Privacy policy
BusyMoss is built so your business records stay with you. This page explains the small amount of personal data we do hold, why, and what you can ask us to do with it.
1. Who we are
The data controller is [FULL LEGAL NAME OR COMPANY NAME] [trading as BusyMoss / company number 00000000], [REGISTERED OR POSTAL ADDRESS]. ICO registration number [ZA000000].
For anything about your data, email [email protected] or use our contact form and choose "Privacy or my data".
2. Your business records are not sent to us
The customers, jobs, receipts, expenses, payroll, employee details and photos you keep in BusyMoss are stored on your device, in a file in your own cloud storage (such as OneDrive, Dropbox or Google Drive), or on your own server. They don't come to us and we can't see them.
- For that information, you are the controller. You're responsible for handling your customers' and staff's data lawfully, and for your own cloud storage or server provider.
- Reading a receipt photo happens on your device. The photo isn't uploaded to us.
- When BusyMoss cloud opens, businesses that choose it will have their records hosted by us, as their processor, under a separate data processing agreement.
3. What we hold
| What | Details |
|---|---|
| Your account | Name, email address, password (stored only as a secure hash), two-step sign-in settings, and sign-in sessions, which include the IP address and browser or device type used. |
| Trial and licence | When your trial started, your licence key and plan, the names and IDs of devices you've used and when they last checked in, and, if you run your own server, that server's address. |
| Purchases | Your email, the plan, the price, the date and PayPal's order reference. PayPal handles the payment itself; we never receive your card details. |
| Support | Support tickets you send from the app, messages you send through our contact form (name, email, topic and message), and our replies. |
| Invitations | When a business owner invites someone, the email address they enter, so we can send the invitation. |
| Google sign-in | Only if you choose "Sign in with Google": the name, email address and profile picture Google shares with us. |
Our website, busymoss.com, doesn't use analytics, tracking or advertising tools.
4. Why we use it, and our legal basis
- To provide your account, trial and licence, count devices, send your licence key and sign-in codes, and answer support requests about them. Legal basis: our contract with you.
- To keep accounts secure: two-step sign-in, spotting misuse of keys or trials, and limiting repeated or automated requests. Legal basis: our legitimate interests in protecting you and BusyMoss.
- To answer contact form messages from people who aren't customers yet. Legal basis: our legitimate interests in replying to you.
- To keep sales records as tax law requires. Legal basis: legal obligation.
- To tell you about important changes to BusyMoss or these terms. Legal basis: our contract with you. We won't send you marketing emails unless you've agreed to them, and you can stop them at any time.
We don't sell your data or use it for advertising.
6. Outside the UK
Where a provider handles data outside the UK, we rely on UK adequacy regulations (including the UK–US data bridge for certified US companies) or the UK International Data Transfer Addendum to the EU standard contractual clauses, so your data keeps an equivalent level of protection.
7. How long we keep it
- Account, trial, licence and devices: while your account is open. If you ask us to delete it, we do so within 30 days, except what we must keep for tax.
- Purchase records: 6 years after the end of the tax year of the sale, as HMRC requires.
- Support tickets and contact messages: [CONFIRM: e.g. 2 years after the conversation ends].
- Sign-in sessions: until they expire or you sign out. A "don't ask again on this device" setting lasts at most 30 days.
- Inactive accounts with no licence: [CONFIRM: e.g. deleted after 2 years without sign-in, with an email warning first].
8. Keeping it safe
Everything travels over encrypted connections. Passwords are stored as hashes, never as text. Two-step sign-in is available for every account and required for our own staff. Licences are checked with signed passes, and only a few named people at BusyMoss can see account details, with each action logged.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that's wrong;
- delete your data, including your account;
- restrict or object to how we use it, including anything based on our legitimate interests;
- give you your data in a format you can move to someone else.
Email [email protected] from the address on your account. We'll reply within one month and won't charge you. We may need to confirm it's you first.
If you're unhappy with how we've handled your data, please tell us. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
BusyMoss is for businesses and isn't intended for anyone under 18.
11. Changes
We'll update this page if what we do with data changes, and email account holders about significant changes before they take effect. The date at the top shows the latest version.