Legal
Last updated: November 5, 2026
FreelanceOS ("we", "our", "the app") is operated by Maple House Films Ltd, a company registered in England and Wales (company no. 11257651), whose registered office is 167–169 Great Portland Street, 5th Floor, London W1W 5PF. Maple House Films Ltd is the data controller for your information. This policy explains what we collect, why, and your rights under UK GDPR.
We collect the following information:
Core account records are synced to our secure cloud backend (Supabase) across supported devices. On iPhone, tax review decisions, business-use splits, expense categories and invoice-to-transaction links are currently stored on that device; they do not yet sync with the imported bank transactions. Export completed tax records as PDF and CSV and keep a backup before deleting the app or changing devices. Sensitive credentials are kept in protected device storage or encrypted server-side storage rather than ordinary app content. Google OAuth tokens, where connections are available, are encrypted before storage. We never store your Google, bank or HMRC password.
Flo is powered by OpenAI. On iPhone, we ask for permission before the first AI request. If you allow it, your messages and relevant business context are sent through our Supabase server function to OpenAI to provide the response you requested. Context can include client and invoice details, tasks, notes, selected document excerpts and reviewed tax figures. You can decline and keep using other tools, or withdraw permission using Flo permission in Settings. Withdrawing stops future AI requests; it does not recall information already sent. Direct Gmail, Google Calendar and Drive connections are paused in the current iPhone release. Where optional Google connections are available, only relevant event details, bounded message snippets or the content of a file you explicitly select are included. FreelanceOS does not sell Google user data, use it for advertising, or use it to train a general-purpose AI model.
These connections are optional and read-only in FreelanceOS. Calendar reads upcoming events from your primary calendar when schedule context is relevant. Gmail reads a bounded set of recent Inbox messages when you ask Flo to identify client requests; no task is created until you review and accept it. Drive uses Google's Picker so you can grant access to specific Google Docs or Sheets; FreelanceOS does not index your whole Drive and fetches bounded file content only after you explicitly ask Flo to use one selected file.
FreelanceOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
See the FreelanceOS Help Centre for connection, disconnection and account-deletion instructions, including how to review FreelanceOS access in your Google Account.
Direct HMRC submission is not currently available. If it is enabled later and you choose to connect it, you will authorise FreelanceOS through Government Gateway before any submission and will be able to disconnect in the app.
Direct bank connections are not yet available. Uploaded bank-statement account information and transaction rows are stored in your FreelanceOS account to prepare and reconcile your records. Review decisions and links currently remain on the iPhone where you make them. You can remove an imported bank account and its imported transactions using the tax screen's account management control. Optional bank details you save for invoices are also stored with your account. Card payments are handled by Stripe or Apple; we do not receive your full card number. If open banking is offered later, it will require your explicit consent.
We collect account-linked product events, such as app opens and key feature actions, to understand which parts of FreelanceOS are useful. Apple Ads attribution may associate campaign, ad-group, keyword and ad identifiers with your account to measure which campaigns lead to app use. We do not retain the short-lived Apple attribution token, use IDFA, or sell these records. Native crash reports and technical diagnostics, including hangs, launch performance, CPU and disk activity, may be sent with your account identifier to help us investigate faults. These records are separate from the business context you choose to send to Flo. You can contact privacy@freelanceos.so to access or object to this processing.
Creating a FreelanceOS account doesn't automatically add you to marketing. If you request an MTD reminder and actively tick the consent box, we use your email address to send the requested checklist, start-date reminders and FreelanceOS marketing. We send no more than one FreelanceOS marketing email in any seven-day period. Kit manages delivery and email activity for us. You can withdraw consent through the unsubscribe link in every marketing email or by contacting privacy@freelanceos.so. We keep limited consent and suppression evidence where needed to prove and honour your choice.
We work with the following third parties to operate FreelanceOS. We do not sell personal data or allow providers to use it for their own marketing. Kit may process email data outside the UK under the safeguards in its Data Processing Addendum.
We rely on performing our contract with you (running the app), your consent (optional features, Google connections and marketing emails), legitimate interests (service reliability and proportionate product and campaign measurement), and legal obligation (HMRC fraud-prevention data). You can withdraw an optional connection or marketing consent without affecting processing that occurred before withdrawal.
We keep account data while your account is active and delete it on account deletion or request, except where the law requires otherwise. Google connection credentials are retained until you disconnect a Google service or delete your account; disconnecting one Google service disconnects all Google services and removes their stored credentials. Google data fetched for a relevant request is not intentionally retained as a separate connector record. We review marketing profiles after 24 months without engagement and delete data that is no longer needed, while retaining only the limited consent or suppression evidence required to honour your choice.
You have the right to access, correction, deletion, portability, and objection. For any data-protection request, contact privacy@freelanceos.so. You can also complain to the ICO (ico.org.uk).
Data is encrypted in transit; API secrets stay server-side; and sensitive credentials are kept in protected device storage or encrypted server-side storage. Found a security issue or vulnerability? Email security@freelanceos.so and we will respond within 24 hours.
FreelanceOS is a business tool not intended for under-18s.
We'll post updates here and change the date above.
If you have questions about this privacy policy, contact us at hello@freelanceos.so