Privacy policy

This policy explains what personal data Mintyai collects, why, who we share it with, how long we keep it and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Mintyai is a service operated by Metamindz Limited, a company registered in England and Wales (company number 11831397), registered office 71-75 Shelton Street, London, WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under number ZB187231.

For data about you as a Mintyai account holder, website visitor or enquirer, Metamindz Limited is the controller.

For the bookkeeping data you put into Mintyai (receipts, invoices and FreeAgent bank transactions), which can include personal data about other people such as suppliers or employees named on a receipt, you are the controller and we act as your processor. We only use that data to provide the service to you, as set out in the data processing section of our terms of service.

Contact us about privacy at privacy@mintyai.app.

What we collect

Account and contact details

• Your name, email address and password (passwords are handled by our authentication provider and stored only as a secure hash).
• Information you give us when you use the contact form or, in the past, requested an invite, such as your company name and message.
• Additional email addresses you add and confirm for sending receipts.

FreeAgent data

When you connect FreeAgent, we receive an access token from FreeAgent (we never see your FreeAgent password) and use it to read:

• your bank account names and currencies;
• outgoing bank transactions that need explaining (date, amount, description, existing explanation and category);
• your expense category list.

When you approve a match, we write a bank explanation to FreeAgent with the explanation text, category, VAT rate and the receipt file attached.

Receipts and invoices

• Files you upload or email to your Mintyai inbox address, and the email they arrived in (sender, recipient, subject, and the body if there is no attachment).
• Details our AI extracts from them: amounts, VAT, dates, supplier, currency, invoice number, a short description and the full text of the document.
• Your matching decisions, and the categories you choose for each supplier, so suggestions follow your choices.

Billing

Subscriptions are paid through Stripe. We store your Stripe customer and subscription identifiers and plan status. Card details go directly to Stripe and are never seen or stored by us.

Technical and usage data

• Server and security logs (IP address, browser type, time of request), used to run and protect the service, including rate limiting of sign-in attempts.
• Error reports when something goes wrong, sent to our error-monitoring provider without cookies or request headers.
• With your consent only: analytics about which pages are used (see cookies) and screen recordings of sessions for diagnosing problems, with all text masked and all images and media blocked.

Why we use it and our lawful basis

AI processing

Receipts are sent to OpenAI's API to extract their details and to compare suppliers. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models. Mintyai suggests matches, categories and VAT rates but never writes anything to FreeAgent until you approve it, so no decision with legal or similarly significant effect is made about you by automated means alone.

Who we share data with

We do not sell your data. We share it only with:

• Service providers (sub-processors) who host and run parts of Mintyai for us under contracts that require them to protect it. The full list, with what each does and where, is on our sub-processors page.
• FreeAgent, as you instruct us when you connect your account and approve matches.
• Professional advisers, regulators, courts or law enforcement where the law requires it or to establish or defend legal claims.
• A buyer or successor if our business or assets are sold or restructured, in which case this policy will continue to apply to your data.

International transfers

Our database and file storage are hosted in the European Union (Ireland), and error reports are stored in the EU (Germany). Some providers, such as OpenAI, Stripe, Google and our hosting and email providers, are based in or may process data in the United States. Where data leaves the UK, we rely on UK adequacy regulations or the safeguards those providers offer under UK law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework.

How long we keep data

• Account, receipts, transactions and matches: while your account is open. When you close your account we delete them within 90 days.
• FreeAgent access tokens: until you disconnect FreeAgent or close your account.
• Billing records: six years after the end of the financial year they relate to, as required for UK tax purposes.
• Security and server logs, error reports: for a limited period set by each provider, after which they are deleted automatically.
• Invite and contact form enquiries: up to two years after our last contact, unless you become a customer.
• Backups: overwritten on our hosting provider's rolling schedule, so deleted data can remain in backups for a short time before it is gone.

How we protect data

• All data travels over HTTPS and is encrypted at rest by our hosting providers.
• FreeAgent access tokens are kept in a separate secrets manager, not in our main database.
• Each account can only access its own data, enforced in the database itself.
• Uploaded files are checked by content and stored in a private folder for each account.
• Administrator access requires two-factor authentication, and administrator actions are recorded in an audit log.

No system is perfectly secure. If a breach affects your personal data and is likely to put you at risk, we will tell you and the ICO as the law requires.

Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data (for example, by closing your account);
• restrict or object to our use of it, including objecting to processing based on legitimate interests;
• data portability: receive data you gave us in a machine-readable format;
• withdraw consent at any time, for analytics (via Cookie settings) or marketing (in Settings), without affecting what happened before.

You can disconnect FreeAgent at any time from FreeAgent's own settings, which stops our access straight away.

To use any of these rights, email privacy@mintyai.app. We will respond within one month. If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

If a receipt you sent us contains someone else's personal data, that person should contact you, as the controller of that data. We will help you respond.

Cookies

We use strictly necessary cookies to keep you signed in and secure, and analytics cookies only if you accept them. Details are in our cookie policy, and you can change your choice at any time using Cookie settings in the footer.

Children

Mintyai is a business service and is not intended for anyone under 18.

Changes to this policy

We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will also email account holders before it takes effect.