This policy explains how Diagonalise collects, uses, shares and protects personal data, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
Diagonalise (https://www.diagonalise.com) is run by [Company legal name], [Company registration]. Our address is [Registered address]. We are registered with the Information Commissioner's Office (ICO) under number [ICO registration number].
For anything to do with your personal data, email support@diagonalise.com.
Our role
- We are the controller for the personal data we hold about you as a user of Diagonalise: your account, your business details, how you use the service, and how we bill you.
- We are a processor for personal data you put into Diagonalise about other people, such as your customers' names, addresses and email addresses, or team members you invite. We only process that data to provide the service to you, on the terms in the data processing section of our Terms of service. You are the controller of that data and responsible for having a lawful basis to use it.
What we collect
- Account details: your name, email address, a hash of your password (never the password itself), and the businesses you belong to and your role in each.
- Business details: business name, address, phone, email, company and VAT numbers, invoice settings, and the bank details you choose to print on your invoices.
- Your records: invoices, line items, expenses, products, reports and the files you attach, such as receipts.
- Your customers' details: names, company details, contact details and notes you add about your customers.
- Billing information: your plan, subscription status and payment history. Card payments are handled by Stripe; we never see or store your full card number.
- Making Tax Digital (only if you use it): your National Insurance number, the authorisation tokens HMRC issues when you connect, the figures you send to HMRC, and the fraud prevention information HMRC requires with every submission (such as your device identifier, IP address, browser and screen details).
- AI assistants and API (only if you use them): the AI apps you connect, the access you grant them, when they were last used and from which IP address, and the actions they take in your account.
- Technical information: IP addresses and the date and time of sign-ins, password reset requests and changes made in your account, recorded in activity logs for security.
- Messages to us: what you send through our contact form or by email, including your name, email address, company and phone number if you give them.
How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing Diagonalise: your account, records, invoices, reports and PDFs | Contract (to provide the service you signed up for) |
| Taking payment and managing your subscription | Contract |
| Sending service emails, such as password resets and invitations | Contract |
| Sending figures to HMRC when you ask us to | Contract, and legal obligation for HMRC's fraud prevention data |
| Connecting AI assistants you approve | Contract |
| Keeping the service secure, preventing fraud and abuse, and keeping activity logs | Legitimate interests (protecting you, us and other users) |
| Helping you when you contact us, including viewing your account to fix a problem | Legitimate interests, or contract where it relates to the service |
| Improving the service | Legitimate interests |
| Keeping financial records and meeting legal requirements | Legal obligation |
We do not sell your personal data, and we do not use it for advertising.
Who we share it with
We only share personal data where we need to, with:
- Stripe, which processes subscription payments.
- Our hosting provider, [Hosting provider and location], which stores our servers and data and sends our emails.
- jsDelivr, the content delivery network that serves the page styles, fonts and scripts your browser loads. It receives your IP address as part of each request but does not receive your account data.
- HMRC, but only if you connect Making Tax Digital and ask us to send figures.
- AI apps you connect, such as Claude, ChatGPT or GitHub Copilot. When your assistant asks for information, we send it to that app because you have authorised it. The app's provider handles that data under its own terms and privacy policy, which you agree with them, not us.
- Professional advisers such as our lawyers, accountants and insurers, where needed.
- Authorities, where the law requires it.
- A buyer or successor, if our business is sold or reorganised, who would have to keep using your data in line with this policy.
International transfers
Some of our suppliers, such as Stripe, may process data outside the UK. Where they do, we rely on the UK's adequacy regulations or on safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
How we protect it
- Personal details such as names, addresses, email addresses, phone numbers and bank details are encrypted with AES-256-GCM before they are stored.
- Passwords, API tokens and password reset links are stored only as one-way hashes.
- All traffic to Diagonalise is encrypted with HTTPS.
- Each business's data is kept separate, and team members only see what their role allows.
- A small number of authorised staff can view an account to provide support or investigate a problem. This access is logged.
- AI assistants only get the access you approve, can never exceed your role, and can be disconnected at any time.
How long we keep it
- Your account and records: while your account is open. If you close your account, we delete your data within 30 days, apart from anything we must keep by law. You can export your data before you close your account.
- Billing records: for six years after the end of the financial year they relate to, as UK law requires.
- Activity and security logs: for as long as the account they relate to is open, and for up to 12 months otherwise.
- Contact form messages: for up to two years after we last hear from you.
You are responsible for keeping your own business records for as long as HMRC requires. That is usually at least five years after the 31 January Self Assessment deadline for the tax year they relate to.
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete your data
- ask us to restrict how we use your data, or object to how we use it
- ask for your data in a portable format
- withdraw consent, where we rely on consent
To use any of these rights, email support@diagonalise.com. We will reply within one month. Most of your data can also be viewed, changed and exported in your account settings.
If your request is about data you hold about your own customers, we will pass it to you, as you are the controller of that data.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
We only use cookies that are strictly necessary for Diagonalise to work. Our Cookie policy lists them.
Children
Diagonalise is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes to this policy
We will update this policy when our practices change. The version number and effective date are shown at the top of this page. If we make significant changes, we will tell you by email or in the app.