Unfiled_

    Privacy Policy

    Last updated: 20 October 2026

    This Privacy Policy explains how Raemedy Limited (“we”, “us”, “our”) collects, uses, stores and protects personal data when you use Unfiled (the “Service”). Raemedy Limited is registered in England and Wales under company number 10285645, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

    We are the data controller for personal data processed through the Service. That means we decide what data is collected, why it is collected and how it is protected. Where you use Unfiled to prepare records on behalf of a company or property business, you remain responsible for the accuracy and lawfulness of the information you enter about other people (for example directors, tenants or suppliers).

    Raemedy Limited is registered with the UK Information Commissioner’s Office (ICO) under data protection registration number ZC262305.

    We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). This policy should be read alongside our Cookie Policy and Terms of Service.

    For any privacy request, email support@unfiled.co.uk.

    1. Data we collect

    We collect only what we need to run the Service, prepare your figures accurately and meet our own legal obligations. The categories below describe everything we hold.

    1.1 Identity and account data

    • Email address, and a name where you choose to provide one.
    • Authentication identifiers, password hashes (we never see or store your password in readable form), email-confirmation state and session records.
    • Account preferences such as notification settings, category mappings, assistant settings and your currently selected business profile.
    • Role information used to control access to administrative functions.

    Where offered, you can choose to sign in with Google or Apple. The provider shares an account identifier and the identity information you authorise, such as your email address, name and profile picture. Apple may provide a private relay email address. We use this to authenticate you and connect your sign-in methods. We do not receive your Google or Apple password, and do not send your tax records or documents to them as part of sign-in. Each provider also processes your sign-in under its own privacy policy.

    We record the terms version and time when you complete social-account setup. Optional analytics and advertising remain subject to your separate cookie choices.

    1.2 Business, accounting and tax data

    • Profile information for each business you add: business type (sole trader, landlord or limited company), trading name, company registration number, registered office address, incorporation date and financial year end.
    • Bank transactions, statements and supporting documents you upload or import, including CSV, Excel, PDF and OFX files, along with descriptions, amounts, dates and any notes you add.
    • Categorisation decisions and rules, including patterns learned from how you have previously categorised similar transactions.
    • Prepared figures and documents: profit and loss statements, balance sheets, directors’ reports, tax computations, filing packs, draft and submitted returns, and confirmation references returned by HMRC or Companies House.
    • Filing declarations and audit records, including who approved a filing, when it was approved and the exact version of the documents that were approved.

    1.3 Government gateway and filing credentials

    • HMRC connection details, including OAuth access and refresh tokens issued when you connect your Making Tax Digital account. These are encrypted before storage.
    • Companies House authentication details where you choose to store them. These are encrypted before storage.
    • Government Gateway credentials supplied for a single Corporation Tax submission are used only for that transmission and are not written to our application database.

    1.4 Payment data

    • Where a filing fee applies, payment is taken by our payment processor. We receive confirmation that a payment succeeded, the amount, currency and a reference. We never receive or store your full card number, expiry date or security code.

    1.5 Technical data

    • IP address, browser type, operating system, device information and log data.
    • Security and audit logs recording sign-ins, failed sign-in attempts, permission checks and administrative actions.
    • Usage analytics (pages viewed, features used) via Google Analytics, only where you have consented to analytics cookies. With additional advertising consent, we send completed registrations (without identity details) and confirmed service purchases (random transaction reference, service price, currency and product name) to Google Analytics and our linked Google Ads account. We exclude customer identity, company details and tax-return data. See our Cookie Policy for how to manage this.
    • Advertising measurement data (landing and sign-up page views, and completed-registration events) via the Meta Pixel, only where you have consented to advertising cookies. We do not send Meta names, email addresses, account identifiers, tax or financial data, or form contents.

    1.6 Communications and assistant data

    • Messages you send us via support, help or feedback channels.
    • Questions you post in the public Questions section, together with any moderation decisions recorded against them.
    • Conversations with our in-app assistant. Your own financial records are only made available to the assistant if you explicitly switch that option on, and you can switch it off again at any time.

    1.7 Pilot applications and promotions

    • Pilot eligibility answers, accounting-period dates, offer source and limited UTM campaign fields. We do not store advertising click identifiers in the application record.
    • Promotion grants, revocations and customer acknowledgements, including the company, accounting period, terms version, operator and timestamps needed for an audit trail.

    2. How we use your data and our lawful basis

    Under UK GDPR we must have a lawful basis for every use of personal data. The table below sets out what we do and why we are permitted to do it.

    • Provide the Service (performance of a contract): operating your account, storing and processing your records, importing and categorising transactions, calculating tax, preparing accounts and filings, and transmitting submissions to HMRC or Companies House on your instruction.
    • Take payment (performance of a contract): processing filing fees and recording that an entitlement to file has been granted.
    • Assess pilot applications and administer limited promotions (steps taken at your request before entering a contract, and legitimate interests): reviewing eligibility, preventing duplicate grants and preserving an auditable fee-waiver record.
    • Security, integrity and fraud prevention (legitimate interests): protecting the Service and its users, detecting abuse or unauthorised access, maintaining audit logs and verifying that a filing was authorised by the right person.
    • Improve the Service (legitimate interests): diagnosing faults, monitoring performance, improving categorisation accuracy and understanding aggregate product usage.
    • Service communications (performance of a contract): account, billing, filing, deadline and security notices that you cannot opt out of while you hold an account.
    • Marketing communications (consent): only where you have opted in. You can withdraw consent at any time without affecting the Service.
    • Analytics and advertising measurement (consent): understanding how the site is used, and whether advertising leads to registrations and purchases. You can withdraw consent at any time using the Manage cookies control in our Cookie Policy.
    • Legal and regulatory compliance (legal obligation): meeting our own tax, accounting, record-keeping and regulatory duties, and responding to lawful requests from authorities.
    • Establishing or defending legal claims (legitimate interests): retaining evidence of what was submitted, by whom and when.

    We do not carry out automated decision-making that produces legal effects concerning you. Suggested transaction categories are recommendations only; you remain in control and can change any figure before it is used.

    3. Sharing your data

    We do not sell your personal data, and we do not share it for third-party advertising profiling. We share data only where it is necessary to deliver the Service, where the law requires it, or where you have instructed us to do so, for example by submitting a return to HMRC.

    3.1 Sub-processors

    The following providers process data on our behalf, under written data-processing terms that require them to keep your data secure and use it only on our instructions.

    • Supabase (Supabase Pte. Ltd.) — database, authentication, file storage and server-side functions. Your Unfiled database, uploaded documents and generated filing artefacts are hosted in the United Kingdom (London region), so your primary financial records stay within the UK.
    • OpenAI (OpenAI OpCo, LLC) — the in-app assistant and categorisation help. Content sent to OpenAI is not used to train their models under the OpenAI API terms. The assistant only accesses your personal financial data when you explicitly opt in, and only for the business profile you are working in.
    • HMRC — tax submissions, obligation checks and queries made on your instruction, using your own credentials or authorisations.
    • Companies House — company lookups and, where applicable, filings made on your instruction.
    • Stripe (Stripe Payments Europe, Limited and Stripe Payments UK Ltd) — secure card payment and checkout for filing fees. Card details are handled directly by Stripe under the PCI DSS standard and never pass through Unfiled.
    • Netlify (Netlify, Inc.) — hosting and content delivery, serving the Unfiled website and application to your browser.
    • Resend (Plus Five Five, Inc.) — delivery of transactional, account, deadline and security emails.
    • Google (Google Ireland Limited) — consent-based analytics and purchase measurement through Google Analytics and Google Ads.
    • Meta (Meta Platforms Ireland Limited) — advertising measurement on the landing and sign-up pages, only after advertising consent. Meta may process device and browser information under its own privacy terms.

    3.2 Other disclosures

    • Professional advisers — our accountants, auditors, insurers and lawyers, where necessary and under a duty of confidentiality.
    • Authorities — where we are legally required to disclose information, for example under a court order or a lawful regulatory request.
    • Business transfer — if the Service is reorganised, merged or acquired, your data may transfer to the receiving entity, which will remain bound by this policy or an equivalent one. We will tell you before this happens.

    We will update the sub-processor list when our providers change. Material changes are highlighted via the “last updated” date at the top of this page.

    4. International transfers

    Your core account, financial records and uploaded documents are stored in the United Kingdom. Some supporting providers, including OpenAI, Stripe, Netlify, Resend and our analytics and advertising measurement providers, may process limited data outside the UK or European Economic Area.

    Where data is transferred outside the UK, we rely on appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with additional technical measures such as encryption in transit and data minimisation.

    5. Retention

    We keep personal data only for as long as we need it for the purpose it was collected, or for as long as the law requires.

    • Account data — retained while your account is active and for up to 12 months after closure, except where longer retention is required by law.
    • Tax and filing records — retained for at least 6 years from the end of the relevant accounting period or tax year, to align with HMRC and Companies House record-keeping requirements.
    • Filing declarations and submission audit records — retained for the same statutory period, because they evidence what was filed, by whom and when. These records are immutable and are not deleted on request where retention is required by law.
    • Payment records — retained for 6 years to meet our own tax and accounting obligations.
    • Support messages — retained for up to 24 months after the request is closed.
    • Backups and technical logs — typically purged within 90 days of being superseded.

    When a retention period ends, data is deleted or irreversibly anonymised so it can no longer be linked to you.

    6. Security

    We take the protection of financial data seriously and apply technical and organisational measures appropriate to its sensitivity, including:

    • Encryption in transit using TLS for all connections to the Service.
    • Encryption at rest for storage, with additional application-level encryption for sensitive credentials such as HMRC and Companies House tokens.
    • Row-level security in the database, so every record is restricted to the owning user and the specific business profile it belongs to.
    • Role-based access controls and the principle of least privilege for internal access, with administrative roles held separately from ordinary accounts.
    • Audit logging of sign-ins, permission checks, filing approvals and administrative actions.
    • Server-side validation of every filing, with checksums binding an approval to the exact documents that were approved.
    • Regular dependency and security reviews of the application.

    No system is perfectly secure. If you suspect a vulnerability or unauthorised access, please email support@unfiled.co.uk promptly. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell you without undue delay where the risk is high.

    7. Your rights

    Under UK GDPR you have the right to:

    • Be informed about how your data is used — which is the purpose of this policy.
    • Access the personal data we hold about you, and receive a copy.
    • Rectify inaccurate or incomplete data.
    • Erase data, subject to legal retention obligations. Statutory filing and declaration records cannot be erased while we are required to keep them.
    • Restrict processing while a concern is investigated.
    • Object to processing based on legitimate interests, and to direct marketing at any time.
    • Data portability — receive your data in a structured, commonly used, machine-readable format. You can also export your transactions and documents directly from the Service at any time.
    • Withdraw consent at any time where processing is based on consent, without affecting processing carried out beforehand.
    • Complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

    To exercise any of these rights, email support@unfiled.co.uk. We respond within two weeks. If a request is complex we may extend this by a further two months and will tell you why. We may ask you to verify your identity before we release information. There is no charge unless a request is manifestly unfounded or excessive.

    You can also delete your account yourself from your account settings. Deletion removes your account and business records except where we must keep specific filing evidence for the statutory period described above.

    CT600 draft reminders

    We use saved-draft activity to send at most one reminder per filing period after five days without meaningful work. No separate draft-reminder opt-in is required. The CT600 draft reminders setting is on by default. Turn it off in Settings, or use the email footer, to stop these reminders. Historical reminder preference records are retained under our retention policy.

    8. Cookies and similar technologies

    We use strictly necessary browser storage to keep you signed in and to remember your settings, and optional analytics and advertising measurement cookies only where you consent. Full details, including how to withdraw consent, are in our Cookie Policy.

    9. Children

    The Service is intended for business use and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

    10. Changes

    We may update this Privacy Policy from time to time to reflect changes to the Service, our providers, or the law. The “last updated” date at the top reflects the latest version. Where changes are material, we will tell you by email or by an in-app notice before they take effect.

    11. Contact

    Raemedy Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Registered in England and Wales, company number 10285645. ICO registration number: ZC262305. Email: support@unfiled.co.uk.

    If you are not satisfied with our response to a privacy concern, you may complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or through ico.org.uk.

    Optional feedback and usage measurement

    When you remove a company or stop preparing a return, you can choose a reason. This is optional and anonymous, with no free text or financial details. We keep a pause/stop status for up to 90 days, or until the company is removed.

    With your analytics consent, we record which pages and actions you use, and link the visit to your account when you sign in. We never record form contents, tax figures, passwords or documents. Records are stored in the UK and deleted within 90 days, or when you delete your account. You can withdraw consent at any time under Manage cookies in our Cookie Policy.