Privacy notice

This notice explains how Atlas Vision Innovations Ltd ("Tick & Bash", "we") uses personal data. We are registered in England and Wales, company no. 15138954, registered office 71-75 Shelton Street, London WC2H 9JQ. For anything about your data, email hello@tickandbash.com.

1. Our two roles

• We are the controller for the details of accounting practice staff who use the app, people who contact us or book a call, and practice owners we email about the pilot.
• We are a processor for the bank statements and client records a practice uploads. The practice is the controller. We use that data only to provide the service to the practice, under a written data processing agreement. If you are a client of a practice, please contact your accountant first. We will help them answer you.

2. What we collect

• Accounts: name, work email, practice name, role, password (stored only as a salted hash) and sign-in records.
• Client records uploaded by a practice: bank statement lines (date, description, amount, balance), statement files, the category proposed for each line, who approved it, and notes. Bank descriptions can name other people, such as customers and payees.
• Calls and messages: your name, email, practice and anything you tell us, including booking details from Calendly.
• Outreach: the name, work email and practice of accounting practice owners, and the public post about Making Tax Digital that led us to write to them.
• Technical: IP addresses and server logs, used to keep the service secure and working.

3. Why we use it, and our lawful basis

• To provide the app to a practice and its staff: performance of our contract with the practice.
• To keep the service secure, prevent misuse and fix faults: our legitimate interests.
• To email accounting practice owners about the pilot: our legitimate interests in telling businesses about a service relevant to their work. Every email tells you how to stop further emails, and we respect that at once.
• To keep billing and accounting records: our legal obligations.

We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

We use these providers, each under a written contract that protects the data:

• Hetzner Online GmbH (Germany): hosts the app, the database and its backups.
• Anthropic PBC (United States): the AI that proposes a category for each bank line. For each line we send its date, description and amount through Anthropic's commercial API. PDF statements are converted through the same API. Under its commercial terms, Anthropic does not train its models on this data.
• Resend (United States): sends account emails, such as password resets.
• Google Workspace: our email.
• Calendly (United States): call bookings.
• Stripe: takes payments. We never see full card numbers.

5. Transfers outside the UK

Hetzner stores data in Germany, which the UK recognises as giving adequate protection. Anthropic, Resend, Calendly, Google and Stripe may process data in the United States. For those transfers we rely on the UK-US data bridge where the provider is certified, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• Client records: until the practice deletes the client or ends its account. We then remove them from the live system, and they leave our backups within 14 days. Before deletion we give the practice an export, because practices must keep their own records for HMRC.
• Accounts: while the account is open, then deleted within 30 days. Billing records are kept for 6 years, as the law requires.
• Outreach: until you ask us to stop, or 12 months after our last contact. If you ask us to stop, we keep only your email address on a do-not-contact list, so we never write again.
• Server logs: for a limited period, for security, and then deleted.

7. How we protect it

All traffic uses HTTPS. The database is not reachable from the internet. Each practice can see only its own clients, and access is checked on every request. The database is backed up daily. Only the founder has administrator access.

8. Your rights

You can ask to see, correct or delete your personal data, to limit or object to how we use it, and to receive it in a portable format. You can always object to marketing emails, and we will stop. Email hello@tickandbash.com. We reply within 1 month.

If you are unhappy with how we use your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

9. Cookies

The website sets no tracking or advertising cookies. The app uses only the cookies needed to keep you signed in, so it does not ask for cookie consent.

10. Changes

If we change this notice, we update the date at the top. If a change affects how a practice's client data is processed, we email the practice first.