Privacy policy

Magpie is operated by J M DIMONACO LTD, a company registered in England and Wales (company number 14260548). For anything in this policy, email hello@magpie.tax. J M DIMONACO LTD is the data controller for the personal data described below.

Magpie stores what it needs to match receipts to payments and to track filing deadlines — nothing else. Concretely:

• Your account — email address, name, and a password hash if you sign up with a password (never the password itself). If you sign in with Google, we store the identifier Google gives us. While you are signed in we also keep routine session records — IP address and browser details — which are deleted with your account.
• Company details — your company number and the public Companies House data derived from it (accounts and confirmation statement due dates, filing history dates).
• Bank transactions— date, amount, merchant, category, account identifiers, and the bank's free-text description line (which can itself contain names or payment references) for accounts you connect. Today that means a direct Monzo connection; support for other banks via an open-banking aggregator exists in the code but is not live.
• Receipts— receipt emails and attachments fetched from a Gmail or Outlook inbox you connect, receipts forwarded to your Magpie ingest address, and files you upload by hand. Confirmed receipts are stored in Magpie's file vault.
• OAuth tokens — the access and refresh tokens for services you connect (Google, Microsoft, Monzo). These live server-side only and are never sent to your browser.
• Organisation membership — who belongs to which organisation, their role, and the email addresses of people who have been invited.
• Export packs — if you build an accountant export pack, the ZIP is held for 24 hours so you can download it, then deleted automatically.

Magpie runs on a small set of infrastructure and service providers. Each only receives what its job requires:

• Convex — the database and file storage. Everything listed above lives here.
• Vercel — hosts the web application.
• Google — sign-in; and Gmail (read-only) and Google Drive (files Magpie creates only), when you connect them.
• Microsoft — Outlook inbox reading, when you connect it.
• Monzo — the bank transaction feed, when you connect it.
• Resend— sends Magpie's emails (deadline reminders, invites, password resets) and, when the forward-a-receipt feature is live, receives email you choose to forward to your ingest address.
• Companies House — Magpie queries the public Companies House API with your company number.
• Anthropic — the AI features, and only when you press an AI button. Nothing is sent automatically. “Scan with AI” sends the text of that one receipt or forwarded email; “Draft with AI” sends your instruction, the text of the document you are editing, and your company name and number. Magpie does not send your bank transactions, your other documents, or anything from another organisation.
• PostHog — product analytics may be enabled; it is currently not. If it is enabled, this policy will say so and describe what is collected.

Plainly: Convex and Vercel host in the United States, and Anthropic processes AI requests there, so your data is stored and processed there. Under UK GDPR that is an international transfer, relying on those providers' standard data-protection terms. If US hosting is a dealbreaker for you, Magpie is currently not the right tool.

Under UK GDPR, Magpie processes your data on two bases: contract — storing transactions, receipts and tokens is the service you signed up for and cannot be done without them — and legitimate interestfor deadline reminder emails, which exist so your company doesn't file late. Magpie does not sell data or use it for advertising.

If you join or create an organisation with other people, the organisation's data — transactions, receipts, deadlines — is visible to its members. That is the point: you invite your accountant so they can see it. Roles limit what members can do (only owners and admins manage members and connections), but assume anyone in your organisation can read its data.

The accountant role reads everything and builds export packs. It performs no triage or settings changes, but it canwrite notes and templates, and can run AI actions, which draw on that organisation's monthly allowance rather than the accountant's own.

We can see some of it.Magpie's operator has an internal dashboard showing account and organisation metadata — organisation names, owner email addresses, member counts, plan, and how many AI actions each organisation has used this month — so we can answer support questions and manage billing. It does not show your transactions, receipts, documents, notes or templates. Aside from that metadata, nobody outside your organisations sees your data.

Your data is kept while your account exists. A few things expire on their own timers: export pack ZIPs are deleted 24 hours after they are built, and the short-lived state used during OAuth connection flows expires after one hour. Everything else stays until you delete it — or delete your account.

You can delete your account and all associated data at any time from Settings → Danger zone. Deletion is immediate and total in Magpie's live systems: every transaction, receipt, vaulted file, connection and stored token of yours is erased, and third-party access is revoked where the provider supports it (Google access is revoked; the aggregator consent is deleted; Monzo and Microsoft offer no remote revoke endpoint, so those tokens are destroyed on our side and you can additionally withdraw Magpie's access in your Monzo or Microsoft account settings).

One guard: if you own an organisation that still has other members or pending invites, deletion is refused until you remove them or transfer ownership — so an accountant's access is never silently orphaned.

Honestly, a few copies are beyond the delete button:

• Platform backups.Convex keeps operational backups and point-in-time recovery snapshots of the whole deployment. Your rows vanish from the live database instantly but persist inside those backups until they age out on Convex's schedule; we cannot surgically erase one user from a platform backup.
• The providers' own copies.Revoking our access deletes nothing at Google, Microsoft or Monzo — your bank still has your transactions and Gmail still has the receipt emails, under each provider's own terms. Magpie only ever held read copies.
• Email already sent.Deadline reminders and invites already delivered can't be recalled, and Resend retains delivery metadata per its own policy.
• Copies in your own storage. Receipts exported to your Google Drive or Nextcloud, and export packs you already downloaded, are yours and stay where you put them.
• A just-deleted session, briefly.A signed-in session's token stays technically valid for up to ~15 minutes after deletion (it cannot renew). Only your own already-open tab could use it.
• Operational logs. Convex and Vercel request logs may retain non-identifying operational metadata for their standard windows.

Magpie sets the cookies needed to keep you signed in — nothing else. No advertising or cross-site tracking cookies.

UK GDPR gives you the right to access, correct, export and erase your personal data, and to object to processing. Most of these you can exercise yourself: export packs give you your data; the danger zone erases it. For anything else, email hello@magpie.tax. If you think Magpie has mishandled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

When this policy changes materially, the date at the top changes and signed-in users will be told in the app. The current version always lives at this address. See also the Terms of Service.