Privacy policy

Our Kev is run by Jak William Bracegirdle trading as Our Kev, 9 Newark Road, New Ollerton, Nottinghamshire, NG22 9PZ. In this policy, “we” and “us” mean Our Kev. We are the controller of your personal data, which means we decide how it is used and are responsible for looking after it.

We are registered with the Information Commissioner’s Office (ICO) under number ZC284319.

Questions or requests about your data: hello@ourkev.app.

Your account

• Your email address, and your password if you set one (stored scrambled, never in plain text).
• Your name and business name, if you add them.
• Whether you live in Scotland, if you tell us, so we can use Scottish Income Tax rates.
• The date you accepted these terms and this policy.

Mileage

• Your vehicles: name, type and registration if you add it.
• Each journey: start and end times, start and end location, the address looked up from each location, whether it was home or a site, the distance and the amount you can claim.
• Your normal commute distance, if you use commute deductions.

Time

• When you clock in and out, your breaks and any notes.

Expenses and receipts

• Photos or PDFs of receipts you upload, and the details on them: supplier, date, amounts, VAT and category.

Invoices and quotes

• Your business details for invoices: address, email, phone, VAT number and the bank details you want printed on them.
• Your clients’ names, contact details and addresses, and what you quote and invoice them for.
• Whether a client accepted or declined a quote you shared with them, and when.

Teams

• The organisations you create or join, your role, invitations (including the email address invited) and decisions on expenses.

Billing

• Your plan, its status and renewal date, and the reference Stripe gives us. Stripe handles your card. We never see or store your full card number.

Technical information

• Server logs, including your IP address, browser and the pages requested. We use these to keep Kev running and secure.
• Anonymous usage figures such as page views, device type and country. See Cookies and analytics.
• If you came to Kev from one of our adverts and then sign up, the advert’s campaign tags and the click reference the ad network added to the link. See Cookies and analytics.
• How your visit went: the site that sent you and any campaign tags on the link you followed, the first page you landed on, the pages you read, whether you were on a phone, tablet or computer, and steps such as using a free calculator or tapping Start free. This has no name or email in it. If you then sign up, where your visit started is saved with your account. See Cookies and analytics.
• Your answer to “How did you hear about Kev?” in setup, if you give one.

GPS mileage tracking only works if Kev knows where a journey starts and ends. When you tap to start or end a journey, your phone asks your permission and then gives Kev your location at that moment.

• We record the location when you start and when you end a journey. We do not track where you go in between, and we do not collect your location at any other time.
• We send the start and end points to a mapping service to look up the nearest address, and to a routing service to work out the road distance. Your name and email are not sent with them.
• You can turn off location permission in your phone or browser settings at any time. Kev cannot track journeys without it, but everything else keeps working.

A journey’s start or end point is often your home or a client’s address, so we treat this information with particular care. Only you can see your journeys.

Data protection law says we need a lawful reason (a “lawful basis”) for each thing we do with your data. Ours are:

• To provide Kev (contract). Running your account, recording journeys, hours, expenses and invoices, reading receipts when you ask, running teams and taking payment for paid plans.
• Our legitimate interests. Keeping Kev secure, preventing fraud and abuse, fixing faults, and understanding how Kev is used so we can improve it, and knowing which of our adverts bring in customers so we don’t waste money on the rest. We use anonymous figures for this wherever we can.
• Legal obligations. Keeping billing records for HMRC and responding to lawful requests.
• Your consent. Your phone or browser asks before sharing your location or camera. If we ever want to send you marketing emails, we will ask first and you can say no.

We send emails you need, such as confirming your account and resetting your password. We do not use your data for advertising and we never sell it.

Your clients

When you add a client or send a quote or invoice, you decide what goes in it. A quote you share opens for anyone with its link, so only send the link to your client. For that information you are the controller and we look after it on your behalf, as your processor. Our terms set out how we handle it. Only add client details you are entitled to use, such as what you need to invoice them.

Organisations

If you join an organisation in Kev, its owner and admins can see your name, email and role, and the expenses and receipts you submit to that organisation, so they can approve them and export them for their accounts. They cannot see your mileage, hours, invoices or personal expenses. If you leave, they keep the records of expenses they have already approved, as they may need them for their own accounts.

Our team

A small number of people who run Kev can see account details, such as email addresses and usage counts, to support you and keep the service running. They only look at your records when needed to fix a problem or when you ask for help.

We sometimes email limited companies and LLPs, such as accountancy firms, to tell them about Kev. We never send these emails to sole traders or ordinary partnerships unless they have asked us to.

For this we keep the firm’s name, the business email address it publishes (on its own website or a public directory), where we found it and whether we have heard back. Our reason is our legitimate interest in telling businesses about Kev. Every email says who we are and how to say no.

If you tell us to stop, we add your address to a do-not-email list so we never contact you again; that is all we keep. Otherwise we delete the details after 12 months without a reply. You have the same rights as anyone else, set out below. Email hello@ourkev.app to use them.

If you ask for Self Assessment deadline reminders on one of our guides or free tools, we keep your email address, the words you agreed to and when, the page you signed up on and any campaign tag in that page's address. Our reason is your consent. Nothing is sent until you tap the link in the confirmation email.

We send a handful of reminders before the deadline, which may also mention Kev. Every email has an unsubscribe link, and you can email hello@ourkev.app to stop them. Emails go out through Brevo.

An address that is never confirmed is deleted after 30 days. If you unsubscribe we keep only your address, marked as unsubscribed, so we never email you by mistake. We don't share the list with anyone.

We use a few trusted companies to run Kev. They only process your data on our instructions and must keep it secure.

• Supabase: database, receipt storage and sign-in. Your records are stored in London (AWS eu-west-2).
• Vercel: hosts the website and app, and provides anonymous usage figures. Requests may be handled in the US.
• Cloudflare: handles email to hello@ourkev.app, and runs the quick robot check (Turnstile) on the sign-up and sign-in pages. The check looks at your browser and connection to tell people from bots, without ads or tracking.
• Stripe: takes payments for paid plans. Stripe is also responsible in its own right for some payment information, under its privacy policy.
• Anthropic: reads receipts for Kev Pro. When you upload a receipt on Pro, the image is sent to Anthropic’s AI to pick out the supplier, date, VAT and total. Under its commercial terms Anthropic does not use this to train its models. Processed in the US.
• openrouteservice (run by HeiGIT gGmbH): works out the road distance between a journey’s start and end point, and looks up their addresses. It receives the two map points, not who you are. Based in Germany.
• OpenStreetMap Foundation (Nominatim): looks up the address for a journey’s start and end point if openrouteservice can’t. Based in the UK.
• OSRM routing service (hosted by FOSSGIS e.V.): works out the road distance if openrouteservice can’t. Based in Germany.
• Brevo: sends account emails such as sign-up confirmations and password resets.

We may also share data:

• with professional advisers, such as our accountant or lawyer;
• when the law requires it, for example a valid request from HMRC or the police;
• with a buyer if Our Kev is ever sold, who would have to respect this policy.

Some of the companies above are based in, or handle requests from, the US or the European Economic Area. When data leaves the UK we make sure it is protected to UK standards, using UK adequacy regulations (including the UK–US data bridge where the company has signed up to it) or the UK’s approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).

• Your records (journeys, hours, expenses, receipts, invoices and clients) are kept while your account is open, so they are there when your accountant or HMRC asks for them.
• When you close your account we delete your records from our live systems within 30 days. Copies in backups are overwritten within a further 90 days.
• Billing records are kept for 6 years after the end of the tax year they relate to, as HMRC requires.
• Visit counts (see Cookies and analytics) are deleted after 13 months. Where your visit started, saved when you sign up, is deleted with your account.
• Deadline reminder sign-ups (see Tax deadline reminders) that are never confirmed are deleted after 30 days.
• Server logs are kept for a short time, usually no more than 30 days.
• Invitations stop working after 14 days, and are deleted along with the organisation.

HMRC expects self-employed people to keep business records for at least 5 years after the 31 January filing deadline. Kev helps, but it is your responsibility, so export your reports before you close your account.

Under UK data protection law you can ask us to:

• give you a copy of the data we hold about you;
• correct anything that is wrong;
• delete your data and close your account (you can do this yourself in Settings, then Your data);
• limit how we use your data, or stop using it;
• give you your data in a format you can take elsewhere (Settings, then Your data, downloads all of it as CSV files plus your receipts);
• withdraw any consent you have given.

Email hello@ourkev.app to use any of these rights. It’s free, and we will reply within one month. We may need to check it’s really you first.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Kev does not use advertising or tracking cookies, so there is no cookie banner. The only cookies are the ones Kev needs to work:

• Sign-in cookie (named sb-…-auth-token): keeps you signed in and secure. It lasts until you sign out, or up to 400 days.
• Sign-in check cookie (named sb-…-code-verifier): used while you sign in or reset your password, to make sure the email link is yours. It is removed once the link has been used.

These are strictly necessary, so the law does not require your consent for them. The robot check on the sign-up and sign-in pages is there for security in the same way.

Analytics

We use Vercel Web Analytics and Speed Insights to count page visits and check how fast pages load. They do not use cookies or store anything on your device, and they do not identify you. Visits are counted using a code that is thrown away after 24 hours. We remove invite links, quote links and sign-in codes from page addresses before anything is sent.

Kev’s own visit counts

To see which pages and posts actually help people, Kev also keeps its own count of how visits go. When you arrive, your browser keeps a random visit number and the page you landed on in this tab’s session storage. It is not a cookie, and it is deleted when you close the tab. With it we record the site that sent you, any campaign tags on the link you followed (such as which post it was in), the pages you read and whether you scrolled through most of a page, your device type (phone, tablet or computer) and steps such as using a free calculator, tapping Start free, opening the sign-up form, the kind of error if sign-up didn’t work (for example “email already registered”), opening the upgrade page or starting checkout. We don’t record your IP address, name or email with these, or what you type into the calculators.

If you sign up, where your visit started (the site that sent you, the first page and any campaign tags) is saved with your account, along with your answer to “How did you hear about Kev?” if you give one. Once you have an account we also note which days you open the app, and whether you have logged a journey, expense, invoice or quote (not what is in them). That tells us which pages, posts and adverts bring in customers who find Kev useful. Visit steps are deleted after 13 months; what is saved with your account is deleted with it.

The law allows this without asking first because it is only used to count how Kev’s website is used so we can improve it, and you can say no at any time with the box below.

If you’d rather not be counted, tick the box below. Kev remembers your choice on this device. If your browser sends a “Do Not Track” or Global Privacy Control signal, we stop counting automatically.

Adverts

We advertise on search engines and social media. An advert’s link carries tags saying which advert it was, and the ad network (such as Google) adds a click reference. These stay in the page address while you look around. Nothing is stored on your device and we don’t use the ad networks’ tracking code on our pages. If you sign up, we save the tags and click reference with your account so we can count how many sign-ups and paying customers each advert brought in. We don’t send them back to the ad network. They are deleted with your account.

Payments

When you pay for a plan you are taken to Stripe’s checkout page, which sets its own cookies to prevent fraud, as described in Stripe’s privacy policy.

Your data is encrypted when it travels to and from Kev and when it is stored. Each account can only see its own records, and receipts are kept in private storage. Access for our team is limited to the people who need it. If something does go wrong that puts your data at risk, we will tell you and the ICO when the law says we must.

Kev is a business tool for adults. You must be 18 or over to create an account, and we do not knowingly collect data from children.

If we change this policy we will update the date at the top. If the change matters, we will tell you by email or in the app before it takes effect.

See also our terms of service.