Privacy Policy

Information We Collect

We collect the following information:

• Account. Your name and the email/identity from Sign in with Apple or Google.
• Content you create. Tasks, invoices, expenses, documents, projects, notes, clients (incl. their names, emails, phone numbers).
• Financial data. Income, expenses and invoice data you record.
• Chat with Flo. Your messages and relevant context (e.g. task/invoice/client names).
• When HMRC submission becomes available and you choose to connect it. Your National Insurance number, business details, and the income/expense figures you choose to submit.
• When you connect a bank. Your account details, balances and transactions, accessed read-only.
• Marketing email. If you actively opt in, Kit receives your email address and reminder group. We retain limited consent evidence, including the time, notice version, form and bounded campaign labels. We do not send Kit your qualifying-income amount or tax-return figures.
• Account service email. When you create an account, Resend receives the account email address so we can deliver the one-off founder welcome. This does not subscribe you to marketing.
• Bot protection. When you use an account or email-capture form, Cloudflare Turnstile processes technical signals to distinguish a person from automated abuse. We do not store its short-lived challenge token or a raw IP address in our marketing-consent records.
• Fraud-prevention data (HMRC requirement). If HMRC submission is enabled, HMRC requires anti-fraud data with each submission: a device identifier, your local and public IP addresses, device and operating-system details, screen size, timezone, and MAC address. This is sent to HMRC and used only for that purpose.

How We Store It

Your data is synced to and stored on our secure cloud backend (Supabase) so it's available across your devices. Sensitive credentials (HMRC and bank access tokens) are held in your device's encrypted Keychain and on our server only as needed; we never store your bank login or HMRC password.

Connecting to HMRC

Direct HMRC submission is not currently available. If it is enabled later and you choose to connect it, you will authorise FreelanceOS through Government Gateway before any submission and will be able to disconnect in the app.

Bank Data

Direct bank connections are not yet available. Bank statements you choose to upload are used only to reconcile your transactions into your own records. When open banking connections are offered, they will be read-only, provided through an FCA-regulated provider with your explicit consent, which you can withdraw at any time.

Marketing Emails

Creating a FreelanceOS account doesn't automatically add you to marketing. If you request an MTD reminder and actively tick the consent box, we use your email address to send the requested checklist, start-date reminders and FreelanceOS marketing. We send no more than one FreelanceOS marketing email in any seven-day period. Kit manages delivery and email activity for us. You can withdraw consent through the unsubscribe link in every marketing email or by contacting privacy@freelanceos.so. We keep limited consent and suppression evidence where needed to prove and honour your choice.

Third Parties We Use

We work with the following third parties to operate FreelanceOS. We do not sell personal data or allow providers to use it for their own marketing. Kit may process email data outside the UK under the safeguards in its Data Processing Addendum.

• HMRC
• Supabase (hosting/storage)
• OpenAI (Flo AI)
• Apple and Google (sign-in)
• Stripe (payments)
• Kit (consent-based email delivery and list management)
• Resend (transactional account email delivery)
• Cloudflare Turnstile (bot and form-abuse protection)

Legal Bases (UK GDPR)

We rely on performing our contract with you (running the app), your consent (optional features and marketing emails), and legal obligation (HMRC fraud-prevention data). You can withdraw marketing consent without affecting processing that occurred before withdrawal.

Retention

We keep account data while your account is active and delete it on account deletion or request, except where the law requires otherwise. We review marketing profiles after 24 months without engagement and delete data that is no longer needed, while retaining only the limited consent or suppression evidence required to honour your choice.

Your Rights

You have the right to access, correction, deletion, portability, and objection. For any data-protection request, contact privacy@freelanceos.so. You can also complain to the ICO (ico.org.uk).

Security

Data is encrypted in transit; API secrets stay server-side; access tokens are stored in your device Keychain. Found a security issue or vulnerability? Email security@freelanceos.so and we will respond within 24 hours.

Children

FreelanceOS is a business tool not intended for under-18s.

Changes

We'll post updates here and change the date above.

Contact Us

If you have questions about this privacy policy, contact us at hello@freelanceos.so