• Account data — name, email address, mobile number, business name
• Tax data — UTR number, VAT number, CIS status, income and expense figures
• Bank data — read-only transaction data via Open Banking (we never store card numbers or account credentials)
• Usage data — voice transcripts (processed and discarded), app usage patterns, device information
• Payment data — billing history (processed by Stripe — we do not store card details)
• Communications — messages sent to our support team

• To provide the £arnd service and process your HMRC submissions
• To communicate with you about your account, deadlines and service updates
• To improve the app — aggregated and anonymised usage data only
• To comply with our legal obligations including anti-money laundering requirements

We will never sell your data to third parties. Ever.

Data is shared with HMRC only when you instruct us to file on your behalf. Data is shared with Stripe solely for payment processing. No data is shared with advertisers or marketing companies.

• Right of access — request a copy of all data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data (subject to legal retention requirements)
• Right to portability — export your data in a machine-readable format at any time
• Right to object — object to processing for direct marketing
• Right to restrict processing — request that we limit how we use your data

To exercise any of these rights, contact us at [privacy@earnd.uk]. We will respond within 30 days.

All data is stored on UK-based servers. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We conduct regular security reviews and penetration testing. See our Security Policy for full details.

We retain your data for 7 years following account closure to meet HMRC record-keeping requirements. After 7 years, all personal data is permanently deleted.

We use essential cookies only for app functionality. See our Cookie Policy for full details.

As an accountancy service provider, £arnd is subject to the UK Money Laundering Regulations 2017 (as amended). We are required to:

• Conduct customer due diligence (CDD) on all customers
• Monitor transactions for suspicious activity
• Report suspicious activity to the National Crime Agency (NCA) via a Suspicious Activity Report (SAR)
• Maintain records of all CDD checks and transactions for a minimum of 5 years
• Appoint a nominated Money Laundering Reporting Officer (MLRO)
• Provide AML training to all staff and contractors

Before providing services, we verify the identity of all customers. This includes:

• Full legal name and date of birth
• Residential address (verified via credit reference agency or document check)
• Business name and nature of trade
• UTR number cross-referenced with HMRC records
• Enhanced due diligence for higher-risk customers or transactions

We use automated identity verification. We reserve the right to refuse or suspend service where CDD cannot be completed satisfactorily.

We monitor for indicators of money laundering including but not limited to: unexplained large cash transactions, inconsistent income patterns, requests to manipulate financial records, or use of the service by third parties on behalf of unnamed principals.

Where suspicious activity is identified, our MLRO will review and determine whether a SAR should be filed with the NCA. We are legally prohibited from tipping off a customer that a SAR has been filed.

Earnr tier customers receiving cash commission payments above £[threshold] per calendar year are subject to enhanced due diligence. Identity verification is required before commission payments are made. This is in addition to standard account verification.

All CDD records, transaction records and internal AML reports are retained for a minimum of 5 years. Records are stored securely on UK servers with restricted access.

£arnd Ltd has a zero-tolerance approach to modern slavery, human trafficking, forced labour and child labour in all its forms. We are committed to acting ethically and with integrity in all our business relationships and to implementing and enforcing effective systems and controls to ensure modern slavery is not taking place anywhere in our business or supply chain.

£arnd is a software business employing [X] people in the UK. Our supply chain consists primarily of technology service providers, cloud infrastructure suppliers and professional services firms. We assess each supplier relationship for modern slavery risk.

• Technology suppliers — we use established, regulated providers (Stripe, AWS/Google Cloud, Twilio etc) who maintain their own modern slavery policies
• Development contractors — all contractors must confirm compliance with the Modern Slavery Act as a condition of engagement
• Staff — all staff are employed under UK employment law, paid at or above the National Living Wage, with the right to work verified

We assess modern slavery risk annually across our operations and supply chain. Our current risk assessment identifies our principal risks as:

• Use of offshore development resource — mitigated by contractual requirements and supplier audits
• Misuse of the £arnd platform to conceal forced labour income — mitigated by our AML monitoring and transaction analysis

Any employee, contractor or customer who suspects modern slavery or human trafficking in connection with £arnd or its supply chain should report this to [compliance@earnd.uk] or directly to the Modern Slavery Helpline on 0800 0121 700.

Whistleblowers will be protected under our Whistleblowing Policy. Reports can be made anonymously.

All staff receive annual training on recognising the signs of modern slavery and the procedure for reporting concerns. Training records are maintained by [HR/Operations].

• In transit — all data is encrypted using TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS
• At rest — all stored data is encrypted using AES-256, including database records, backups and file storage
• Backups — encrypted backups are taken [daily] and stored in geographically separate UK data centres

• Users authenticate via biometric (Touch ID / Face ID) or a 6-digit PIN, with 90-day re-authentication for inactive sessions
• Sensitive operations (HMRC settings, bank connection changes) require step-up authentication even within an active session
• All staff access to production systems requires multi-factor authentication
• Access to customer data is restricted on a strict need-to-know basis with full audit logging
• Privileged access accounts are reviewed quarterly and revoked immediately on staff departure

• All data is stored on UK-based servers. No customer data is transferred outside the UK or EEA without explicit consent
• Infrastructure is hosted with [AWS / Google Cloud — TBC], which holds ISO 27001 and SOC 2 certifications
• Network access is controlled via firewalls with intrusion detection systems
• Vulnerability scanning is conducted [monthly] and penetration testing [annually]

Bank connections are established via FCA-regulated Open Banking providers. £arnd has read-only access to bank transaction data. We cannot initiate payments, transfer funds or access account credentials. Bank credentials are never stored by £arnd.

In the event of a suspected data breach, £arnd will:

1. Contain the breach and assess the scope within 24 hours
2. Notify the ICO within 72 hours where required under UK GDPR Article 33
3. Notify affected customers without undue delay where the breach is likely to result in a high risk to their rights and freedoms
4. Conduct a full post-incident review and implement remedial measures

To report a security vulnerability, email [security@earnd.uk]. We operate a responsible disclosure policy and will acknowledge reports within 48 hours.

All payment card processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. £arnd never stores, processes or transmits raw card data. Stripe handles all tokenisation and secure storage of payment credentials.

Cookies are small text files stored on your device when you visit a website or use an app. They help us keep you logged in, remember your preferences, and understand how the app is being used so we can improve it.

Essential cookies cannot be disabled — the app cannot function without them. Analytics cookies can be disabled at any time in Settings → Privacy → Analytics.

You can also clear all cookies by signing out of £arnd and clearing your browser or app cache. Note that clearing cookies will log you out and you will need to re-authenticate.

Stripe (our payment processor) may set cookies when you make or receive payments. These are governed by Stripe's Privacy Policy. We do not control these cookies.

You can contact us by any of the following methods:

• In-app — Settings → Contact → Make a complaint
• Email — [complaints@earnd.uk]
• WhatsApp — [number]
• Post — Complaints, £arnd Ltd, [Address]

Please include your name, account email address, a description of the issue and, where possible, dates and any reference numbers.

1. Acknowledgement — we will acknowledge your complaint within 2 business days
2. Investigation — a member of our team will investigate and aim to provide a full response within 10 business days
3. Resolution — we will explain what went wrong, what we are doing to put it right, and any remedy offered
4. Final response — if we cannot resolve within 10 days, we will write to you with an update and an expected resolution date

If you are not satisfied with our final response, you may refer your complaint to:

• The ICO — for data protection complaints: ico.org.uk/make-a-complaint or 0303 123 1113
• Citizens Advice — for general consumer rights: citizensadvice.org.uk
• HMRC — for complaints relating to tax filings made on your behalf: gov.uk/complain-about-hmrc

All complaints are logged, reviewed monthly by our management team, and used to improve our service. Trends and systemic issues are escalated immediately. We publish a summary of complaint volumes and outcomes in our annual transparency report.

The £arnd Earnr programme allows customers to earn rewards by referring new customers to £arnd. There are three tiers:

• Customer (all users) — you and your referred friend each receive one free month of your respective subscriptions when they subscribe to a paid plan
• Earnr (unlocks automatically at 5 qualifying referrals) — 10% monthly commission on each referred customer's active subscription, for 2 years from their sign-up date
• Affiliate Earnr (by invitation from £arnd only) — 15% lifetime commission; governed by a separate Affiliate Agreement. Not available by application.

A referral is qualifying when: (a) the new customer signs up via your unique referral link or QR code; (b) they complete their 30-day free trial; and (c) they make their first subscription payment. Trial sign-ups that do not convert do not count.

• Commission is calculated at the end of each calendar month based on active subscriptions from your referrals
• Commission rate is applied to the net subscription value (excluding VAT)
• The 2-year window runs from each referral's sign-up date — not from when you became an Earnr
• When you make your 5th qualifying referral, a retroactive lump sum is paid covering commission on referrals 1–4 from their sign-up dates to the date you became an Earnr
• Commission is paid to your registered UK bank account by the 15th of the following month
• If a referred customer changes plan, your commission adjusts accordingly from that month
• If a referred customer cancels, commission pauses. If they resubscribe within their 2-year window, commission resumes for the remaining period

Commission payments are made gross. Earnr commission is taxable income in the UK. It is your responsibility to declare commission income on your Self Assessment tax return. £arnd will provide an annual commission statement by 5 April each year to assist with this. £arnd may be required to report commission payments to HMRC above certain thresholds under the UK DAC7 digital platform reporting rules.

Before commission payments begin, Earnr customers must complete identity verification in accordance with our AML Policy. This requires photo ID and proof of address. Payments will be withheld until verification is complete.

The following are strictly prohibited and will result in immediate removal from the Earnr programme and forfeiture of unpaid commission:

• Creating fake or duplicate accounts to generate referrals
• Self-referral (referring yourself under a different email or identity)
• Misrepresenting £arnd's services in referral communications
• Referring customers who were already in contact with £arnd through another channel
• Any form of spam, unsolicited contact or misleading advertising

£arnd reserves the right to amend the commission structure with 30 days' notice. Commission rates in effect at the time a referral qualifies are honoured for the full 2-year window regardless of subsequent changes. £arnd may terminate the Earnr programme entirely with 90 days' notice, during which all accrued commission will be paid out.