Privacy Policy

1. Who we are

ZyroBooks is operated by Supply Solutions, a business registered in Pakistan. For the personal data described below, Supply Solutions is responsible for protecting it. Contact: hello@zyrobooks.uk.

2. Our role: controller and processor

For your own account details (name, email, company, sign-in and usage data) we are the controller. For the business records you enter into ZyroBooks, such as customers, suppliers, employees, invoices and VAT records, you are the controller and we are your processor, acting only on your instructions under our Data Processing Agreement.

3. What personal data we process, why, and our lawful basis

• Account data (name, email, company, password stored as a secure hash): to create and run your account. Lawful basis: performance of a contract.
• Business records you enter (invoices, transactions, VAT records, and details of your customers, suppliers and employees): to provide the accounting service to you. Lawful basis: performance of a contract (you decide what to enter; you are the controller).
• Usage and security data (login times, IP address, features used, audit logs): to keep the service secure, prevent fraud and fix faults. Lawful basis: legitimate interests in running a secure service.
• Tax filing data (for example VAT submissions to HMRC and fraud-prevention headers HMRC requires): to submit what you ask us to submit. Lawful basis: performance of a contract and legal obligation.
• Optional AI features: only if you switch them on. Lawful basis: your consent, which you can withdraw by switching them off.
• Website analytics: Cloudflare Web Analytics, which does not use cookies (lawful basis: legitimate interests in understanding how the website is used), and Google Analytics 4 from Google LLC (lawful basis: your consent in the United Kingdom, the European Economic Area and Switzerland, and legitimate interests in other countries, where you can turn it off at any time with the Cookie settings button).

4. How we use your data

Your data is used to provide and improve our accounting services. We do not sell your data. If you switch on the optional AI features, the relevant data is sent to the AI provider whose API key you enter (Google Gemini or Groq) to produce the answer. We never use your financial data to train AI models.

5. Storage, security and sharing

All data is encrypted in transit using TLS. API keys and other credentials are stored encrypted. Data is stored on secure cloud infrastructure with strict access controls. Our application servers are hosted with Vultr in Bangalore, India, so your data is stored and processed outside the UK. We share data only with the service providers listed on our sub-processors page, and with tax authorities when you ask us to file on your behalf. See also our security page. Where data leaves the UK or EEA, it is protected as described in our Data Processing Agreement.

6. Your rights

• Access your data and receive a copy
• Correct data that is wrong
• Ask us to delete your account and associated data (erasure)
• Export your data in standard formats (portability)
• Object to or restrict some processing, and withdraw consent where we rely on it

To use these rights, email hello@zyrobooks.uk. If you are not happy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk).

7. Data retention

Data is retained while your account is active. After you ask us to delete your account, your data is removed within 30 days. Backups are overwritten on their normal cycle.

8. Cookies

The app uses essential cookies for sign-in only, with no advertising cookies. This website loads Google Fonts and an optional Google Translate widget, which may set their own cookies, and uses Cloudflare Web Analytics, which does not use cookies. Google Analytics 4 sets cookies (such as _ga and _ga_WH13F1T5TN) to measure website visits and which pages lead to sign-ups. If you are in the United Kingdom, the European Economic Area or Switzerland, or we cannot tell where you are, Google Analytics is loaded only after you click Accept analytics on our cookie banner. In other countries it is on by default, and we show a notice with a button to turn it off. In every country you can change your choice at any time with the Cookie settings button at the bottom left of any page of this website, and if you turn it off, Google Analytics is not loaded and its cookies are deleted. The registration and login pages of the app (app.zyrobooks.uk) follow the same rule and, if analytics is on, send Google Analytics only the fact that a new account was created, with no name, email, company details or page address from inside the app.

9. Data breaches

If a breach affects personal data, we follow a written procedure: we contain it, assess the risk, notify the regulator within 72 hours where required, and tell affected people without undue delay when the risk to them is high.

10. Changes and contact

We will update this page when our practices change. Privacy questions: hello@zyrobooks.uk