Privacy Policy

Who we are

Quibo is a product of Allen Living Limited, a company registered in England & Wales (Companies House number 14787139). Allen Living Limited is the data controllerfor the personal data described here, and is registered with the Information Commissioner's Office (ICO) under registration number ZC177345.

If you have any question about your data or this policy, you can reach us at hello@quibo.co.uk.

Bank data and Open Banking

This feature has not launched yet — no bank is connected today.

When you choose to connect your bank, we read your transactions through an FCA-regulated Open Banking provider, and only with your explicit consent. You give that consent through your own bank, and you can withdraw it at any time.

Under Open Banking rules your consent is re-confirmed every 90 days, so access doesn't continue indefinitely without you renewing it. Your bank data is encrypted at rest and we keep it to the minimum needed to prepare your claim — we don't pull in more than the work requires.

Who we share it with

We share your data only with the service providers who help us run Quibo, and only so they can do that job for us. These are the ones handling your data today:

• Supabase, Inc. — Database and private storage for the documents you upload. Processed in Ireland — AWS eu-west-1 (US-incorporated provider). Covered by Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Cloudflare, Inc. — Website hosting and request routing. Processed in Global edge network. Covered by Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Twilio Inc. — Sending you SMS and WhatsApp messages. Processed in United States. Covered by Standard Contractual Clauses with the UK International Data Transfer Addendum.

Planned, but not in use yet

These are the providers we have lined up for features that haven't launched. They hold none of your data today, and we'll update this page before any of them do:

• Anthropic Ireland, Limited — Reading your bank and CIS statements to draft your claim. Would be processed in United States (contracting entity in Ireland). Would be covered by Standard Contractual Clauses covering the onward transfer to the United States.
• Plaid Financial Ltd — Connecting to your bank through FCA-regulated Open Banking. Would be processed in United States (AWS regions). Would be covered by Standard Contractual Clauses with the UK International Data Transfer Addendum.
• Stripe Payments UK Limited — Taking the one-off fee when you file. Would be processed in United States (AWS regions). Would be covered by Standard Contractual Clauses with the UK International Data Transfer Addendum.

We never sell your data. And your refund is always paid into your own bank account — it is never nominated to us.

Where your data goes

Some of the providers handling your data today are based outside the UK, or are US-owned, which means your data can be transferred abroad. Where that happens we rely on the safeguards UK data protection law requires — the Standard Contractual Clauses together with the UK International Data Transfer Addendum — so your data keeps the same protection it has here.

Each affected provider above names its safeguard inline. If you'd like a copy of the safeguards for any of them, email us at hello@quibo.co.uk.

Your rights

You have the right to ask us to:

• see the personal data we hold about you;
• correct anything that's wrong;
• delete your data; and
• withdraw your consent at any time.

To exercise any of these, email us at hello@quibo.co.uk. If you're not happy with how we've handled your data, you can complain to the ICO at ico.org.uk.