Privacy Policy

This policy explains what data we collect, why we collect it, and what we do with it. We've tried to keep it readable — no walls of legalese.

When we say "Company", "we", "our", or "us", we're referring to Double Three Digital Limited, a company registered in Scotland. We are the data controller for the personal data described in this policy.

When we say "Services", we mean ClearingHouse and any related services available at clearinghouse.app.

What We Collect and Why

Account information

When you sign up, we collect your name, email address, and a password. We use this to create your account, authenticate you, and send you important emails about the Services (such as billing, security, or connection issues).

If you enable two-factor authentication, we store an encrypted secret and recovery codes to verify your identity.

Business information

We store your business name to identify your business within ClearingHouse.

Connected account data

When you connect your payment processor (e.g. Stripe) and accounting software (e.g. FreeAgent), we store:

• Account identifiers — your account ID and display name from each provider, so we know where to sync data.
• OAuth credentials — access and refresh tokens for your accounting software, encrypted at rest. These allow us to sync data on your behalf. Stripe manages its own connection credentials server-side.

Financial transaction data

To perform the service, we receive and temporarily process financial data from your payment processor, including invoices, payments, refunds, fees, and payouts. We store payout records (amounts, currency, status, and the last four digits of the destination bank account) and use this data to create the corresponding records in your accounting software.

Session and security data

When you use ClearingHouse, we store your IP address and user agent as part of your session. Sessions are stored in our database and are used for authentication and security. Sessions expire after 120 minutes of inactivity.

Activity logs

We log sync activity (such as invoices created, payments explained, and payouts reconciled) to help you and us understand what ClearingHouse has done in your accounts. These logs are automatically deleted after 90 days.

Webhook data

We receive webhook events from your payment processor to keep your data in sync. Webhook payloads are stored temporarily and automatically deleted after 7 days.

What We Don't Collect

We don't collect or store your payment card details. Subscription billing is handled entirely by Stripe.

We don't sell, rent, or trade your personal data to anyone. We never have and never will.

Website Analytics

We use Fathom Analytics across the entire site. Fathom doesn't use cookies, doesn't collect personal data, and is fully GDPR compliant. No data about your visit is shared with third parties.

Cookies

We use a session cookie to keep you logged in and a CSRF token cookie to prevent cross-site request forgery. That's it — no tracking cookies, no advertising cookies.

Third-Party Services

We share data with the following third parties, only as necessary to provide the Services:

• Hetzner — our hosting provider. Your data is stored on servers located in Nuremberg, Germany.
• Laravel Forge — server management platform used to provision and manage our infrastructure.
• Amazon Web Services (AWS) — we use S3 (EU West, London) for encrypted offsite backups.
• Stripe — we use Stripe to process your subscription payments. We also connect to your Stripe account to receive transaction data via their API and webhooks.
• FreeAgent — your accounting software. We create and update records in FreeAgent on your behalf. We also use FreeAgent as our own accounting software, where your billing data (such as invoices) is synced.
• Bento — for sending transactional emails (such as password resets).
• Fathom Analytics — for privacy-friendly website analytics.

We do not share your data with any other third parties. If this changes, we will update this policy and notify you.

Data Security

We take the security of your data seriously:

• All connections to ClearingHouse are encrypted with TLS (HTTPS).
• OAuth credentials and two-factor secrets are encrypted at rest.
• Passwords are hashed with bcrypt.
• Session cookies are HttpOnly and Secure.

For more detail, see our Security page.

Data Retention

• Account data — retained for as long as your account is active.
• Activity logs — automatically deleted after 90 days.
• Webhook data — automatically deleted after 7 days.
• Sessions — expire after 120 minutes of inactivity.

If you delete your account, we delete your personal data, connection credentials, and system mappings. Backups containing your data may persist for up to 30 days, after which they are permanently removed. Anonymised, aggregated data (such as usage statistics) may be retained.

Data already synced to your accounting software and payment processor will remain in those systems — we do not automatically remove it as part of account deletion.

Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following bases:

• Contract — processing your account information and connected account data is necessary to provide the Services you've signed up for.
• Legitimate interest — we log activity and session data to maintain security, debug issues, and improve the Services.
• Legal obligation — we may retain certain data where required by law (such as billing records).

Your Rights

Under UK GDPR, you have the right to:

• Access your personal data and request a copy of it.
• Correct any inaccurate personal data we hold about you.
• Delete your personal data — you can do this at any time from your account settings.
• Object to our processing of your personal data.
• Restrict the processing of your personal data.
• Port your data — request your data in a portable format.

To exercise any of these rights, email us at [email protected].

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority.

Data Processing Agreement

If you are using ClearingHouse on behalf of your clients (for example, as an accountant or bookkeeper), you may be acting as a data controller and we as a data processor. Our Data Processing Agreement sets out our obligations in that relationship.

International Data Transfers

Our servers are hosted on Hetzner in Nuremberg, Germany. Some of the third-party services we use may process data outside the UK, in which case appropriate safeguards (such as Standard Contractual Clauses) are in place.

Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we'll notify you by email. Continued use of the Services after changes take effect constitutes your acceptance of the updated policy.

Contact

If you have questions about this privacy policy or how we handle your data, email us at [email protected].