Privacy Policy
At CapiPlan Ltd, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you visit our website or use our services. We process personal data in accordance with applicable UK data protection laws, including the UK GDPR and the Data Protection Act 2018.
Effective Date: 01 October 2026
Last Updated: 01 October 2026
Version: 1.0
Depending on how you use CapiPlan, we may collect:
- Your name, email address, phone number, and company details.
- Account and login information.
- Billing and subscription information.
- Business, accounting, invoicing, payroll, and financial information you enter into CapiPlan.
- Information you provide when contacting our support or sales teams.
- IP addresses, device type, browser type, operating system, login activity, and technical information collected when you access or use CapiPlan.
- Access logs, login attempts, and related technical data used to investigate suspicious activity and unauthorised access.
We may use your information to:
- Provide and manage CapiPlan services.
- Create and manage your account.
- Process payments and subscriptions.
- Provide customer and technical support.
- Communicate with you about our services.
- Protect our systems and prevent fraud or unauthorised access.
- Meet our legal and regulatory obligations.
We use appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, misuse, or disclosure.
- Data is encrypted in transit using TLS.
- Third-party access tokens and refresh tokens are encrypted at rest, and the encryption key is stored separately from the database.
- Access to customer information is limited to authorized personnel on a need-to-know basis.
- Access controls prevent customers from accessing other customers’ data.
- Access and security logs are monitored to detect suspicious activity.
We retain your personal and financial data only for as long as necessary:
- Account and billing data is kept for the life of your account and for 12 months after closure until you delete by yourself.
- Financial and accounting records are kept for the applicable statutory period, which is six years where required by law.
- To resolve disputes and enforce our agreements.
- Third-party access tokens are kept until you disconnect the integration or the authorisation is revoked, rejected, or expires. After that, they are no longer used and are deleted.
- Security and access logs are kept for 12 months.
- Records of submissions made through third-party integrations are retained for six years where required by applicable accounting record requirements until you cancel the plan and delete the data.
- Customers can request an export of their business and financial data, subject to available export features.
- To request deletion of your data, email info@capiplan.co.uk. We will respond within one month. We may keep records we are legally required to retain, and we will tell you what we are keeping and why.
- When data is no longer required, we securely delete or anonymise it.
Where required by law, certain financial and accounting records may be retained for the legally required period.
Once your data is no longer required, we securely delete or anonymise it where appropriate.
Under UK data protection law, you may have the right to:
- Access your personal data.
- Correct inaccurate information.
- Request deletion of your information.
- Restrict or object to certain processing.
- Request transfer of your data where applicable.
- Withdraw consent where processing is based on consent.
- You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your personal data has been handled unlawfully.
ICO complaints: https://ico.org.uk/make-a-complaint/
To exercise your rights, contact us at info@capiplan.co.uk
We use cookies and similar technologies to operate our website, improve your experience, and understand how our website is used.
Where required, we will ask for your consent before using non-essential cookies. You can also manage cookies through your browser settings.
- CapiPlan accesses third-party data only after the customer authorises access through the relevant third-party authorisation process.
- Third-party data is used only to provide the services requested by the customer and permitted by the granted authorisation.
- Customers must authenticate directly through the relevant third-party service and should not share their passwords with CapiPlan.
- Customers can revoke CapiPlan’s access through the relevant third-party service. CapiPlan will stop making API requests that rely on the revoked authorisation.
- Third-party data is not sold or used for advertising, marketing, or profiling.
- Third-party data is shared only with identified service providers where necessary to deliver, secure, or maintain the requested services, subject to applicable confidentiality and data protection requirements.
- CapiPlan supports services provided through third-party integrations, depending on the features available and the authorisation granted.
- Contract: Account information and business records are processed when necessary to provide the services requested by customers.
- Legal obligation: Personal and financial records are processed when required to comply with applicable tax, accounting and legal requirements.
- Legitimate interests: Security logs and access records are processed to protect accounts, detect fraud and prevent unauthorised access.
- Consent: Where consent is the lawful basis, customers can withdraw it at any time.
- Third-party data: Data obtained through third-party integrations is processed under the applicable lawful basis for providing the requested service. Third-party authorization alone does not establish the lawful basis for all processing.
- We share personal data only where necessary to provide the Services, comply with the law, or protect our rights. This includes sharing data with relevant third-party service providers when you instruct us to or when necessary to deliver the requested Services.
- We use third-party providers for cloud hosting, storage and backup, email delivery, payment processing and technical support. They process data only on our instructions and under contracts requiring confidentiality and appropriate security.
- Where personal data is transferred outside the UK, we use the safeguards required by UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or transfer only to countries covered by UK adequacy regulations.
- Third-party access tokens and refresh tokens are encrypted when stored and are sent only over secure connections.
- Access tokens are handled according to the relevant third-party service’s expiry requirements, and revoked authorizations are no longer used for API access.
- CapiPlan does not ask customers to provide their third-party account passwords to maintain an API connection.
- When you disconnect a third-party integration in CapiPlan, the stored tokens are deleted from our systems. If the third-party service revokes or rejects an authorization, we stop using it, and you must reconnect to continue using the integration.
- Customers can report suspected security incidents, data breaches and unauthorised access to info@capiplan.co.uk.
- Reports should include the affected account, the incident description and the approximate date and time. Customers should not include passwords or access tokens.
- CapiPlan investigates reported incidents, takes steps to contain their impact and implements appropriate corrective measures.
- Affected customers are notified where required by applicable data protection law.
- CapiPlan reports relevant incidents to the applicable third-party service providers in accordance with their requirements.
- Personal data breaches are reported to the ICO within 72 hours of awareness where the UK GDPR requires notification within that period.
We may update this Privacy Policy from time to time to reflect changes to our services, legal requirements, or business practices. Any updates will be published on this page with a revised Last Updated date.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
Company Registration Number: 17336594
8 Long Lane, Rowley Regis, Birmingham, England, B65 0HY
Email: info@capiplan.co.uk
Phone: +44 7458 931755
