Who we are
Spiral HQ Ltd is the controller of the personal data described in this policy. We are registered in England and Wales and registered with the Information Commissioner’s Office (ICO). You can reach our Data Protection team at privacy@spiralhq.co.
What we collect
We collect information you give us (name, email, business details), the financial data you enter or import (invoices, expenses, customers), transaction data from connected bank feeds via Open Banking, and technical usage data such as device and log information.
Why we use it and our legal basis
We process your data to provide and maintain the service (performance of our contract with you), to meet legal and tax obligations such as MTD submissions and record-keeping (legal obligation), and to secure, support and improve Spiral (our legitimate interests). Where we rely on consent — for example some marketing — you can withdraw it at any time.
Open Banking and your bank data
When you connect a bank account, you authorise the connection on your bank’s own secure page through regulated Open Banking providers. Spiral receives read-only access to transaction data — we never receive your banking credentials and can never initiate payments or move money.
You can disconnect a bank feed at any time from your settings, which stops any further data being shared with us.
How we protect it
We protect your data with 256-bit encryption in transit and at rest, store it in UK and EU data centres, and enforce strict internal access controls with audit logging. We run regular security testing and hold our providers to the same standards.
How long we keep it
We keep your data while your account is active. After you close it, we retain financial records for as long as UK tax law requires — generally up to six years — and then delete or anonymise your data. You can request earlier deletion of anything not subject to a legal retention duty.
Your rights
Under UK GDPR you have the right to access, correct, export, delete or restrict processing of your personal data, and to object to certain processing. To exercise any of these, email privacy@spiralhq.co and we will respond within one month.
If you’re unhappy with how we’ve handled your data, you can complain to the ICO at ico.org.uk — though we’d always like the chance to put things right first.
Contact us
For any question about this policy or your data, contact our Data Protection team at privacy@spiralhq.co. We update this policy from time to time and will notify you of material changes.