Data processing
Last updated 19 October 2026.
These terms apply when a practice uses RecordsIn to hold records about its clients. They form part of the RecordsIn terms.
Who is who
The practice is the controller of its client records. RecordsIn is the processor. The processor is the business named on the About and legal page, trading as RecordsIn.
What is processed
Client names, email addresses and phone numbers, income type and MTD start dates, the checklist for each quarter, emails clients send to RecordsIn addresses and their attachments (such as bank statements, invoices and receipts), and the history of emails sent and received. The people concerned are the practice's clients and anyone who emails a RecordsIn address for the practice.
Why
RecordsIn processes client records only to provide the service: importing clients, sending checklists and reminders for the practice, receiving and filing replies, showing them in the app, sending the practice its digest, and preparing the ZIP export. RecordsIn does not file to HMRC and does not use client records for anything else.
Instructions
RecordsIn acts only on the practice's instructions. These terms and the practice's use of the app are those instructions. If RecordsIn thinks an instruction breaks data protection law, it will tell the practice. If the law requires other processing, RecordsIn will tell the practice first unless the law forbids it.
Confidentiality
Only the person who runs RecordsIn can access client records, and only to provide support, fix a fault, or when the practice asks or the law requires it. That person is bound by confidentiality.
Security
Data is encrypted in transit and at rest. Client files are stored in Cloudflare R2 and the database in Cloudflare D1, both with EU jurisdiction. Sign-in uses one-time email links that expire after 15 minutes. Files can only be downloaded by a signed-in user of that practice.
Sub-processor
RecordsIn uses Cloudflare, Inc. for hosting, storage, queues and email. Cloudflare's own sub-processors are listed at cloudflare.com/gdpr/subprocessors. Cloudflare's network can process data outside the UK while it handles a request or an email. Those transfers are covered by the UK Extension to the EU-US Data Privacy Framework and by Cloudflare's data processing addendum, which includes the EU standard contractual clauses with the UK Addendum. RecordsIn will email the practice at least 30 days before adding or replacing a sub-processor. The practice can object, and if RecordsIn cannot resolve it the practice can cancel and export its data.
Requests from clients
The practice can find, export, correct and delete a client's records in the app. If it needs more help answering a client's request, RecordsIn will help.
Breaches
RecordsIn will tell the practice without undue delay after becoming aware of a breach affecting its client records, and say what it knows and what it is doing. RecordsIn will also help with the practice's own security, breach and impact assessment duties.
Deletion
When the practice deletes a client, RecordsIn deletes that client's files and records, and that client's unmatched mail and files. RecordsIn keeps one audit row with the client id only. When the practice deletes an unmatched email, RecordsIn deletes its body, sender, subject and files. When the practice deletes a file, RecordsIn deletes the file. Its name stays in the client's history until the client is deleted.
When an account ends
An account that never starts a plan is deleted 30 days after signup. RecordsIn emails a warning 7 days before.
While Stripe is retrying a failed payment, the practice is read only. The 30 days before deletion do not start while Stripe retries. Update the card in the billing portal.
Once the subscription is unpaid, or it ends before the first payment, the practice is read only for 30 days and can download the ZIP. A founding place ends 12 months after the account opens. RecordsIn emails a warning 14 days before. From that date the practice is read only for 30 days and can download the ZIP. A founding place cannot be bought again.
During those 30 days the practice can start Solo or Practice from the billing page to keep the account and its records. A practice that starts Solo or Practice again is charged straight away, with no new trial. After 30 days, RecordsIn deletes the files and the client records.
Deleted database rows can stay in Cloudflare backups for up to 30 days.
How long files are kept
While the account is active, files and chase history stay until the practice deletes them. The practice can delete a file or a client, or download a ZIP, at any time.
Audits
RecordsIn will give the practice the information it needs to show these terms are met, and will answer reasonable written questions. An audit beyond that needs 30 days' notice and is at the practice's cost.
Duration
These terms last as long as the practice has an account, and until its data is deleted.
Questions: hello@recordsin.co.uk.