Privacy Policy

Last updated: 26 September 2026

1. Introduction

Solas ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

Solas is operated by Solas Services Ltd, a company registered in England and Wales (Company No. 16994762), with registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

We are the data controller responsible for your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number ZC087654.

This notice explains what we process, why we process it, who we share it with, and the choices and rights available to you. It does not ask you to consent to processing that relies on another lawful basis.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide when using our Service, including:

  • Name and email address
  • Business name, entity type, and address
  • UTR (Unique Taxpayer Reference) number
  • National Insurance Number (NINO)
  • VAT registration number (if applicable)

2.2 Financial Data

To provide our services, we collect and process:

  • Receipt images and extracted data (vendor, amount, date, category), including receipts forwarded by email
  • Income and expense records
  • VAT-related information
  • Invoice and customer records (name, email, address, and tax identifiers of your clients)
  • Open Banking feeds are coming soon; Solas does not yet connect to a bank or receive bank-feed data through this integration
  • Vehicle and mileage records

2.3 Customer Communications and Front Desk

If you connect a business telephone number, WhatsApp account, or messaging channel, we process information about the people who contact your business. This can include:

  • Caller and recipient telephone numbers, WhatsApp identifiers, names, profile details, message text, attachments, delivery status, and message timestamps
  • Call routing information, call times, duration, recordings, transcripts, summaries, and the actions taken during or after a call
  • Enquiries, leads, appointments, jobs, customer notes, and follow-up tasks created from those communications

Callers are given a recording notice when recording is enabled. The business using Solas remains responsible for telling its customers how it uses their information and for choosing an appropriate lawful basis for its communications and recordings. For customer information that we process only to provide the connected service, Solas acts on that business's instructions.

2.4 AI Assistant Conversations

When you use our AI-powered chat assistant, we store:

  • The text of your messages and the assistant's responses
  • Queries the assistant makes against your financial data on your behalf

2.5 Automatically Collected Information

When you use our Service, we may automatically collect:

  • Device information (type, operating system, user agent)
  • Usage data (features used, interaction patterns)
  • Log data (access times, IP addresses, crash reports)
  • Precise or approximate location and motion activity when you enable mileage detection or ask us to find your current address
  • Dictation audio and the resulting transcript when you use voice input; iOS may send that audio to Apple's speech recognition service
  • Address-search text, map results, and location data when you use address suggestions or current-address lookup through Apple's Maps services

2.6 Tax Submission Confirmation Records

When you prepare or confirm a supported submission to HMRC, we create a tamper-resistant audit record. This includes the complete submission payload you reviewed and a cryptographic fingerprint used to verify its integrity. It may also include the declaration wording and version, your account and user identifiers, confirmation and submission timestamps, the submission outcome and HMRC receipt or reference, and security information such as your IP address, user agent, and device identifier.

3. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The legal bases we rely on for each type of processing are:

  • Account information (name, email): Contract — necessary to provide the Service to you
  • Financial data (transactions, receipts): Contract — core service functionality to help you manage your finances
  • Open Banking: This integration is coming soon and is not currently receiving bank data through Solas
  • Customer communications and Front Desk data: Contract — to provide the communications and administration service you enable, and legitimate interests — to secure, troubleshoot, and improve delivery. The lawful basis that you use for your own customers is your responsibility
  • Tax data (UTR, NINO, VAT numbers): Contract and Legal obligation — necessary to provide tax services and comply with HMRC requirements
  • Tax submission confirmation records: Contract, legal obligation, and legitimate interests — to carry out the submission you expressly confirm, demonstrate what was authorised, prevent duplicate filings, reconcile uncertain HMRC outcomes, maintain security, and establish or defend legal claims
  • AI processing (receipt analysis, chat assistant): Contract — integral to the automated accounting features of the Service
  • Device and usage data: Legitimate interests — to maintain security, prevent fraud, and improve our Service
  • Marketing communications: Consent — we will only send marketing where you have given explicit consent
  • User research, product feedback, and feature updates: Legitimate interests — to understand how customers use the Service, gather feedback, and inform you about new and improved features. You can opt out at any time (see Section 11)

Where we rely on legitimate interests, we have conducted a balancing test to ensure our interests do not override your rights and freedoms.

4. How We Use Your Information

We use the collected information to:

  • Provide and maintain our Service
  • Process and categorise your financial transactions
  • Generate tax reports and Self Assessment documentation
  • Prepare VAT return figures and, when authorised and available, submit supported returns to HMRC on your behalf
  • Record your explicit confirmation of the exact tax submission prepared for review, and reconcile a submission with HMRC when the immediate response is uncertain
  • Provide AI-powered accounting assistance
  • Receive and send connected business communications, answer or route calls, prepare replies, capture enquiries, and create agreed follow-up work
  • Open Banking feeds are coming soon; you can prepare and review the financial records that will support a future connection
  • Improve and personalise your experience
  • Communicate with you about updates and support queries
  • Contact you occasionally to ask about your experience, invite you to interviews or surveys, or gather feedback on existing and planned features
  • Send you information about new features, improvements, and changes to the Service that may be relevant to your use of it
  • Ensure security and prevent fraud
  • Comply with legal obligations

5. AI and Automated Processing

Our Service uses artificial intelligence to provide core accounting features. This section explains how AI processes your data.

5.1 Receipt Scanning and Categorisation

When you upload or email a receipt, the image is sent to a third-party AI provider for optical character recognition (OCR). The AI extracts structured data such as the merchant name, amounts, tax, line items, and payment method. The image and extracted data are then used to categorise the expense and determine the applicable VAT rate.

5.2 Chat Assistant

Our AI chat assistant can answer questions about your finances and UK tax. To do so, it may:

  • Query your financial data (transactions, receipts, invoices, tax records) using read-only access scoped to your account
  • Search our UK tax knowledge base of official guidance and legislation
  • Search the web for current tax information

Your name, business name, entity type, and current tax year are provided as context to the AI to personalise responses. Chat conversations are stored on our servers (see Section 9 — Retention).

When web search is used, the generated search query is sent to our search provider. Standard search-query logs may be retained by that provider for up to 90 days. We are responsible for limiting personal or confidential information in those queries.

5.3 Front Desk Voice and Messaging

Front Desk uses AI to understand calls and messages, ask relevant questions, prepare or send replies within the rules selected by the business owner, and turn communications into structured enquiries, appointments, jobs, or follow-up tasks. To do this, our communications and voice providers may process telephone numbers, message content, live call audio, recordings, transcripts, business instructions, and tool results. A human can review the resulting record and take over where the workflow requires judgement.

5.4 Human Oversight

AI-powered features assist with categorisation and suggestions, but significant financial decisions — such as submitting tax returns — remain under your control. No automated decision produces legal or similarly significant effects without your review and confirmation.

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

  • HMRC: When a supported submission feature is available and you authorise us to submit VAT returns, income tax updates, or other tax documentation, and when we need to check the outcome of a submission whose immediate response was uncertain
  • AI and cloud model providers: Process receipt images, document-search queries, assistant conversations, and the context needed to answer them. A web-search provider also receives generated queries when web search is used
  • Communications and voice providers: Process connected phone numbers, calls, messages, recordings, transcripts, and delivery information where you enable those channels
  • Cloud and operational providers: We use providers for hosting, storage, authentication, email, notifications, subscriptions, and payments
  • Apple services: Apple may process device tokens and notification payloads, App Store purchase data, dictation audio or transcripts, and address-search or location data when you use the corresponding iPhone features
  • Analytics provider: Receives usage events from our app and website so we can understand and improve the Service. In the mobile app, those events are linked to your Solas account ID and email address
  • Legal requirements: When required by law or to protect our rights

We assess the role of each provider and require appropriate contractual and transfer safeguards before enabling a processing path. Where that assessment is incomplete, the relevant feature remains release-gated. Some recipients, including HMRC, banks, payment providers, and communications platforms, may also act as independent controllers for their legal, security, or platform purposes. You may ask us for further information about the provider categories we use. Our maintained list of named providers, their purposes, and their roles is available on our Service Providers page.

7. International Data Transfers

Our primary application database and much of our AWS and AI infrastructure are configured in UK or European regions. Some providers and their subprocessors process or permit support access from other countries, including the United States. A provider's selected hosting region does not necessarily mean that every support, security, or subprocessor activity stays in that region.

Some of our service providers (including email delivery, subscription management, push notifications, and payment processing) operate partially or wholly in the United States. Where a restricted transfer to the US is approved, we document and apply one or more of the following safeguards:

  • The UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework)
  • The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses

We use an applicable UK adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, or another lawful safeguard for a restricted transfer. Data transfers between the UK and EEA may rely on the UK's adequacy regulations. We review the actual contracting entity, destination, certification, and subprocessor chain rather than assuming that one safeguard applies to every provider. Providers or processing paths that remain under assessment are not enabled for the affected feature.

8. Data Security

We implement robust security measures to protect your data:

  • 256-bit encryption for data in transit and at rest
  • Secure authentication and access controls
  • Row-level security ensuring users can only access their own data

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods are:

  • Active account data: Duration of your account plus 90 days after deletion request, during which you may restore your account
  • Financial and tax records: Normally the duration of your account plus the 90-day deletion grace period. We strongly recommend you export your records before requesting deletion. Self-employed people will generally need to keep relevant records for at least 5 years after the 31 January filing deadline for the relevant tax year, and longer in some circumstances
  • Tax submission confirmation records: Duration of your account plus the 90-day deletion grace period, after which they are deleted with your account. Export any evidence you need before requesting account deletion
  • Chat conversations: Duration of your account plus 90 days after deletion request
  • Call recordings and transcripts: Until the retention date configured for Front Desk (90 days by default), or earlier if the connected account is deleted, subject to the account-deletion grace period and deletion processing
  • Customer communications and Front Desk records: Normally the duration of your account plus the 90-day deletion grace period. Financial records created from an enquiry or job may need to be retained for the applicable tax-record period
  • Provider copies and logs: Communications, authentication, banking, payment, email, and AI providers may retain limited records under their own documented schedules, legal duties, backup cycles, and fraud or security controls
  • Accounts awaiting a sign-in migration decision: Normal app access remains unavailable until you complete the transition. If you decline the replacement Terms, access closes immediately and your existing records enter a manual retention review. Declining does not start the ordinary 90-day deletion process. We check whether financial or tax records, legal obligations or legal claims require retention, document the decision, and separately authorise final deletion when those checks are complete. Records remain restricted while that review is pending. You can contact us to request access to your records or exercise your data-protection rights
  • Identity-denial security fingerprints: After final account deletion, we retain a pseudonymous fingerprint of each deleted sign-in identity indefinitely under the current security design. This prevents a surviving sign-in token for that same identity from creating another account. The fingerprint contains no raw email address, provider identifier or account reference. It remains personal data, separate from your deleted business records. Its purpose is account security and preventing unintended re-creation; it is not used for marketing. You can request erasure or object to this processing using the contact details in Section 10; we assess those requests rather than treating this record as exempt from your rights
  • Marketing preferences: Until you withdraw consent
  • Device and usage data: 12 months from collection

When you request account deletion, your operational account data is made inaccessible immediately and permanently deleted after the 90-day grace period, including tax-submission confirmation records. Export any records you need to retain before requesting deletion. The migration retention-review process and the identity-denial security fingerprint described above are separate exceptions to this ordinary account-deletion schedule.

10. Your Rights (UK GDPR)

Under UK GDPR, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data (subject to legal retention requirements)
  • Portability: Receive your data in a portable format
  • Restriction: Limit how we process your data
  • Objection: Object to certain processing activities
  • Withdraw consent: Revoke previously given consent
  • Automated decision-making: Not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. See Section 5.4 for details on how our AI features operate.

To exercise these rights, please contact us at support@solas.services. We will respond to your request within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated. Visit www.ico.org.uk or contact the ICO at 0303 123 1113.

11. Communications from Us

We may contact you for the following reasons:

  • Service communications: account, security, billing, legal, and operational messages essential to the Service. You cannot opt out of these while you have an active account.
  • Product updates: occasional emails about new features, improvements, and material changes to the Service. You can opt out at any time using the unsubscribe link in any such email or by emailing support@solas.services.
  • User research: occasional invitations to participate in interviews, surveys, or feedback sessions, including personal outreach from our team. Participation is always voluntary, and you can opt out at any time by replying to the message or emailing support@solas.services.
  • Marketing: promotional content about Solas or related services. We will only send marketing where you have given explicit consent, and you may withdraw that consent at any time.

We honour opt-out requests promptly and maintain a record of your communication preferences for the lifetime of your account.

12. Cookies and Tracking

Website Analytics

Our website uses a PostHog Cloud EU project to understand how visitors use the site. This collects page views, clicks, device and browser information, approximate location derived from your IP address, browser exceptions, and session replay outside blocked authentication surfaces.

In accordance with the Privacy and Electronic Communications Regulations (PECR), analytics cookies are only set with your consent. When you first visit, you can accept or decline via the cookie banner. If you decline (or have not yet chosen), analytics runs in memory-only mode: nothing is stored on your device, and you are not recognised across visits or pages you return to later. If you accept, an analytics cookie and local storage entry allow us to recognise return visits.

Storage We Use

  • Session cookies: Temporary cookies that enable core site functionality and are deleted when you close your browser
  • Security cookies: Help protect against cross-site request forgery and maintain secure sessions
  • Consent preference: A local storage entry recording your cookie choice, so we do not ask again. This is strictly necessary and does not require consent
  • Analytics cookie (consent only): A PostHog cookie and local storage entry that recognise you as a returning visitor. Set only if you accept analytics cookies

Mobile App Analytics

Our mobile app does not use cookies. The app sends usage events (such as features used and screens viewed) to PostHog, linked to your account ID and email address, to help us improve the Service. This is processed under our legitimate interests as described in Sections 2.5 and 3. You can object by contacting us (see Section 15).

We do not use advertising or cross-site tracking cookies. We do not track you across other websites, and we do not sell or share your data for advertising.

13. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

← Back to Home