Privacy built for finance workflows.

Who We Are

Cherry Money provides finance software for invoicing, cash-flow awareness, VAT workflows, reporting and AI-assisted finance support. Cherry Tax is the companion UK Self Assessment and Making Tax Digital product.

Soham London CIC (company number 12924477) is the data controller for the Cherry Money services covered by this policy, including the main service and the community application for voluntary, community and social enterprise (VCSE) organisations, community interest companies (CICs), trusts and charitable incorporated organisations (CIOs). It determines how and why personal data is used for its controller purposes and is also the HMRC production-access applicant.

References to "we", "our" or "us" in this policy mean Soham London CIC. For privacy questions or rights requests, contact info@cherrymoney.co.uk.

Where your organisation determines how and why customer, supplier or employee data is used in its business records, it is the controller of that processing. We process those records on its instructions to deliver the selected services. Soham London CIC is responsible for its own account administration, service security and legal obligations. A privacy request can involve both roles; we will identify the responsible organisation when responding.

Information We Collect

We collect information you provide directly, information created while you use the service, and limited technical information needed to keep the platform secure and reliable.

• Account details: names, email addresses, phone numbers, business names, user roles, login details and profile preferences.
• Blog subscriptions: email address, region, consent timestamp, subscription status and unsubscribe token when you choose to receive Cherry Money Blog updates.
• Business records: client and supplier details, products, invoices, quotes, expenses, payments, purchase invoices, credit notes and related attachments.
• Tax and VAT records: Self Assessment records, income and expenses, mileage, receipt metadata, VAT return details, HMRC connection status, tax settings, calculation results and submission-related records where you choose to use these features.
• Government identifiers: Cherry Tax may process your National Insurance number when you ask it to retrieve or submit HMRC Income Tax information. The mobile app stores this identifier in secure device storage for reuse on that device.
• HMRC fraud-prevention telemetry: where HMRC requires it, Cherry Tax sends technical data such as a persistent app device ID, local IP addresses and timestamp, screen/window size, timezone, operating-system details and app version through the Cherry backend to HMRC.
• Receipts and files: receipt images or files are processed only when you choose capture/upload or request OCR. Extracted fields remain subject to user review.
• Usage and device data: browser type, device information, IP address, session activity, error logs and performance signals.

How We Use Information

We use personal and business information to provide a dependable financial workspace and improve the tools you rely on.

If you explicitly subscribe to the Cherry Money Blog, we use the subscription details you provide to send the updates you requested and to honour unsubscribe choices. Blog marketing emails are separate from essential account and security messages.

• To create, maintain and secure your account.
• To generate and manage invoices, quotes, payments, expenses, reports and VAT workflows.
• To provide product support, service notifications and operational messages.
• To diagnose errors, improve performance, protect against misuse and maintain platform integrity.
• To comply with legal, tax, accounting and regulatory obligations where they apply.

Why We May Use Personal Data

For processing where Soham London CIC is the controller, the following purposes and UK GDPR lawful bases apply. A business customer determines the lawful basis for the records it instructs us to process; connecting an integration is not a substitute for that assessment.

• Your account and requested services: name, contact details, authentication and subscription information are used to perform our contract with you, or take steps you request before a contract. For staff using an organisation's contract, our legitimate interests are administering the business relationship and providing authorised access.
• Support and service communications: we use contact details and relevant case information to fulfil our contract with individual customers; for business contacts, our legitimate interests are resolving requests and keeping users informed about their service.
• Security, fraud prevention and audit: our legitimate interests are protecting accounts, investigating misuse and preserving reliable financial change histories. We use account identifiers, technical logs and necessary audit evidence for these purposes, subject to a necessity and balancing assessment.
• Our statutory duties: we retain and disclose records where a legal obligation applies to us, including our own accounting and tax obligations. A customer's record-keeping duty does not automatically permit us to retain every item of their personal data indefinitely.
• Optional marketing and non-essential tracking: where consent is required, we rely on your freely given choice and you may withdraw it without affecting the lawfulness of earlier processing. Service access is not conditional on marketing consent.
• Requested AI assistance: account information needed to deliver an individual customer's requested feature is processed to perform that contract. Business records supplied by an organisation are processed on its instructions; security controls remain subject to the legitimate interests described above. Selecting an AI feature is not blanket consent to unrelated processing.

Account and authentication information is needed to provide access. Optional information and integrations are your choice, but a feature may not work without the data it needs. Contact us to discuss a basis, object to processing based on legitimate interests, or withdraw consent.

Financial, Tax and HMRC Data

Financial data may include sensitive business information such as invoice values, payment status, VAT calculations, client records, supplier records and reporting summaries. We treat this data as confidential business data and use it only for the services you select.

If you connect HMRC services, the platform may process OAuth tokens, National Insurance numbers, business identifiers, obligation data, calculation references, filing metadata and the technical fraud-prevention information HMRC requires for authorised workflows. HMRC tokens are held on the Cherry backend rather than in the mobile app. Direct HMRC production filing through Cherry Money and Cherry Tax is currently unavailable pending the applicable production access.

Ask Cherry AI

Ask Cherry is designed to help you review finance information, understand business records and carry out guided workflows. The assistant may use account context, invoice data, VAT boxes, purchase records and other platform data to answer questions or prepare actions you request.

AI-generated responses can contain mistakes and should be reviewed before you rely on them for filing, tax, payment or accounting decisions. You are responsible for checking outputs and confirming business actions before submission.

Cookies and Analytics

We may use cookies and similar technologies to keep you signed in, remember preferences, secure sessions, understand product usage and improve performance. You can control cookies through your browser settings, though some features may not work correctly without them.

Sharing Information

We do not sell your personal information. We may share information only where needed to operate the platform, support your account or meet legal requirements.

• Service providers: hosting, payments, communications, security and technical support partners that help us run the service.
• AI providers: when you choose an AI-assisted feature, we may send a bounded finance or tax context to an AI service provider, including OpenAI where configured. We do not sell that information.
• Integrations: third-party services you authorise, such as HMRC or payment-related providers.
• Legal requirements: regulators, public authorities or other parties where disclosure is required by law or necessary to protect rights and safety.

International Transfers

Hosting, communications, payment and AI providers may process information outside the UK, including through support access or subprocessors. The location of our application server alone does not determine where all information is processed.

Before a restricted transfer, the responsible controller must establish an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, with the required data protection test (transfer risk assessment). A provider's security statement alone is not a transfer safeguard.

Contact info@cherrymoney.co.uk for the destinations, recipients and applicable safeguard for the service you use, and how to obtain a copy. We must establish a valid transfer arrangement before enabling a feature that requires it.

Security and Retention

We use administrative, technical and organisational safeguards intended to protect information against unauthorised access, loss, misuse or alteration. No online service can guarantee absolute security, but we work to keep protection proportionate to the financial nature of the platform.

We retain account information while it is needed to provide your service. On an erasure request we assess each category, remove information no longer needed and explain any specific exception, its legal basis and its retention end date or review date. A pending request is not confirmation that deletion has happened.

• VAT and accounting evidence: VAT records generally need to be kept for at least six years; some schemes and circumstances require longer. Our VAT evidence archive applies a conservative minimum of six years from the end of the capture year, followed by review for other obligations or holds.
• PAYE records: employers generally need records for three years from the end of the relevant tax year. Other accounting, dispute or legal requirements may justify longer retention of particular records.
• Self Assessment business records: these generally need to be kept for at least five years after the 31 January submission deadline for the relevant tax year, with longer periods in some circumstances.
• Audit and support evidence: retain only what is needed to explain relevant transactions, handle the case or investigate a specific security issue. Review against the related record's retention requirement and any documented claim or hold; this is not a blanket exemption from erasure.
• Backups and recipients: an erasure response covers relevant processors and backup handling as well as the live database. Data awaiting backup expiry must be put beyond use; any restore must reapply completed erasures before normal access resumes.

Your Rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict or object to the use of your personal information. You may also ask for a copy of certain data or withdraw consent where processing is based on consent.

To exercise these rights, including an accessible copy or export when moving provider, contact us using the details below. We may ask for proportionate information to verify your identity. We normally respond within one month; if a lawful extension is necessary, we will explain the reason and revised deadline within that first month. We will explain any refusal or retention exception and your right to complain to the ICO.

Privacy Complaints

If you are concerned about how your personal information is handled, contact info@cherrymoney.co.uk. You also have the right to complain to the UK Information Commissioner's Office. Visit the ICO complaints service for information about raising a concern.

Account Deletion

Cherry Tax users can initiate account deletion from the app under Settings > Legal & account, where identity is re-verified before a request is recorded. You can also start a deletion request without the app at the Cherry Tax account-deletion page.

Cherry Money users can request deletion through their account or by emailing info@cherrymoney.co.uk. In-app requests require the current password and return a request reference and pending-review status. Access remains available during review so you can export records; tell us if you also need access suspended. A deletion request covers the Cherry account and associated personal data that is not required to be retained. Because tax and financial services can carry statutory record-keeping, fraud-prevention or regulatory obligations, some records may need to be retained for a defined period. We will tell you when that applies, restrict retained data to the required purpose, and delete it when the applicable retention period ends.

Changes to This Policy

We may update this policy to reflect product, legal or operational changes. When we make changes, we will update the effective date on this page. We will draw material changes to your attention and obtain fresh consent where the law requires it; continued use is not consent to a new purpose.

Contact

For privacy questions, rights requests or security incidents (including suspected loss or unauthorised access), contact Cherry Money using the details below.