Legal

Privacy Policy

Last updated: June 2026 · CityFiscal Ltd · Company No. 17275439 · ICO Registration ZC176899

1. Who we are

CityFiscal is operated by CityFiscal Ltd, a company registered in England and Wales (company number 17275439). Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Our contact email is hello@cityfiscal.com.

CityFiscal Ltd is registered with the Information Commissioner's Office (ICO), registration reference ZC176899.

For the purposes of UK GDPR, CityFiscal is the data controller for the personal data described in this policy.

2. What data we collect

If you register interest via our waitlist form, we collect:

• Your name
• Your email address
• Your occupation type (e.g. sole trader, freelancer) — optional
• The date and time of your submission

If you use the CityFiscal app (app.cityfiscal.com), we additionally collect:

• Your email address and encrypted password (account credentials)
• Bank connection data — account names, sort codes, and account numbers provided via your bank through TrueLayer's Open Banking integration
• Transaction data — merchant names, transaction amounts, dates, and descriptions retrieved from your connected bank accounts
• Tax categorisation outputs — how your transactions are categorised for HMRC purposes, including any manual corrections you make
• Tax estimates and quarterly summaries generated from your transaction data
• Deduction alerts and notifications generated on your behalf

3. Why we collect it

Waitlist data is collected for the following purposes:

• Waitlist management — to notify you when CityFiscal's private beta opens and to send you early access information
• Product development — to understand the types of self-employed professionals interested in the product
• Correspondence — to respond if you contact us directly

Our legal basis for processing waitlist data is legitimate interests (running a pre-launch waitlist for a product you have voluntarily expressed interest in).

App data is collected to provide the CityFiscal service, including:

• Connecting to your bank accounts and retrieving transaction history
• Automatically categorising transactions for UK tax purposes
• Generating real-time tax visibility, estimates, and quarterly MTD preparation
• Sending proactive alerts when deductions are identified or thresholds are approached

Our legal basis for processing app data is performance of a contract — processing is necessary to deliver the service you have signed up for.

4. How we store your data

Your data is stored and processed using the following infrastructure:

• Supabase — primary database, hosted in the European Union (eu-west-2 region). Data at rest is encrypted. Row-level security policies restrict access to your own data only.
• Railway — API server that processes requests between the app and your data. Hosted in the EU.
• TrueLayer — FCA-authorised Open Banking provider. Bank connection tokens are encrypted before storage and are used solely to retrieve your transaction data on your behalf.

We do not store your bank login credentials. All bank connections are made through TrueLayer's regulated Open Banking infrastructure.

5. Automated AI categorisation

When you connect a bank account, your transaction data — including merchant names, amounts, dates, and descriptions — is processed by Claude, an AI service operated by Anthropic PBC (USA), to automatically categorise transactions for tax purposes.

Anthropic acts as a data processor on our behalf under a Data Processing Addendum incorporating Standard Contractual Clauses, which governs the transfer of your personal data to the United States in compliance with UK GDPR.

Anthropic does not use your transaction data to train its AI models. Data is processed solely to return categorisation results and is not retained by Anthropic beyond that purpose.

You can review and correct any AI-generated categorisation within the app at any time. Manual corrections take precedence and are stored as your preferred categorisation going forward.

If you have questions about how your data is processed by Anthropic, contact us at hello@cityfiscal.com.

6. Who we share your data with

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use the following sub-processors to deliver the CityFiscal service:

• Supabase — database storage (EU-hosted)
• Railway — API hosting (EU-hosted)
• Cloudflare — website hosting and delivery
• TrueLayer — FCA-authorised Open Banking provider for bank connections and transaction retrieval (UK/EU)
• Anthropic PBC — AI transaction categorisation (USA, covered by Standard Contractual Clauses)

We may disclose your data if required to do so by law or in response to a valid legal request.

7. How long we keep your data

Waitlist data is retained for up to 24 months from the date of submission, or until you request deletion, whichever comes first. If CityFiscal does not launch, all waitlist data will be deleted.

App data is retained for the duration of your account, and for up to 12 months following account deletion, to allow for any queries or disputes. You may request earlier deletion at any time by contacting us at hello@cityfiscal.com.

Bank connection tokens are revoked and deleted promptly when you disconnect a bank account or delete your CityFiscal account.

8. Your rights

Under UK GDPR, you have the following rights:

• Right of access — you can request a copy of the data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your data at any time
• Right to object — you can object to us processing your data
• Right to restrict processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a portable format

To exercise any of these rights, email us at hello@cityfiscal.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

CityFiscal currently uses no tracking cookies, analytics, or third-party advertising scripts on this website. The only data stored is what you voluntarily submit via the interest form. See our Cookie Notice for full details.

10. Changes to this policy

We may update this Privacy Policy as CityFiscal develops. When we do, we will update the date at the top of this page. We encourage you to review this page periodically.

11. Contact

For any questions about this Privacy Policy or your personal data, contact us at hello@cityfiscal.com.