Privacy policy

Who we are

Ceiling is run by the Ceiling team (“we”), who decide how the personal data it holds is used. For anything about your data, email hello@vatline.uk.

What Ceiling keeps

When you sign in with Google

• Your name, email address and profile picture, which Google shares when you sign in. Ceiling asks for nothing else from your Google account and never touches your Gmail.
• The sign-in details Google issues, so you stay signed in, and a session record with its cookie.

What you put in

• Your monthly sales totals, and whether each month is locked against changes.
• Your settings: safety buffer, quick amounts, email choices, registration checklist ticks, and whether you dismissed a reminder.
• When you import a bank statement or a sales spreadsheet, the file is read to find the money coming in and is then discarded. Ceiling keeps only its file name, how many rows were counted, and the month and total applied.
• A record of which scheduled emails were sent to you and when, so none is sent twice.
• If we give your account early access to a feature we are trying out, a record that we did and when. It is deleted with your account, or when that access ends.

As a guest

Nothing you enter is written to the database. It is held in the server’s memory only, and is gone when you end the session, after two hours without use, or when the server restarts. A cookie identifies your guest session while it lasts.

Security

Your IP address is used briefly, in memory, to limit how quickly guest sessions can be started, and some links opened, from one connection. It is not stored. Our hosting provider may keep standard server logs.

Cookies

Ceiling uses only the cookies it needs to work: one to keep you signed in, one for a guest session, and short-lived ones that protect the Google sign-in itself. There are no analytics, advertising or tracking cookies, and nothing is shared with advertisers.

Why, and on what basis

We use your data to provide the service you signed up for - working out your position against the VAT threshold and sending the emails you choose - which is necessary for our contract with you. We use the security measures above because we have a legitimate interest in keeping the service safe.

Who else handles it

Your data is handled on our behalf by our hosting, database and email providers, only to run Ceiling. It is stored on servers in London, UK. If you turn on emails, your email address and what each email says pass through our email provider, which may process them outside the UK, with the safeguards UK law requires. Google handles the sign-in under its own privacy policy. We do not sell your data, and we do not share it with anyone else unless the law requires us to.

How long we keep it

For as long as you have an account. You can delete it at any time from Settings → Advanced settings → Delete my account, which removes your account and everything in it straight away. Copies of the database are kept as backups for 14 days, then deleted, so an account you delete is gone from those too within 14 days.

Your rights

Under UK data protection law you can ask for a copy of your data, have it corrected or erased, restrict or object to how it is used, and have it given to you in a portable form. Email hello@vatline.uk to do any of these. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (opens in a new tab).

Changes

If this policy changes, the new version will be published here with a new date at the top.