ScanalyseScanalyse

Privacy Policy

Last updated: 11 August 2026

Who we are. This service (“Scanalyse”) is provided by Scanalyse Limited, a company registered in England and Wales under company number 17338724, whose registered office is at 99 Stockport Road East, Bredbury, Stockport, England, SK6 2AQ. We are registered with the UK Information Commissioner’s Office under reference ZC205165. Privacy contact: [email protected].

Our role. For the supplier and purchase data inside the documents you submit, you (our customer) are the controller and we act as your processor under a Data Processing Agreement. For your user accounts and our audit logs, we are the controller. This notice explains both.

What we process

To turn supplier purchase documents into QuickBooks records we process: the uploaded or emailed documents and their contents; supplier details (name, address, email, phone, tax/registration numbers, bank/payment references); line-item and pricing data; your user account (username, hashed password, role); and access/audit logs. Documents may contain personal data of individuals (for example sole traders or named contacts).

Why we process it (lawful basis)

As your processor we act on your instructions. As controller, your basis is typically legitimate interests (running your accounts payable) and/or legal obligation (tax record-keeping). For your user accounts we rely on legitimate interests and performance of a contract in securing the service.

Sub-processors

Intuit / QuickBooks Online receives your data too, but it is not our sub-processor and we do not process your QuickBooks data on Intuit’s behalf. QuickBooks Online is your account, held by you with Intuit under your own agreement with them, and we and Intuit each decide independently what we do with the data we hold. We tell you about it here anyway, because you should be able to see every company your data reaches.

Our current sub-processor list and their transfer safeguards are available on request.

International transfers

Anthropic and Intuit process data in the US. We rely on the EU Standard Contractual Clauses (2021/914) and the UK Addendum to those Clauses, as set out in those providers’ data-processing terms. Primary processing is in the UK/EU.

Your data is processed and stored in the United Kingdom, in DigitalOcean’s London region (LON1). DigitalOcean states that its employees do not have access to customer content unless a customer grants permission for support. DigitalOcean’s published sub-processor list names providers in the United States that support all of its services, including Amazon Web Services for backups and infrastructure, Cloudflare for platform security, and Traversal for customer troubleshooting and support, so some handling of data outside the UK is possible, principally for support, backup and platform security.

DigitalOcean, LLC holds an active certification under the EU-U.S. Data Privacy Framework and its UK Extension, due for recertification on 3 March 2027, and this is the mechanism its data processing agreement applies to such transfers. That agreement also sets out the EU Standard Contractual Clauses (2021/914) and the UK Addendum to those Clauses, which take effect if the Data Privacy Framework is invalidated or DigitalOcean fails to recertify. DigitalOcean is contractually responsible to us for its sub-processors and requires them to meet obligations no less protective than its own.

Retention

Documents you upload are archived once posted and then deleted after approximately 7 years (aligned to UK VAT record-keeping); documents left un-posted are kept approximately 90 days then archived; OAuth tokens are kept until you disconnect QuickBooks; audit logs are kept for up to 24 months, except entries that record a deletion or a data request we carried out, entries that are the only record of something the app still shows you, and the record of administrator access to your account, which we keep for as long as the record they relate to. Deletion follows the periods above, and you can ask us to delete your data at any time.

The app separately keeps a mirror of the open and recent items in your QuickBooks company, so the register, the Pay Bills screen and the spend reports have something to show. That mirror is a cache of your own ledger rather than a record we create: it is refreshed from QuickBooks continuously, and an entry leaves it when QuickBooks stops listing it. Settled bills, payments and journal entries drop out approximately 12 months after their transaction date. A bill you still owe stays mirrored for as long as it is outstanding, because it is money still to pay and the app has to keep showing it to you. Clearing the imported ledger in Settings removes it. The 7-year schedule above covers the documents you upload and does not describe this mirror.

Those periods cover the copy we hold. They do not cover your QuickBooks company. When we post a bill, a credit note or a payment on your authorisation, that record is written into your own QuickBooks account, with the scanned document attached, and it stays there for the life of that account. It is your accounting record, not ours, and we never delete it: erasing a document here removes our copy and leaves the QuickBooks entry untouched. Removing that entry is something only you can do, in QuickBooks.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. We provide tooling to export and erase all data derived from a document. To exercise a right, contact [email protected]. You may complain to the ICO (ico.org.uk) or your local supervisory authority.

Cookies and local storage

The app uses a session cookie for login and a CSRF cookie for security; it stores your theme preference and the connected QuickBooks company id in your browser’s local storage. No third-party advertising or tracking cookies are used.

Security

Encryption at rest, TLS in transit, role-based access control, audit logging and rate limiting protect your data.

Changes

We will update this notice as the service evolves and post the revised date above.