Privacy Policy
Version 1.0 — 11 October 2026
Padgrad Ltd is the data controller for the personal data described in this notice. We are a company registered in England and Wales (company number 17365449) with our registered office at 20 Wenlock Road, London, England, N1 7GU. PadCount is a product of Padgrad Ltd, and this notice explains how we handle personal data when you use PadCount (padcount.com).
- Data protection contact: privacy@padgrad.com
- EU representative (GDPR Art. 27): Not yet appointed — we will publish the representative's name and address here before we actively offer services to people in the EU. Until then, contact privacy@padgrad.com and we will deal with your request directly.
- ICO registration: Pending — published once the statutory data protection fee is paid.
1. Our two roles
- For your account, billing and marketing data, and for anything you do on padcount.com as an individual, we are the controller.
- For the employee and financial data your organisation puts into PadCount, your organisation is the controller and we act as its processor, under the Data Processing Addendum. This notice covers the parts where we are the controller.
2. The personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and identity | name, email address, password hash, Google account identifier (if you sign in with Google), account status | you |
| Company and team | company name and web address, VAT number, tax year end, team member names, emails, roles and permissions, invite records | your organisation and its staff |
| Your records | expense and revenue entries, dates, amounts, categories, notes, asset and deadline entries, uploaded receipt images (which may show names, card fragments, addresses or merchant data) | you and your team |
| Payments | Stripe customer and payment identifiers, plan, transaction history. We never receive or store your card number | Stripe |
| Communications | support messages, tickets, complaints, emails we send you, feedback | you and our systems |
| Technical | IP address, approximate country location derived from IP, device and browser information, session identifiers, error and security logs | your device |
| Cookies and similar | see the Cookie Policy — including analytics and session-replay data collected only with your consent | your device |
We do not ask for, and do not want, special category data (for example health, ethnicity, religion, trade union membership, sexual orientation, biometrics). Receipts sometimes contain more than you intend, so please redact anything you would not want stored.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and company, providing the features you use | Performance of a contract (Art. 6(1)(b)) |
| Storing and organising the records and receipts you upload, and exporting them for your accountant | Performance of a contract |
| Sending service emails (invites, receipts, security, major service changes) | Contract or legitimate interests |
| Sending product news or marketing you opted into | Consent (Art. 6(1)(a)) |
| Analytics and product improvement, error monitoring | Consent where cookies or session recording are involved (see the Cookie Policy); otherwise legitimate interests in running a working, secure service |
| Security, fraud and abuse prevention, rate limiting, enforcing our terms | Legitimate interests and, where relevant, legal obligation |
| Taking payment, accounting, tax and VAT records | Contract and legal obligation (Art. 6(1)(c)) |
| Handling complaints, rights requests and legal claims | Legal obligation and legitimate interests in defending claims |
Automated decisions. We do not use solely automated processing to make decisions that significantly affect you, and PadCount does not score or rank you.
4. Artificial intelligence
PadCount does not send your data to AI model providers. The records features are ordinary software. If we ever add an AI-assisted feature that processes your personal data, we will update this notice and the Disclaimer first and tell you what would be sent, to whom and where. We do not use your records, receipts or documents to train any model, and we do not sell your personal data.
5. Who we share personal data with
We share personal data only as needed, and only with parties bound by written contracts:
| Recipient | Purpose | Location |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) | hosting, database, receipt storage | EEA (europe-west1) |
| Stripe | payments, subscriptions, billing | US / EU |
| Amazon Web Services (SES) / Resend | transactional email | US / EEA |
| Microsoft Clarity | website analytics on public pages, only after you consent | US |
| Professional advisers (accountants, insurers, lawyers) | where necessary | UK |
| Regulators and law enforcement | where we are legally required | UK / EU / other |
| A buyer or successor | if our business (or this product) is sold or reorganised | UK / other |
Within your company, your organisation's data is visible to the members your organisation invites. We do not sell your personal data and we do not share it for third-party advertising.
6. International transfers
Some of our providers are outside the UK/EEA. Where we transfer personal data to a country without UK adequacy regulations, we rely on the ICO International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a documented transfer risk assessment.
| Transfer | Safeguard |
|---|---|
| EEA (Google Cloud europe-west1) | Covered by UK adequacy regulations for the EEA |
| United States (Stripe, Microsoft, AWS, Resend) | IDTA/UK Addendum and risk assessment, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified |
You can ask us for a summary of the safeguards we rely on at privacy@padgrad.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, company and your records | while your account is active, then 12 months after closure or last activity, then deleted |
| Receipt images and financial data | per your organisation's instructions; deleted on termination in line with the Data Processing Addendum |
| Cookies and analytics | as set out in the Cookie Policy |
| Payment, tax and accounting records | 6 years from the end of the relevant financial year (a legal requirement) |
| Security and audit logs | 12 months |
| Complaints and legal files | 6 years (the limitation period) |
We keep data only as long as we need it, and review retention schedules annually.
8. Your rights
You have the right to: be informed; access a copy of your personal data; rectify inaccurate data; erase data we no longer need; restrict how we use it; object to processing based on legitimate interests, including direct marketing (marketing objections are absolute — we stop); data portability; withdraw consent at any time; and, in relation to automated decisions that significantly affect you, to be told about the decision, make representations, obtain human intervention and contest the outcome.
How to exercise them: email privacy@padgrad.com. We will respond within one month (we may extend by two further months for complex requests and will tell you if we do). We do not charge, and we may ask you to verify your identity. Much of your data you can edit or delete yourself in the app.
If you are unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk · 0303 123 1113) in the UK, or your national supervisory authority if you are in the EU.
9. Marketing
We send product news and marketing only with your consent, asked for separately with an unticked box, and you can withdraw it at any time using the unsubscribe link in every email or in your settings. Withdrawing marketing consent does not stop essential service emails.
10. Security
We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, access controls and role separation, per-tenant isolation, audit logging, regular backups, patched infrastructure, and least-privilege access to production data. Receipt images are stored in access-controlled cloud storage. No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and tell you directly where the risk is high.
11. Children
PadCount is a business service and is not intended for children. We do not knowingly collect data from under-18s.
12. Cookies
Our Cookie Policy lists the cookies and similar technologies we use, what they are for, and how to accept, reject or withdraw. Non-essential cookies and session recording are set only after you consent.
13. Changes
If we make a material change to how we use your personal data, we will update this notice, change the version date, and notify you by email or in-product notice before the change takes effect.
14. Contact
Padgrad Ltd · 20 Wenlock Road, London, England, N1 7GU · privacy@padgrad.com