Welcome to TunedBooks. We are committed to protecting your privacy and the security of your personal and business information. This Privacy Policy applies to all users globally and complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Nigeria Data Protection Act (NDPA) 2023, and applicable international data protection laws.

Information You Provide

• Account information: full name, email address, phone number
• Business details: business name, address, business type and sector
• Tax identifiers: VAT Registration Number (VRN), National Insurance Number (NINO), Tax Identification Number (TIN)
• Business records: transactions, sales, purchases, expenses, customer data, inventory, financial summaries
• Payment information: processed by Apple, Google, Paystack, or Stripe — we do NOT store full card details
• Communications: messages sent through customer support, feedback, and survey responses

Information Automatically Collected

• Usage data: log-in times, features used, pages visited, time spent in app
• Device information: device type, operating system, unique device identifiers, IP address
• HMRC OAuth tokens: secure access tokens allowing us to submit to HMRC on your behalf (never your HMRC password)
• Fraud prevention data: device ID, OS version, screen size, timezone, local IP address — required by UK law (Finance Act 2020) to be submitted to HMRC with every API call

We process your personal data under the following lawful bases:

Specifically We Use Your Data To

• Create and manage your account
• Provide business management, invoicing, and record-keeping features
• Submit Making Tax Digital VAT returns and income tax summaries to HMRC on your behalf (UK users)
• Generate FIRS-compliant e-invoices (Nigerian users)
• Process your subscription payments
• Send important service updates, security alerts, and notifications
• Analyse app usage to improve features and fix technical issues
• Detect and prevent fraud and security threats
• Comply with legal obligations in applicable jurisdictions

When you connect TunedBooks to HMRC for Making Tax Digital compliance, the following applies in addition to the rest of this policy:

What We Do

• Submit VAT returns and Income Tax quarterly summaries to HMRC on your behalf via OAuth 2.0
• Store a secure OAuth 2.0 access token so you stay connected to HMRC between sessions
• Send fraud prevention headers to HMRC as required by the Finance Act 2020
• Maintain a secure audit log of all HMRC submissions in your account

What We Never Do

• Store your HMRC username or password — ever
• Access more HMRC data than you explicitly authorise via the OAuth consent screen
• Submit returns to HMRC without your explicit confirmation in the app

We Share Data Only With

• HMRC — tax submissions made on your behalf with your explicit authorisation (UK users)
• FIRS — via official e-invoicing systems where applicable (Nigerian users)
• Google/Firebase — cloud infrastructure provider under a Data Processing Agreement (DPA)
• Apple/Google — subscription payment processing under their own privacy policies
• Paystack — payment processing for Nigerian users under a DPA
• Stripe — payment processing for web/global users under a DPA
• Legal authorities — only when required by UK, Nigerian, or other applicable law, with notice to you where permitted

Your business data is highly sensitive. We implement industry-leading security measures:

Retention Periods

• Active account data: retained while your account is active
• Financial and transaction records: 7 years after account closure (UK and Nigerian tax law requirement)
• HMRC submission audit logs: 7 years (HMRC requirement)
• HMRC OAuth tokens: until you disconnect or your account is deleted
• Support communications: 3 years
• Marketing consent records: until withdrawn or 2 years of inactivity
• Deleted accounts: personal profile data deleted within 30 days; financial records retained 7 years for legal compliance

Depending on your location, you have the following rights over your personal data:

UK Users — Rights Under UK GDPR

• Right to access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion (Settings → Delete Account)
• Right to data portability — export your data in machine-readable format (Settings → Export Data)
• Right to object — object to processing for direct marketing
• Right to restrict processing — limit how we use your data in certain circumstances
• Right to withdraw consent — disconnect HMRC at any time (Settings → HMRC Connection → Disconnect)
• Right to lodge a complaint with the ICO: ico.org.uk | 0303 123 1113

Nigerian Users — Rights Under NDPA 2023

• Right to access your personal data
• Right to correction of inaccurate data
• Right to deletion of your data (Settings → Delete Account)
• Right to data portability (Settings → Export Data)
• Right to object to processing
• Right to lodge a complaint with the NDPC: ndpc.gov.ng

To exercise any right, contact us at privacy@tunedbooks.online. We will respond within 30 days.

TunedBooks uses Google Cloud Platform (Firebase) infrastructure. Your data may be processed in the following locations:

Data Processing Locations

• United States — Google Cloud us-central1 (primary server location)
• Nigeria — NDPC-compliant processing for Nigerian users

Types of Cookies We Use

• Essential cookies: required for login, security, and core functionality
• Performance cookies: track feature usage and app performance to improve the service
• Functional cookies: remember your preferences such as dark mode and language

We do not use advertising or third-party tracking cookies. You can manage cookies in Settings → Privacy or in your device/browser settings.

In the event of a personal data breach, we will:

For UK Users

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware
• Notify HMRC within 72 hours via the HMRC developer support portal
• Notify affected users without undue delay where the breach poses a high risk to your rights

For Nigerian Users

• Notify the Nigeria Data Protection Commission (NDPC) within 72 hours as required by NDPA 2023
• Notify affected users as required by law

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email and in-app notification at least 30 days in advance. Minor changes will be reflected in the "Last Updated" date above. Continued use of TunedBooks after the effective date constitutes acceptance.