1Who we are
1.1Reckon is operated by Oxus Technologies Ltd, registered in Ireland under CRO number 818468, registered office Greenhills Road, Dublin 12, D12 DX80.
1.2This policy explains what personal data we handle when you use Reckon, why we handle it, and what you can ask us to do about it. It sits alongside our Terms of Service.
1.3Questions about anything here go to info@oxus.ie.
1.4We have not appointed a Data Protection Officer, as we are not required to. Privacy questions are handled by the address above.
2Controller or processor
2.1Which role we play depends on the data, and the distinction matters for your rights.
| Data | Who decides | Our role |
|---|---|---|
| Records you keep in Reckon — cash reports, sales, drivers, expenses, till data | Your business | Processor, acting on your instructions |
| User accounts, billing records, support correspondence, security logs | Us | Controller |
| The reckon.ie website | Us | Controller |
2.2Where we act as processor, we process personal data only on your documented instructions, keep it confidential, and help you meet your own obligations — including responding to requests from the people the data is about.
2.3If you need a separate written data processing agreement for your records, ask us and we will provide one.
3What we process
| Category | What it includes |
|---|---|
| Account | Name, work email address, role, which organisation and shops you belong to, sign-in timestamps |
| Staff and driver records | Driver names, shifts and hours worked, pay and weekly invoice figures, entries recorded against named employees |
| Operational records | Daily cash reports, float and denomination counts, sales figures, voids, expenses, supplier records and receipt images |
| Till data | Transaction records from your point-of-sale system, including — where your till holds them — an end customer's name and telephone number against an order |
| Billing | Billing contact, subscription and invoice history, VAT details. Card numbers go directly to Stripe; we never see or store them |
| Technical | IP address, browser type, request logs, audit records of who changed which report and when |
| Support | Emails and bug reports you send us, and anything you attach to them |
3.1We do not ask for and do not want special category data — health, biometrics, trade union membership and the like. Please do not put it into Reckon.
4Where it comes from
- From you — when you create an account, enter a day’s figures, add a driver or upload a receipt.
- From your point-of-sale system — through the connector you install on your own back-office machine.
- From your colleagues — an owner or manager who invites you and sets your role.
- Automatically — technical and audit records generated as you use the Service.
- From Stripe — confirmation that a payment succeeded or failed, and the status of your subscription.
5Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service to your organisation | Performance of a contract; and, for data you control, your instructions as controller |
| Creating and managing accounts and access | Performance of a contract |
| Taking payment and issuing invoices | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Support, and investigating problems you report | Performance of a contract; legitimate interests in running a working service |
| Security, audit trails, preventing abuse | Legitimate interests in protecting the Service and its users |
| Service notices — outages, changes to terms, billing | Performance of a contract |
| Product news and marketing email | Consent, which you can withdraw at any time |
5.1Where we rely on legitimate interests, we have considered the effect on the people concerned and are satisfied our interest does not override their rights. Ask us and we will explain the assessment.
6Data from your till system
6.1The connector runs on your premises, reads your point-of-sale database locally, and sends the results to Reckon over an encrypted connection. It reads; it does not write to your till system.
6.2Some of what it sends is personal data. Transaction records can carry a customer’s name and telephone number where the till captured them for a delivery, and shift and exception records carry employee names.
6.3We hold that data on your behalf so it can be looked up against an order — a card dispute, a complaint, a delivery query. We do not use it for anything else, and we never contact your customers.
6.4You are the controller of this data. Making sure your own privacy notice covers it, and that you have a basis to record it, is your responsibility as the business that took the order.
6.5If you would rather Reckon did not store customer names and telephone numbers at all, tell us and we will disable their capture for your organisation.
7Receipt scanning and AI
7.1Reckon can read a photographed supplier receipt and pull out the figures, saving them being typed. This feature is optional and is only active where it has been enabled for your organisation.
7.2When it runs, the receipt image is sent to Anthropic for text extraction and the extracted figures are returned to Reckon. Nothing else in your account is sent.
7.3Under our commercial terms with Anthropic, content submitted through their API is not used to train their models.
7.4Extracted figures are a starting point, not a verified record. They are presented for you to check before they are saved.
7.5If you would prefer no receipt data left the platform, ask us to turn the feature off for your organisation and receipts will be entered by hand instead.
8Who else processes it
8.1We use a small number of providers to run Reckon. Each is bound by a contract that limits them to processing data on our instructions.
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All records held in Reckon, including receipt images | EU — Ireland |
| Vercel | Application hosting and delivery | Requests, IP addresses, server logs | EU / US |
| Stripe | Subscriptions and card payments | Billing contact, invoices, card data held by Stripe | EU / US |
| Resend | Transactional and notification email | Recipient address, message content | EU / US |
| Anthropic | Receipt text extraction, when enabled | Receipt images submitted for scanning | US |
8.2Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses together with additional safeguards. A copy of the relevant terms is available on request.
8.3We will tell you before adding a new processor that handles Customer Data, so you can object if you need to.
8.4We may also disclose data where the law requires it, to professional advisers under a duty of confidence, or to a successor if the business is sold — in which case you will be told beforehand.
9Where it is stored
9.1The Reckon database and file storage are hosted in the European Union, in the Ireland region. Your records do not leave the EU in the ordinary course of the Service.
9.2The exceptions are the supporting services in section 8 — hosting, email, payments and optional receipt scanning — which may process limited data outside the EEA under the safeguards described there.
10How long we keep it
| Data | Kept for |
|---|---|
| Records held in Reckon | For as long as your subscription runs; deleted or anonymised within 90 days of it ending |
| User accounts | Until removed by your organisation, or 30 days after the subscription ends |
| Invoices and accounting records | 6 years, as Irish tax law requires |
| Security and audit logs | 12 months |
| Support correspondence | 24 months from the last message |
| Backups | Aged out on their normal cycle, no more than 35 days behind |
10.1Audit records of who changed a cash report are kept for the life of that report, because their whole purpose is to show how a figure came to be what it is.
10.2Ask us to delete sooner and we will, unless we are required to keep something. Deletion is irreversible.
11How we protect it
- Traffic is encrypted in transit; the database and stored files are encrypted at rest.
- Access is scoped by organisation and by shop, enforced in the application and backed by row-level security in the database.
- Connector and API keys are stored only as hashes; the key itself is shown once, at creation, and can be revoked at any time.
- Passwords are handled by our authentication provider and are never stored by us in readable form.
- Changes to a signed-off cash report are recorded with who made them and when.
- Access to production data is limited to those who need it to run and support the Service.
11.1No system is perfectly secure. If a breach affects your personal data and is likely to present a risk, we will notify the Data Protection Commission within 72 hours of becoming aware of it, and tell you without undue delay.
11.2Report a suspected vulnerability to info@oxus.ie. We will acknowledge it and will not pursue anyone who reports in good faith and does not access data beyond what is needed to demonstrate the issue.
12Your rights
Under the GDPR you can ask for:
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate.
- Erasure — deletion, where we have no overriding reason to keep it.
- Restriction — that we pause processing while a dispute is resolved.
- Portability — your data in a structured, machine-readable format.
- Objection — to processing we base on legitimate interests, or to marketing at any time.
- Withdrawal of consent — where consent was the basis, without affecting what came before.
12.1Write to info@oxus.ie. We respond within one month, and will say so if a complex request needs longer.
12.2If your request concerns records held by a business that uses Reckon — for example an order you placed with a shop — that business is the controller, and we will pass your request on to them and help them answer it.
12.3Exercising these rights is free. We may charge a reasonable fee only for requests that are manifestly unfounded or repetitive.
13Cookies
13.1Reckon uses strictly necessary cookies only — the ones that keep you signed in and keep your session secure. They cannot be switched off without breaking sign-in, and they need no consent banner.
13.2We set no advertising cookies, run no third-party analytics, and do not track you across other websites.
13.3Some preferences — the shop you last had open, for instance — are kept in your own browser’s storage and never reach us.
14Automated decisions
14.1Reckon makes no automated decision that produces a legal or similarly significant effect on anyone, and does no profiling.
14.2It calculates and flags — an over or short outside tolerance, a day that has not been reconciled. Every figure is presented for a person to review, and a person decides what to do about it.
15Children
15.1Reckon is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 16.
15.2Where a shop employs someone under 18 and records their hours in Reckon, that record is employment data held by the employer as controller, and normal employment safeguards apply.
16Changes to this policy
16.1We update this policy when the Service changes. The version number and effective date at the top always tell you which version you are reading.
16.2Where a change materially affects how we handle personal data, we will give at least 30 days’ notice by email or in the application.
17Contact and complaints
17.1Privacy questions and rights requests: info@oxus.ie. By post: Oxus Technologies Ltd, Greenhills Road, Dublin 12, D12 DX80, Ireland.
17.2Please raise a concern with us first — most things are quickest to fix directly.
17.3You also have the right to complain to the Irish supervisory authority, the Data Protection Commission. Its current contact details are published at dataprotection.ie.
17.4If you are based in another EU country, you may complain to your own national supervisory authority instead.