Privacy notice
You hand us bank statements and receipts. This page says exactly what happens to them, in plain words.
Who is responsible
shoebox.club is a service of AMI Financial Solutions Limited, a company registered in Scotland (SC533818) at 1 Ravenstone Drive, Giffnock, Glasgow G46 6AL, which is the data controller for the personal data described here. Paul Padaruth runs the service. Contact: hello@shoebox.club.
What we hold
| What | Why | How long |
|---|---|---|
| Your email address and a password (stored hashed) | To sign you in and to email you when a run finishes | Until you delete your account |
| The name, number and year end of your club or charity, and the filing details you type in (address, trustees, purposes) | To prepare the accounts and fill the regulator's forms | Until you delete the organisation |
| The documents you upload: bank statements, receipts, invoices, cashbook photos | To read the transactions and build the accounts | Until you delete them or the organisation; you can delete everything with one click |
| The transactions, categories and figures derived from them, and the pack we produce | So you can review, correct and download them, and so next year starts from this year | Until you delete the organisation |
| A log of what each run did, and the automated reviewer's notes on it | To find and fix faults | Until you delete the organisation |
| If you create an examiner's link: the examiner's name and email address you type in, and your message to them | To send the examiner a one-time code so only they can open the link | Until you delete the organisation; switching the link off stops it working but keeps the record of who was given access |
| An anonymous visit count: time, page, the referring site's name, the tag in the link you arrived by (for example from an advert), the browser type and screen size | To see whether the site is reaching people and to tell real visits from automated ones | Indefinitely; it is not linked to you or your account |
We do not use cookies and we do not use any analytics or advertising service. Two things are kept in your browser's own storage. The app keeps your sign-in session and which step you were on, so it works. And while Shoebox is in pilot, every page keeps two small flags: the time this browser last counted a visit to the page, so a reload is not counted twice, and a yes-or-no marker that this browser has been here before. Neither holds an identifier and neither is sent anywhere except as that yes-or-no in the visit count. They are there because we are testing: they let us tell a returning person from an automated scanner, and they will go when the pilot ends.
Where it is and who processes it
- Storage and database: Supabase, in its London (UK) region. Your documents are stored in a private bucket that only you, and our processing service, can read.
- Reading documents: the pages are read on our processing server in the UK. Scanned or photographed pages, and receipts, are sent as images to Anthropic's API to be read, and a typed PDF is sent the same way if its text cannot be read reliably. For every run, the transaction descriptions and amounts, your organisation's name and purposes, and a summary of what the run did are also sent to Anthropic's API, to place each line under the regulator's headings, to draft the trustees' report wording and to review the run. Anthropic processes it in the United States, so for that step your data leaves the UK; the transfer is made under Anthropic's commercial data processing terms, and under those terms none of that content is used to train models.
- Email: the sign-in codes and sign-up emails, and the examiner's one-time codes, are sent by Supabase's own email service. The emails about your runs are sent by Resend from its Ireland (EU) region.
- Website: Netlify hosts the site pages. It does not see your documents.
Nobody else sees your documents. We do not sell, share or publish anything. If you create an examiner's link, your examiner sees your organisation's figures and documents through that link until you switch it off.
During the pilot
While Shoebox is in pilot, the person running it may open a run's log, figures and documents to find out why something read wrongly, and an automated agent may do the same. That is the only reason either looks, and when the automated agent is asked to look, a record of the case is kept.
The lawful basis
Processing your account details and documents is necessary to provide the service you asked for. Emailing you about a run you started, or that you signed up and never started, is part of that service; the one-off emails to pilot testers are sent on the basis of our legitimate interest in running the pilot, and every one says how to stop them. The documents you upload may contain other people's names, for example on bank lines; you are responsible for being allowed to use them for your organisation's accounts, which is the same responsibility you already have as its treasurer.
Your rights
You can see, correct and download everything we hold about your organisation from inside the app at any time. You can delete any document, or the whole organisation with everything under it, from the app; deletion is immediate in the live system and removes the stored files as well as the records; our database provider keeps rolling backups for seven days, so a deleted copy can remain in a backup for up to a week before it is gone for good. Working copies of page text that our reading service keeps on its own machine to avoid re-reading a page are cleared within 30 days, and its operating log, which holds run stages and file names but not your documents' contents, is kept for fault-finding only. To delete your account itself, or to ask anything about your data, email hello@shoebox.club. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this notice changes in a way that matters, the date at the top changes and the change is listed here.
- 25 October 2026: said which emails are sent by Supabase and which by Resend; said that Anthropic processes data in the United States; listed the examiner's details and the link tag in what we hold; described the two visit-count flags kept in the browser during the pilot; said that backups keep a deleted copy for up to seven days; dropped a promise to tell signed-in users of changes, which the app did not do.