Plain-English summary
We collect the minimum we need to run your account, file your taxes, and match you with the right accountant.
We never sell your data. We never share it for advertising. The only people who see your books are: you, the accountant you're assigned to, and a small on-call support team – who only see specific records when you raise a ticket and only for as long as it takes to resolve it.
We keep records for six years (HMRC's rule), then destroy them. You can export everything any time. You can ask us to delete anything we don't legally have to keep.
Who we are
Qantori (a trading name of Vasil Kacarov, operating as a sole trader in the United Kingdom) of 1 Knowsley Road, Norwich NR3 4PR is the data controller for information you give us directly.
Our Data Protection Officer is Vasil Kacarov, reachable at info@qantori.com.
Data we collect
We collect three kinds of data:
1. Identity & account data
Name, email, phone number, business trading name, entity type, UTR, VRN, Companies House number, passport or driving licence (for AML), proof of address.
2. Financial & transactional data
Bank transactions (read-only via Open Banking), invoices, receipts, payroll records, VAT returns, tax computations, filings with HMRC and Companies House.
3. Usage data
How you use the app: pages visited, features used, device type, browser, IP address (for security). We do not use third-party advertising trackers, session-replay tools, or any analytics that send identifiable data off-platform.
Why we process it
Under UK GDPR, we process your data on the following lawful bases:
- Contract– to deliver the accounting services you've signed up for
- Legal obligation– AML, HMRC record-keeping, Companies House filings
- Legitimate interests– fraud prevention, service improvement, security (always balanced against your rights, and you can object)
- Consent– marketing emails (opt-in; opt out any time in your account settings)
How long we keep it
| Data category | Retention | Why |
|---|---|---|
| Financial records | 6 years after filing | HMRC statutory requirement |
| AML identity verification | 5 years after relationship ends | Money Laundering Regulations 2017 |
| Account & profile data | Duration of account + 30 days | To enable re-activation if you return |
| Messages with your accountant | 6 years | Audit trail for professional advice given |
| Marketing preferences | Until you opt out | Honouring consent choices |
| Security & access logs | 13 months | Incident response & forensics |
Your rights
Under UK GDPR you have the right to: access your data, correct it, ask us to delete it, restrict how we process it, object to processing, and receive a portable copy. To exercise any of these, email info@qantori.com or use the Download / Delete my data controls in your account settings.
We don't charge for access requests. We respond within 30 days (usually faster).
Contact & complaints
Questions or concerns: info@qantori.com.
If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.ukor on 0303 123 1113. We'd rather hear from you first so we can fix whatever's gone wrong.