Privacy Policy

1. Who this covers

This policy covers two groups of people: firm users (the accountants and staff who sign up for and use FileChaser directly) and clients (the firm's own clients, whose details a firm adds to FileChaser so we can chase them on the firm's behalf). For a client's data, the firm is the data controller and FileChaser processes it on the firm's instructions - see our Terms of Service.

2. What we collect

For firm users: name, email address, hashed password, and role within the firm.

For clients (added by a firm): name, email address, and phone number if provided; the content of messages exchanged during a chase; and any documents uploaded in response to a chase request (which may include financial documents such as bank statements, receipts, or tax records).

We do not collect payment card details directly - subscription payments are handled entirely by Stripe.

3. What we use it for

• drafting and sending chase reminders by email and SMS on a firm's behalf;
• classifying and responding to client replies, and matching uploaded documents to outstanding checklist items;
• operating firm user accounts, authentication, and team/permission management;
• processing subscription payments; and
• keeping an audit trail of automated and human actions taken on a firm's account.

4. Who else sees it (subprocessors)

We share data with the following third parties, only as needed to provide the service:

• Anthropic (Claude API) - to draft chase messages and classify client replies. Message and reply text is sent to Anthropic for this purpose.
• Postmark - to deliver email.
• Twilio - to deliver SMS.
• Stripe - to process subscription payments. We never see or store full card details.
• Our cloud storage provider (S3-compatible object storage) - to store uploaded documents.
• Our hosting provider - runs the application and the database, so everything described above is stored on their infrastructure.
• Sentry - to record application errors so we can fix them. Receives technical diagnostics, your IP address, and whatever data happens to be in scope when something breaks.
• Slack or Microsoft Teams - only if your firm connects one. Client names and engagement names are then posted into the channel your firm chooses.

Several of these providers are based outside the UK. Where personal data is transferred internationally, we rely on the safeguards required by UK data protection law (such as Standard Contractual Clauses) - [specific mechanism per provider to be confirmed and documented here].

5. How long we keep it

We retain firm and client data for as long as the firm's account is active, so that engagement history and audit trails remain available. [A specific post-cancellation deletion timeline is not yet defined and should be added here.]

6. Security

Passwords are hashed, never stored in plain text. Uploaded files are validated for type and size and checked against their actual content before being stored. Access to a firm's data within FileChaser is restricted to that firm's own authenticated users. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to us.

7. Your rights

Under UK data protection law you have the right to request access to, correction of, or deletion of your personal data, to object to certain processing, and to complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled. If you are a client of a firm using FileChaser rather than a firm user yourself, please contact that firm directly in the first instance, since they control your data.

To make a request, email us at the address in section 9. We will respond within one month, as UK data protection law requires. If a request is complex we may extend that, and we will tell you why within the first month rather than afterwards.

When we delete your data, we delete it from our own database and document storage straight away. Copies may persist for a short time in the systems of the providers listed in section 4 - an email we have already handed to Postmark, for example - governed by each provider's own retention period rather than ours. We do not use those copies for anything.

8. Cookies

We set two strictly-necessary cookies: one that keeps firm users logged in, and one that lasts a few minutes during two-factor sign-in. We also store your light/dark theme choice in your browser's local storage, so the site looks the same next time you visit. That is everything. We do not use advertising or analytics tracking cookies, and nothing here tracks you across other websites.

9. Contact

Questions about this policy, or a data rights request: support@docchaser.co.uk.