Data Handling Policy

This Data Handling Policy supplements our Privacy Notice and our Terms of Service. It sets out, in one place, how TrueBooks stores and handles data, who our sub-processors are, what international transfers we make, and how long we retain each category of data. Section 6 (Data Processing Addendum) constitutes the contractual agreement under Article 28 of the UK GDPR for those situations in which we act as your data processor.

1. Our role with respect to your data

TrueBooks has two distinct roles, depending on the category of data:

• We are the data controller in respect of your account profile (name, email, phone, billing details, login records, IP addresses, audit log) and any personal data you give us when you contact our support team. The processing of that data is described in our Privacy Notice.
• We are a data processor on your behalf in respect of the financial data we retrieve from Third-Party Services you have authorised (for example, settlement reports retrieved from Amazon SP-API). To the extent any of that data contains personal data of your end-customers, you remain the data controller and we process it on your behalf strictly under your instructions, on the terms of Section 6.

2. Data we access from your connected platforms

2.1 Amazon Selling Partner API

When you connect an Amazon Seller account, we access only:

• Settlement reports — period totals and transaction-level detail (amounts, fees, order references, SKU, marketplace).
• Financial event groups — disbursement dates and totals.
• Marketplace participations — which Amazon marketplaces your account is enrolled in.
• Inventory summaries (where the role is granted) — SKU, ASIN, product name, total quantity.
• Order-level ship-to country (where the role is granted) — used solely to apply the correct UK VAT classification.

We do not access end-customer names, postal addresses, email addresses, telephone numbers, payment-card details, product reviews, advertising data, listings, browsing data or any data unrelated to financial settlements.

Your Amazon credentials (refresh token) are encrypted at rest using AES-256-GCM and used only to retrieve the data above on your behalf. They are never shared with any third party and are never visible to TrueBooks staff.

2.2 Xero

When you connect Xero, we post settlement data to your Xero organisation when you explicitly request it (manually or via the Auto Post toggle). We retain only the access and refresh tokens (encrypted at rest) and minimal metadata — tenant ID, organisation name, base currency, organisation type, tax-account chart — required to perform the post.

2.3 Other connected platforms

Where you connect Alibaba.com Open Platform, eBay Marketplace, or sign in via Google or Xero OIDC, we receive the data described in Section 2.3 of our Privacy Notice, subject to the scopes you grant.

3. Disconnecting a third-party platform

You can disconnect any connected platform at any time from Settings → Integrations. Disconnection immediately stops further data retrieval and our copy of the access / refresh tokens is zeroed in our database. Data previously imported into your TrueBooks account is preserved so your accounting history is not lost; you may delete that data on request to support, subject to legal-retention requirements (Section 5).

4. Where your data is stored

Primary application data (the Postgres database, Redis caches, encrypted raw-settlement backups, application logs) is stored on infrastructure located in the United Kingdom. Customer accounts are logically isolated at the database level so that no other TrueBooks customer can access your data.

Where data is processed outside the UK by a sub-processor (see Section 7), an appropriate Article 44–49 transfer safeguard is in place.

5. Data retention

We retain personal and business data only for as long as necessary for the purposes set out in our Privacy Notice. The retention periods we apply by category are:

5.1 Account closure

When you close your TrueBooks account from Settings → Security → Delete Account, your account profile (name, email, phone, password) is deleted within thirty (30) days. Login sessions and trusted-device tokens are invalidated immediately. Authentication credentials are deleted on closure. Login IP records are retained for ninety (90) days to support fraud-prevention investigation.

Financial records (settlement and transaction data, billing records) are retained for the period required by UK law — typically six (6) years from the end of the relevant tax year — to meet HMRC record-keeping obligations under the VAT Regulations 1995 and Companies Act 2006. After account closure this data is held in an archived state and is not accessible through the TrueBooks application.

5.2 Subscription cancellation / trial expiry

If your Subscription is cancelled or your trial expires without conversion, your account enters a grace period. After ninety (90) days of continued inactivity, the account and non-financial data are eligible for deletion under the schedule above. Financial records are retained as required by law.

5.3 Data subject deletion requests

You can request deletion of personal data we hold about you at any time by emailing support@truebooks.co.uk. We will confirm what can be deleted immediately and what must be retained for legal-obligation reasons. Where retention is required, the data will be held in archived form (not accessible through the application) and deleted at the end of the legally-mandated period.

6. Data Processing Addendum (DPA)

This Section 6 forms part of our agreement with you when you are the data controller of personal data processed by us as data processor (typically, personal data about your end-customers within settlement information you process through the Service). It is intended to satisfy the requirements of Article 28(3) of the UK GDPR.

6.1 Subject matter, nature and purpose of processing

Subject matter: provision of the TrueBooks accounting-automation Service. Nature of processing: retrieval, classification, storage, accounting export and reporting of financial settlement data on behalf of the controller. Purpose: to enable the controller to maintain accurate accounting records for the controller’s online-selling business.

6.2 Duration

Processing continues for the term of the Service contract, plus the legally-required retention period (Section 5).

6.3 Categories of personal data and data subjects

Categories of personal data: order identifiers, SKU references, financial line items, shipping country (where retrieved), marketplace identifiers. We do not retrieve or process end-customer names, addresses, contact details or payment-card information.

Categories of data subjects: the controller’s end-customers, identified only by an opaque order reference issued by the connected marketplace.

6.4 Obligations of TrueBooks as processor

We will:

• Process only on documented instructions from you, including instructions in respect of transfers to a third country, unless required to process by law (in which case we will inform you before processing, unless prohibited from doing so);
• Ensure persons authorised to process the data are bound by confidentiality;
• Implement appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR (see Section 9 below);
• Only engage sub-processors from the list in Section 7, and notify you of any intended change in sub-processors with at least thirty (30) days’ notice to give you an opportunity to object;
• Assist you, taking into account the nature of the processing, by appropriate technical and organisational measures, in fulfilling your obligation to respond to requests from data subjects exercising their UK GDPR rights;
• Assist you in ensuring compliance with your obligations under Articles 32 to 36 (security, breach notification, DPIAs and consultation);
• At your choice, delete or return all personal data to you after the end of the provision of services, and delete existing copies, unless retention is required by law;
• Make available to you all information necessary to demonstrate compliance with Article 28 obligations, and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint. Audits may be conducted not more than once per twelve-month period (or more frequently following a personal-data breach), on at least thirty (30) days’ written notice, during normal business hours, at your cost, and subject to a reasonable confidentiality agreement.

6.5 Personal-data breach notification

If we become aware of a personal-data breach affecting personal data we process on your behalf, we will notify you without undue delay (and in any event within seventy-two (72) hours of becoming aware), with the information you reasonably need to comply with your own notification obligations under Articles 33 and 34 of the UK GDPR.

6.6 International transfers as processor

We will not transfer personal data we process on your behalf outside the UK without an appropriate Article 44–49 safeguard in place. Where we engage a sub-processor based outside the UK, we use the International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, as applicable.

7. Sub-processors

The following sub-processors are engaged in delivering the Service. Each is subject to a written data-processing agreement. Where any process personal data outside the UK, the Article 44–49 safeguard in place is noted.

7.1 Onward sharing at your instruction

When you connect a third-party platform to your TrueBooks account, you authorise us to exchange data with that platform at your instruction. These platforms are not sub-processors of TrueBooks — you have your own direct relationship with each, and each operates under its own terms and privacy notice:

• Amazon Services Europe S.à r.l. — Seller account data, settlement reports.
• Xero Limited — Posting of invoices and manual journals at your instruction.
• Alibaba.com Singapore E-Commerce Private Limited — Order data (optional).
• eBay Inc. — Order data (optional).
• Google LLC — Sign-in-with-Google authentication (optional).
• HM Revenue & Customs — VAT-number validation lookups (only when you request validation).

8. Data isolation and access

Each customer’s data is logically isolated at the database level. All cross-customer operations and admin queries pass through application-level controls that scope queries to a single workspace.

TrueBooks staff access production data only on a need-to-know basis to investigate a support issue, resolve a security incident or fulfil a legal obligation. All access by staff is logged and audited. Where a staff member needs to view-as a specific user account for support purposes, an “impersonation session” mechanism is used; this is time-limited, read-only, prompts for a fresh second-factor, and is recorded in the audit log with the reason given.

9. Security measures

We apply technical and organisational measures appropriate to the risk in accordance with Article 32 of the UK GDPR, including:

• Encryption in transit — TLS 1.2+ for all connections, HSTS preload, strict TLS configuration on the application server.
• Encryption at rest — AES-256-GCM for high-sensitivity tokens (Amazon and Xero refresh tokens, TOTP secrets); bcrypt for passwords; per-record auth tags so a database breach without the encryption key cannot decrypt the data.
• Authentication — bcrypt password hashing, optional TOTP and SMS two-factor authentication, brute-force rate limiting, secure session cookies (HttpOnly, Secure, SameSite=Strict, __Host- prefix), automatic session expiry.
• Authorisation — per-feature permission gates, role-based admin access, 30-minute inactivity timeout on admin sessions, 90-day forced rotation of admin passwords, step-up authentication for destructive actions.
• Audit logging — all security-relevant actions are recorded for twelve (12) months.
• Backups — encrypted, retained per the retention schedule, restorable from off-site copy.
• Incident response — documented procedure for detecting, containing, eradicating and recovering from incidents; mandatory ICO notification within 72 hours where required.
• Vendor security review — sub-processors are reviewed on engagement and on material change.

Further detail is in our Security Notice.

10. Changes to this policy

We may update this Policy from time to time. When we add or change a sub-processor, we will notify subscribed customers by email at least thirty (30) days before the change takes effect to allow you to object if you consider the change material. Other material changes are notified by email and reflected in the “Last updated” date above.

11. Contact

Data-handling questions, sub-processor objections or data-subject requests should be addressed to support@truebooks.co.uk, or by post to: Ideal Creations Ltd, Princes Road, Buckhurst Hill, Essex, IG9 5DZ, United Kingdom.

Trademarks and non-affiliation

TrueBooks is an independent third-party solution. TrueBooks is not affiliated with, endorsed by, sponsored by, or otherwise associated with Amazon.com, Inc. or any of its subsidiaries. Amazon, Amazon Seller Central, Selling Partner API, FBA, and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates. Xero is a registered trademark of Xero Limited. All other trademarks are the property of their respective owners. See our Amazon disclaimer for more detail.