk).

7. Data retention

Data is retained while your account is active. After you ask us to delete your account, your data is removed within 30 days. Backups are overwritten on their normal cycle.

8. Cookies

The app uses essential cookies for sign-in only, with no advertising cookies. This website loads Google Fonts and an optional Google Translate widget, which may set their own cookies, and uses Cloudflare Web Analytics, which does not use cookies.

9. Data breaches

If a breach affects personal data, we follow a written procedure: we contain it, assess the risk, notify the regulator within 72 hours where required, and tell affected people without undue delay when the risk to them is high.

10. Changes and contact

We will update this page when our practices change. Privacy questions: hello@zyrobooks.uk