Who looks after your data
Practice Bookkeeping is responsible for the personal information used to run this learning service. For privacy questions, access requests or complaints, contact hello@practicebookkeeping.com.
Information we use
- Account: your email address, authentication records and any optional name, experience or learning preferences you provide.
- Practice: exercise entries, drafts, completion history, hints used and progress needed to resume across devices.
- Subscriptions: Stripe customer and subscription references, payment status and billing periods. Stripe handles your payment details; our app does not receive or store your full card number.
- Support and security: messages you send us, technical request information such as IP addresses, and records needed to investigate errors, payment disputes or misuse.
We use account and practice information to provide the service you request (contract). We use limited technical and support information to keep the service reliable, prevent abuse and handle enquiries (legitimate interests). We retain records where required for legal or accounting obligations. Optional advertising measurement uses a separate marketing choice.
When you ask Penny
AI questions are optional. Your question, recent conversation, the current exercise and your entered work are sent to OpenAI to produce a reply. The app does not deliberately include your account email or profile name in that request, but anything you type into the question or exercise can be included. Please do not enter real customer records, bank details or confidential information.
The app keeps the conversation in this tab’s memory until you clear it or reload. We do not save a chat transcript in your progress database. We keep account-level request counters to limit misuse.
We request replies without saved response history. This does not mean zero retention: OpenAI may retain content in abuse-monitoring logs, ordinarily for up to 30 days, with exceptions for legal or safety needs. Its API data is not used for model training by default. See OpenAI’s data controls.
Penny can make mistakes. Exercise checks follow the app’s answer rules; Penny cannot award completion or professional status. You can use the prepared hints without sending an AI question.
Services that help us run the site
- Cloudflare: website hosting, security and email forwarding.
- Supabase: sign-in, account profiles and saved progress. Our project is hosted in London.
- Stripe: checkout, subscriptions, receipts and payment management.
- Resend: confirmation and password-reset emails.
- OpenAI: Penny’s optional AI replies.
- Google: font delivery and the inbox used to handle support email.
- Meta: optional advertising measurement of public visits, signups, checkout and first subscription payments, after you accept marketing.
These providers receive the information needed for their role. Some processing can take place outside the UK, including in the United States. International transfers are subject to the providers’ applicable contractual safeguards and transfer arrangements. Contact us for details. Optional Meta Pixel advertising measurement is described below.
Optional advertising measurement
If you accept marketing cookies, we use Meta Pixel on our public marketing pages and server-side Meta Conversions API events to measure visits, confirmed account registrations, opened checkout sessions and successful first subscription payments from Facebook and Instagram adverts, and help improve our advertising and audiences. This processing relies on your consent.
Meta receives the public page address, referrer, cookie identifiers, IP address and browser/device information. Meta may associate this information with your Facebook or Instagram account and process it under its Privacy Policy. We do not load the pixel on sign-in, password-reset or learning-workspace pages, or share your exercise answers, learning progress, passwords or Penny conversations. For consented server events, we share your account email after normalising and hashing it with SHA-256, a hashed account identifier, advertising cookie IDs where available, browser information and IP address, together with the event type and subscription amount/currency where relevant. Hashing helps Meta match an event; it does not make the email anonymous. We never share card details, authentication links or full account-page addresses.
You can reject marketing cookies, or withdraw permission at any time using . Withdrawing stops future pixel loading, cancels pending server events once the change reaches our server, and clears the first-party Meta cookies we can remove. An event already being transmitted may still arrive. If you are offline, reconnect to apply the server-side change. It does not reverse information already sent to Meta. Our server keeps a marketing choice for up to six months. Pending event payloads are cleared after delivery, withdrawal or expiry (within 24 hours plus the delivery check). Minimal event receipts prevent duplicate conversions and are removed when your account is deleted. Meta applies its own retention rules. Our Cookies & storage notice explains the choices and storage involved.
How long information stays
We keep your account and saved work while your account remains open so you can return to your practice. Ending a subscription does not delete your account. On an account-deletion request, we remove account and practice data once identity and any subscription arrangements have been resolved, except information we need for legal obligations or an unresolved dispute.
Payment, support and security records are retained for the period needed to meet their accounting, support or investigation purpose. Provider backups and logs can remain for their retention period after active records are removed. Browser copies remain until you clear this site’s data; deleting the account cannot erase copies on your devices or exported files.
Your choices and requests
You can edit your profile and export your progress in Your account. For access to other personal information, correction, deletion, restriction, portability or an objection to processing based on legitimate interests, email hello@practicebookkeeping.com. These rights depend on the circumstances. We may need to confirm your identity and will normally respond within one month; we will explain if a lawful extension is needed.
To request deletion, email from your account address with the subject “Account deletion request”. We will explain any subscription cancellation and records that need to be retained. Sending the email does not immediately erase your work or cancel a payment.
You may complain to the Information Commissioner’s Office. You can contact us first, but you do not have to.
Browser storage and updates
See our Cookies & storage notice for sign-in and progress storage. We will update this notice when the service changes and bring material changes to your attention.