1. Who We Are

Filed ("we", "us", "our") is an Irish financial tracking application for self-employed people. We are the data controller for personal data collected through our app and website at filed.ie.

For data protection queries contact us at: dpo@filed.ie

2. What Data We Collect

2.1 Account Information

• Your first name
• Email address and password (stored encrypted)
• Profession (e.g. freelancer, photographer, electrician)
• Business structure (sole trader / limited company)
• VAT registration status
• Marital status (for tax band calculation only)

2.2 Financial Data

• Income entries (amount, description, date, RCT status)
• Expense entries (amount, category, date, supplier, notes)
• Annual income estimate you provide during onboarding
• Receipt photographs you upload
• VAT amounts on expenses

2.3 Technical Data

• IP address
• Device type and operating system
• Browser or app version
• Pages visited and features used within the app
• Error logs

2.4 Data We Do NOT Collect

3. How We Use Your Data

3.1 To Provide the Service

Legal basis: Performance of a contract (Article 6(1)(b) GDPR)

• Calculate your estimated income tax, USC, and PRSI
• Track your income and expenses throughout the year
• Generate your year-end tax summary
• Store and display your transaction history
• Process receipt photographs through optical character recognition (OCR)

3.2 To Send Reminders

Legal basis: Legitimate interests (Article 6(1)(f) GDPR)

• Monthly reminders to log expenses
• Tax deadline reminders (October and November)
• Preliminary tax payment reminders

You can opt out of reminders at any time in your account settings.

3.3 To Process Payments

Legal basis: Performance of a contract (Article 6(1)(b) GDPR)

Subscription payments are processed by Stripe. We do not store your card details. Please refer to Stripe's privacy policy at stripe.com/ie/privacy.

3.4 To Improve the App

Legal basis: Legitimate interests (Article 6(1)(f) GDPR)

• Analyse anonymised usage patterns to improve features
• Monitor and fix technical errors
• Understand which features are most used

We use aggregated, anonymised data only. We cannot identify you from this data.

3.5 Legal Compliance

Legal basis: Legal obligation (Article 6(1)(c) GDPR)

We may process your data where required by Irish or EU law.

4. Who We Share Your Data With

4.1 Our Service Providers

We use the following third-party processors who are contractually bound to protect your data:

Supabase Inc. — Database and file storage (EU servers)

• Purpose: Storing your account, financial data, and receipt photos
• Location: European Union
• Privacy policy: supabase.com/privacy

Stripe Inc. — Payment processing

• Purpose: Processing subscription payments
• Location: EU (Stripe Ireland, Ltd.)
• Privacy policy: stripe.com/ie/privacy

Google Cloud — OCR receipt scanning

• Purpose: Extracting text from receipt photographs
• Receipt photos are processed and immediately discarded — not stored by Google
• Privacy policy: cloud.google.com/privacy

4.2 We Do Not Sell Your Data

4.3 Legal Disclosure

We may disclose data if required by Irish law, a court order, or to protect the rights and safety of Filed users.

5. Data Transfers Outside the EU

We primarily store and process your data within the European Union. In limited circumstances, data may be processed in the United States (by Stripe and Google Cloud). Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

6. How Long We Keep Your Data

Account and financial data

We keep your data for as long as your account is active, plus 7 years after you close your account. This reflects Irish Revenue requirements for financial record-keeping.

Receipt photographs

Stored for the duration of your account plus 7 years, consistent with Revenue record-keeping requirements.

Technical logs

Kept for 90 days then automatically deleted.

Marketing data

Kept until you unsubscribe or withdraw consent.

7. Your Rights Under GDPR

Right of Access (Article 15)

You can request a copy of all personal data we hold about you. We will respond within 30 days.

Right to Rectification (Article 16)

You can correct inaccurate data at any time through your account settings or by contacting us.

Right to Erasure (Article 17)

You can request deletion of your account and data. Note: we may need to retain certain financial records for 7 years to comply with Revenue requirements.

Right to Data Portability (Article 20)

You can request an export of your data in a machine-readable format (CSV or JSON).

Right to Object (Article 21)

You can object to processing based on legitimate interests, including direct marketing.

Right to Restrict Processing (Article 18)

You can ask us to pause processing of your data in certain circumstances.

How to Exercise Your Rights

Email us at dpo@filed.ie with the subject line "Data Subject Request". We will respond within 30 days. We may need to verify your identity.

Right to Complain

If you are unhappy with how we handle your data, you have the right to complain to the Data Protection Commission (DPC) Ireland:

• Website: dataprotection.ie
• Phone: +353 57 868 4800
• Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28

8. Data Security

We implement the following measures:

• All data encrypted in transit using TLS 1.3
• All data encrypted at rest using AES-256
• Passwords hashed using bcrypt — we cannot see your password
• Row-level security: each user can only access their own data
• Regular security reviews and penetration testing
• Access to production data restricted to essential personnel only

9. Cookies

Our app uses cookies and similar technologies. Please see our Cookie Policy for full details. Essential cookies keep you logged in and cannot be disabled. We do not use advertising cookies.

10. Children's Privacy

Filed is not intended for persons under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at legal@filed.ie and we will delete it immediately.

11. Changes to This Policy

When we make significant changes, we will:

• Display a notice in the app
• Send an email to registered users
• Update the effective date at the top of this document

12. Contact Us

Email: dpo@filed.ie
General enquiries: legal@filed.ie
Website: filed.ie

Accountancy practices

If you invite an accountant, they can see and edit your records only after you give consent. You can revoke that access at any time under Sharing & privacy. Every view and change they make is recorded in a log you can see. Where a practice manages a profile for you without your own login, the practice is the data controller and Filed processes the data on its behalf under our Practice Data Processing Agreement.