DRAFT FOR REVIEW — not approved for production submission. Client engagement terms and provider processing/transfer arrangements still need review before production submission.
Privacy notice
Rachel King trading as King’s Accountancy & Bookkeeping
rachel@kingsaccountancy.uk
Who operates this app
King’s Invoice Desk is a private bookkeeping tool operated by Rachel King, a sole trader trading as King’s Accountancy & Bookkeeping. Contact: rachel@kingsaccountancy.uk. Only Rachel King is authorised to sign in.
Whose information is involved
The app accesses information in QuickBooks companies connected by the operator. This may include suppliers, customers, customer-linked projects/jobs, names and contact details, account and VAT references, and supplier bill details. Invoice details are entered manually. The current version does not collect Outlook emails or store uploaded invoice files.
Sources and purposes
Information comes from the connected QuickBooks account, invoice details entered by the operator, and requests made by a visitor’s browser. It is used to select supplier and project allocations, prepare and create bills after review, detect duplicate invoice numbers and retain submission records for reconciliation and recovery. The app does not make solely automated decisions with legal or similarly significant effects.
Data protection roles — to confirm before publication
Rachel King is responsible for administration and security of this private tool. Responsibility for client accounting data depends on the bookkeeping engagement and the client’s instructions. The tool is intended for multiple bookkeeping clients, with Rachel King as its sole user. Controller and processor responsibilities must be recorded in each engagement. Bookkeeping, accounts preparation, tax returns and payroll may involve different responsibilities. The engagement addendum remains a draft until completed and agreed.
Lawful basis — proposed for review
For the operator’s own administration and security, the proposed basis is legitimate interests in maintaining accurate bookkeeping and protecting the service, subject to assessing those interests against individuals’ rights. Any processing required by a specific legal recordkeeping obligation must be identified separately. Where client data is processed on a client’s instructions, the client’s lawful basis and the engagement’s data processing terms apply. Authorising QuickBooks access is not treated as blanket data protection consent from suppliers or customers.
What the app keeps
Connection tokens and bill submission records are encrypted in the app’s persistent storage. Submission records include the bill payload, company reference, saved request ID, status and bill identifiers and totals. Supplier/customer lookup lists are used while handling requests. Invoice drafts remain in the open browser page rather than being saved by this hosted app to browser local storage. Authentication uses essential session cookies lasting up to two hours; a restart or sign-out ends dashboard access. The app has no advertising or analytics scripts.
Providers and access
Render hosts the application and storage. Intuit supplies QuickBooks and its connection service. Squarespace manages the domain’s DNS; DNS management does not grant access to invoice records. GitHub stores the application source code, not the app’s invoice records or connection tokens. Contact email is handled through the operator’s email service. Hosting providers may process browser connection and operational information such as IP addresses. These services have their own applicable terms and privacy information. Xero and QuickBooks are used in the wider bookkeeping practice for agreed services. This dashboard currently connects to QuickBooks only and does not process payroll, accounts filings or tax submissions. The operator does not sell accounting data or use it for advertising.
Locations and international transfers — to confirm before publication
The supplied Render configuration selects Frankfurt for the application service. This does not establish where every provider processes support, logs or account information. The operator must confirm provider processing agreements, relevant locations and any applicable UK transfer safeguards, including how individuals can obtain information about those safeguards. This draft does not assert that those contractual checks are complete.
Retention and deletion — proposed criteria for review
Accounting submission records should be retained only as long as required for the relevant bookkeeping engagement, applicable recordkeeping obligations and necessary duplicate prevention, audit and reconciliation. A client-specific schedule and review process must be agreed before live use. The updated app offers client-specific review dates, recorded retention reasons, legal holds, export, token revocation and explicit app-data deletion. Dates are review reminders, not automatic deletion schedules. Deletion requires confirmed disconnection, a due review date, no hold, no pending submission and the operator’s explicit approval. Accessible same-disk app snapshots are scrubbed for that client. Provider disk backups and exported copies require separate handling. App snapshots on the same disk retain up to 14 snapshot dates, rather than guaranteeing deletion after 14 calendar days. Provider backups and operational-log retention must be confirmed. Removing a record from this app does not remove a bill already saved in QuickBooks.
Security
The hosted app requires a private password and uses HTTPS, secure session cookies, request checks and login throttling. Connection tokens and submission history are encrypted; the encryption key is configured separately in Render. These controls do not guarantee absolute security. Multi-factor authentication, staff accounts and independent off-site backup export are not features of this app.
Your rights and complaints
Depending on the circumstances and lawful basis, individuals may request access, correction, erasure, restriction or portability of their information. You may object to processing based on legitimate interests. Email rachel@kingsaccountancy.uk to make a request or complaint. Requests concerning a client-controlled accounting record may need to be referred to that client. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.
Changes
The notice should be reviewed when the app’s features, providers, purposes or data practices change. Draft prepared 27 October 2026; it is not an approved or effective production privacy notice.