Privacy Policy

Last updated: February 2026

1. Introduction

Prompt provides automated client reminder services for UK accounting practices. This policy explains how we collect, use, and protect personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using Prompt, you agree to the collection and use of information in accordance with this policy. We are committed to protecting your privacy and the privacy of the clients whose data is entrusted to us by your organisation.

2. Identity and Contact Details

Prompt is the trading name for this service. For the purposes of UK GDPR, we act as:

• Data controller for platform data — information collected when you create and manage your account, including your name, email address, and subscription details.
• Data processor for client data — personal data about your clients that you store within the platform. In this capacity, we process data only on your instructions.

For all privacy-related enquiries, contact us at: privacy@phasetwo.uk

3. Data We Collect

We collect and process the following categories of personal data:

Account Data

• Email address and name
• Organisation name and slug (your unique URL identifier)
• Role within your organisation (admin or member)
• Account creation and last active timestamps

Client Data (Stored by Accountants as Data Controllers)

• Client names and email addresses
• UTRs (Unique Taxpayer References)
• Company registration numbers
• Postal addresses
• Filing deadlines and accounting period dates
• VAT stagger group information
• Financial documents and records uploaded through the client portal — including but not limited to tax certificates (P60, P45), employer forms (P11D), HMRC tax calculations (SA302), bank statements, dividend vouchers, statutory accounts, VAT records, and Companies House filing documents

Billing Data

• Stripe handles all card details — we never see or store card numbers, CVV codes, or full payment card information
• We store your Stripe customer ID and subscription status
• Subscription plan, billing period, and trial end date

Authentication Data

• Magic link emails (one-time login links sent via Postmark)
• Session cookies for maintaining authenticated state

Usage Data

• Email send logs (timestamps, delivery status, email type)
• Audit trail entries for account and client changes
• Inbound email metadata (for reply tracking)

4. Our Role as Data Processor

When accountants store client PII within Prompt, we act as a data processor under Article 28 of UK GDPR. Accountants are the data controllers for their client data and are responsible for:

• Having a lawful basis to collect and store client personal data
• Ensuring clients are informed that their data may be used for automated reminders
• Maintaining appropriate data processing agreements with their own clients
• Ensuring the accuracy of client data entered into the platform

We process client data only as instructed — specifically for sending reminders, rendering email templates, delivering email communications, storing and managing financial documents and tax records uploaded via the accountant portal or received as email attachments, and providing accountants with access to those documents on behalf of their clients. We will not access, use, or disclose client data for any other purpose.

Where accountants share a portal link with their clients to facilitate document uploads, those clients interact directly with the Prompt platform as data subjects. In this context, accountants (as data controllers) are responsible for informing their clients that their personal data and financial documents will be processed by Prompt as a data processor. The upload portal does not require client account registration; clients access the portal via a time-limited token link provided by their accountant.

5. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 of UK GDPR:

• Contract performance (Article 6(1)(b)) — Processing your account data is necessary to provide the Prompt SaaS service and fulfil our contractual obligations to you.
• Legitimate interests (Article 6(1)(f)) — We process certain data for security purposes, fraud prevention, and service improvement where our legitimate interests are not overridden by your privacy rights.
• Legal obligation (Article 6(1)(c)) — We may process data where required by law, including for tax records, regulatory compliance, and responding to lawful requests from public authorities.

6. How We Use Your Data

We use personal data for the following processing activities:

• Account management and user authentication via secure magic links
• Email template rendering with client data placeholders (rich text editor output to email-safe HTML)
• Automated deadline-based reminder sending via configurable schedules
• Ad-hoc email sending on behalf of accountants to their clients
• Transactional email delivery via Postmark
• Subscription billing management via Stripe
• Audit trail recording for account and client changes
• Inbound email reply tracking and client record updates
• System notifications (trial reminders, payment failures) sent to account holders

7. Sub-processors

We engage the following sub-processors to provide the Prompt service. Each has been assessed for compliance with UK GDPR requirements. Google LLC, Microsoft Corporation, and Dropbox Inc. are optional sub-processors — they are only engaged when an accountant explicitly enables the corresponding document storage integration for their organisation.

8. International Data Transfers

Our sub-processors in the USA receive personal data as part of providing the Prompt service. These transfers are conducted under appropriate safeguards including:

• Standard Contractual Clauses (SCCs) as approved by the European Commission and adapted for UK use
• UK International Data Transfer Agreements (IDTAs) where applicable
• Each sub-processor's own UK GDPR-compliant data processing agreements

9. Data Retention

• Account and client data is retained for the duration of your active subscription
• On account termination or cancellation, all data is deleted within 30 days
• Email logs are retained for 12 months for compliance and audit purposes
• Stripe retains payment and billing data per their own retention policy, independent of our deletion
• Backup data may be retained for up to 7 days beyond deletion requests (database backup rotation)
• Financial documents and tax records uploaded to the platform are subject to statutory retention requirements. Under HMRC record-keeping obligations (TMA 1970 s12B for individuals; HMRC CH14600 for companies) and UK GDPR Article 17(3)(b), financial documents must be retained for a minimum of 5 years from the 31 January filing deadline (individual filings) or 6 years from the tax period end date (company filings). These documents will not be deleted within the applicable statutory retention period, even on account cancellation.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data:

• Row-level security (RLS) enforced at the database level for complete tenant isolation
• All connections encrypted via TLS in transit
• Organisation-scoped data access — no cross-tenant data visibility at any layer
• Authentication via secure magic links — no passwords are stored
• API routes protected by server-side session verification
• Environment secrets managed outside of application code

11. Multi-tenancy and Data Isolation

Prompt is a multi-tenant SaaS platform. Each organisation's data is completely isolated using database-level row-level security policies. No organisation can access, view, or influence another organisation's data under any circumstances.

Super-admin access for platform operations is restricted to authorised personnel and is audited. Super-admins can view organisation metadata (such as subscription status and user counts) but cannot access client data.

12. Your Rights Under UK GDPR

As a data subject, you have the following rights under UK GDPR:

• Right of access (Article 15) — You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17) — You may request deletion of your personal data, subject to legal retention obligations.
• Right to restrict processing (Article 18) — You may request that we limit how we use your personal data in certain circumstances.
• Right to data portability (Article 20) — You may request a machine-readable copy of your personal data for transfer to another controller.
• Right to object (Article 21) — You may object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@phasetwo.uk. We will respond within one month of receipt of your request.

13. Cookies

We use only strictly necessary cookies for authentication session management, provided by Supabase Auth. These cookies are required for the service to function and cannot be disabled while using the platform.

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookies for marketing purposes. No cookie consent banner is required under the Privacy and Electronic Communications Regulations 2003 (PECR) as these are strictly necessary cookies.

14. Children

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@phasetwo.uk and we will delete that information.

15. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us at privacy@phasetwo.uk in the first instance.

16. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated “Last updated” date. For significant changes, we will notify you via email to the address associated with your account. We encourage you to review this policy periodically.

Your continued use of Prompt after any changes constitutes acceptance of the updated policy.