What Brenda holds about you, why, and what you can ask for.
Sonic Blue Tech Ltd is the data controller. Last updated 7 September 2026.
Your account. Your name, email address, and a hashed password. If you turn on the second step at sign in, a secret shared with your authenticator app.
Your business. What it does, whether it is registered for VAT and its VAT number, your National Insurance number if you give it, how you account, and the answers you gave when setting up.
Your records. Every transaction you enter or import: dates, amounts, categories, who you paid and who paid you. Bank statements and card processor reports you upload. Receipts and invoices you photograph, upload or forward by email, including the images themselves.
Your connection to HMRC. Access tokens that let Brenda act for you, and a record of every call made on your behalf, including what was submitted.
How you connected. Your IP address, an identifier for your device, your screen and window size, your browser and your timezone. There is a section on this below, because it is required by law rather than chosen by us.
Everything below is one of these. Nothing is done on a basis that is not listed.
| What for | Lawful basis |
|---|---|
| Keeping your books, producing your figures, reading your receipts, and filing where you ask. The service you are paying for. | Contract. We cannot do what you signed up for without it. |
| Sending HMRC information about the device a filing came from. | Legal obligation. HMRC requires this of any software that files, and publishes the requirement. We cannot file without it. |
| Keeping your records for six years after the tax year they relate to. | Legal obligation. How long tax records have to be kept. |
| Keeping the service secure, and being able to answer what happened if a submission is ever questioned. | Legitimate interests, being the security of the service and the ability to account for a filing made in your name. We think you would expect this, and you can object. |
We do not rely on consent for any of the above, so there is nothing here you need to agree to and then cannot withdraw. We do not sell your data and we do not use it for advertising.
Sonic Blue Tech Ltd is responsible for the personal data described here and for keeping it safe. HMRC access tokens are encrypted before they are stored, because they are the ability to file a return as you. Passwords are hashed and never stored as text. Everything travels over an encrypted connection. Receipts are encrypted where they are stored. Every query that reads your records carries your account with it, so one customer's books cannot be returned in answer to another customer's request.
If something goes wrong we will tell you, and we will tell the Information Commissioner's Office and HMRC where we are required to. To report a security problem to us, write to security@brenda.finance.
Receipts are sent to a model provider to be read. When you upload or forward a receipt or invoice, the image or PDF is sent to Anthropic so the text can be extracted, and so is the text of any website you ask Brenda to look at. Anthropic processes it on our instructions and does not use it to train models. Processing may take place outside the United Kingdom. This is worth knowing before you forward a document, which is why it is not buried further down.
HMRC. The figures you file, and the device information described below. This is the point of the service.
Our hosting and storage providers, who hold the database and the documents.
Our email provider, which receives receipts forwarded to your Brenda address before passing them to us.
Stripe, if you are on a paid plan, which handles the payment. We never see or store your card details.
HMRC requires this and publishes the requirement. Every time Brenda files for you, it sends your IP address, an identifier for the device you used, your screen and window size, your browser, your timezone, and whether you used a second step at sign in.
It is there to make tax fraud harder. We cannot file for you without it, and we send it only to HMRC.
Each business gets its own forwarding address. Mail sent to it is only read if it comes from an address you have listed and passes its sender check. Anything else is recorded as refused and not processed, so we keep a note that a message arrived and from where, without acting on it.
A receipt or an invoice usually names somebody else: a supplier, or one of your customers. When you put those into Brenda we hold that information on your instructions, for the purpose of keeping your books. We do not use it for anything else. If you need a data processing agreement covering that, ask and we will provide one.
Your records: six years after the tax year they relate to, because that is how long tax records generally have to be kept. This applies even if you close your account, and it is a legal obligation rather than a preference.
Your account and connection to HMRC: deleted when you close your account.
Everything else, including logs of calls made to HMRC on your behalf: kept for as long as it may be needed to answer a question about a submission.
You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to how we use it. You can also complain to the Information Commissioner's Office.
You do not have to ask us for a copy of your receipts: you can take them out yourself, as a zip with an index, from your own account, at any time.
Deletion has a limit, and it is worth saying plainly: where we are required to keep tax records, we cannot delete them on request. We can delete everything that is not covered by that.
Sonic Blue Tech Ltd, The Old Dairy, 1 Whitebushes, Redhill, Surrey, RH1 5LN. Company number 12789740.
For anything about your data, including the requests above: privacy@brenda.finance.