Outworx

    Privacy Notice

    Last updated: 26 September 2026

    This notice explains what personal information Outworx collects, why we collect it, who we share it with, and the rights you have under UK data protection law. We have written it to be readable. If anything is unclear, please email legal@outworx.ai and we will explain it in more detail.

    At a glance

    • We are Outworx Ltd, a UK company (company number 17006703), registered with the ICO as a data controller (registration number ZC186598). We operate the Outworx bookkeeping automation platform at app.outworx.ai.
    • We collect only what we need to run the service: account details, the documents you upload (invoices, receipts, bank statements), and data fetched from accounts you connect (banks, Xero, QuickBooks).
    • We use specialist sub-processors (AWS for hosting, Google for AI extraction, and the accounting providers you connect to). We never sell your data or use it for unrelated advertising. We do not use your data, or data received from Xero or QuickBooks, to train, fine-tune, adapt or enhance AI models.
    • You can ask us at any time to see, correct, export or delete your data. Contact our DPO at legal@outworx.ai.
    • You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

    1. Who we are

    Outworx is a service operated by Outworx Ltd, a company registered in England and Wales under company number 17006703. Outworx acts as a data controller for information relating to the administration and operation of your Outworx account, including account registration, billing, support, security and direct communications with you. Outworx Ltd is registered with the UK Information Commissioner’s Office (ICO) under registration number ZC186598.

    Where you use Outworx to process personal data belonging to your customers, suppliers, employees or other third parties, Outworx generally acts as a data processor on your behalf. The relevant customer remains responsible for determining the purposes and lawful basis for that processing. Our Data Processing Agreement applies to this processing.

    • Registered office: Outworx Ltd, 415c Margaret Powell House, Midsummer Boulevard, Milton Keynes, United Kingdom, MK9 3BN
    • ICO registration number: ZC186598
    • General enquiries: general@outworx.ai
    • Data Protection Officer: legal@outworx.ai

    2. The information we collect

    We collect personal information in three ways:

    2.1 Information you give us directly. When you sign up for an Outworx account or contact us, you provide us with your name, business name, email address, phone number, and any details you enter into our forms. If you subscribe, we collect billing information through our payment processor (we do not see or store your full card number).

    2.2 Information you upload or import. When you use Outworx, you upload documents (invoices, receipts, bank statements, supplier statements, expense claims) and connect external accounts (UK banks via Open Banking, Xero or QuickBooks Online via OAuth, and Microsoft OneDrive to import documents). We process the contents of those documents and the transactions returned by those accounts so we can extract structured data, reconcile records and post entries on your behalf. The documents and transaction data may contain personal information about you, your business, your suppliers, your customers and your staff.

    2.3 Information we collect automatically. When you use the website, we log technical information needed to run the service: IP address, browser type, pages visited, timestamps and any errors. We use cookies to keep you signed in and to remember your preferences. See section 9 for cookie details.

    3. How we use your information

    We use your information for the following purposes:

    • To deliver the service — extracting data from your documents, reconciling transactions, posting entries to Xero/QuickBooks, sending notifications you have requested.
    • To manage your account — letting you sign in, securing your account, processing your subscription, sending billing receipts and important service emails.
    • To support you — answering questions you send to support, recording support communications so we can resolve issues.
    • To improve and secure the service — investigating errors, monitoring for abuse and fraud, measuring aggregate usage to prioritise improvements.
    • To comply with our legal obligations — including HMRC, Companies House, accounting and anti-money-laundering rules where applicable.

    We do not sell your personal information, share it for unrelated advertising, or use your documents or any data from connected accounting platforms to train, fine-tune, adapt or enhance any AI model, whether our own or a third party’s (see section 6). Information sent to Google Gemini for extraction is used solely to return a structured extraction result for your document; under our agreement with Google, this content is not retained for model training.

    4. The legal bases we rely on

    UK GDPR requires us to identify a lawful basis for each use of personal information. We rely on:

    • Performance of a contract — to deliver the service you have signed up for and to manage your account.
    • Legitimate interests — to keep the service secure, to investigate fraud or abuse, and to communicate essential service updates. Where we rely on this basis we have weighed our interests against your privacy rights.
    • Consent — where consent is required by applicable law, we obtain consent before sending marketing communications or placing non-essential cookies. Where another lawful basis is permitted, we may rely on that basis instead. You can withdraw consent at any time without affecting the lawfulness of any processing carried out before withdrawal.
    • Legal obligation — to retain financial records required by HMRC and other UK regulators, and to respond to lawful requests from authorities.

    5. Who we share your information with

    We use a small number of carefully selected sub-processors to deliver the service. Each is bound by a written data processing agreement that obliges them to protect your data and process it only on our instructions.

    • Amazon Web Services (AWS) — hosts our infrastructure and stores uploaded documents. Data is held in AWS’s London (eu-west-2) region. AWS is ISO 27001, SOC 2 and UK GDPR compliant. AWS Privacy Notice.
    • Google LLC (Gemini API) — performs AI extraction on uploaded documents. Documents are sent to Gemini and a structured result is returned. To match each document to the correct account, tax rate and supplier, we also send Gemini your chart of accounts, tax rates, tracking categories and contact names from your connected accounting software. Under Google’s API terms applicable to our usage, this data is not used to train Google’s models. Google Privacy Policy.
    • Intuit Inc. (QuickBooks Online) — receives the bills/invoices we post on your behalf when you connect a QuickBooks company. Intuit Privacy Statement.
    • Xero Limited — receives the bills/invoices we post on your behalf when you connect a Xero organisation. Xero Privacy Notice.
    • Twilio Inc. — provides our messaging services: receiving documents you send us by WhatsApp, and sending WhatsApp and SMS notifications where you have opted in. Twilio Privacy Notice.
    • Stripe — processes subscription payments and stores billing details. We never see your full card number. Stripe Privacy Policy.
    • Microsoft Corporation — provides email services and, when you connect OneDrive, lets us read the documents you import from it. We never see or store your Microsoft password. Microsoft Privacy Statement.
    • Better Stack — application logging and uptime monitoring, used to detect and fix errors. Better Stack Privacy Policy.

    Where we process data about your own clients on your behalf, our Data Processing Agreement applies and lists the sub-processors we use for that data.

    We may also share information when required by law (for example, in response to a court order or a lawful request from HMRC), or to protect the rights, property or safety of Outworx, our customers, or others. If we ever sell or restructure our business, your information may transfer to the new owner; in that case we will tell you and the same protections will continue to apply.

    6. Data from Xero and other connected accounting software

    When you connect a Xero organisation (or a QuickBooks Online company) to Outworx, you authorise us through the provider’s secure sign-in (OAuth 2.0). We never see or store your Xero password. This section explains how we handle the data we receive through that connection (“Xero data”).

    • What we collect. Only the data needed for the features you use: organisation details, chart of accounts, tax rates, tracking categories, contacts (suppliers and customers), bank accounts and transactions, and bills, invoices and payments. We request only the access permissions (scopes) those features need.
    • Why we use it. To match and code your documents to the right accounts, suppliers and tax rates; to reconcile transactions; to detect duplicates; and to post bills, invoices and other records to Xero when you approve them.
    • How we store it. Xero data is stored encrypted on our infrastructure in AWS’s London region, protected by the measures in section 11. Access tokens are encrypted and used only to call Xero on your behalf.
    • Who we share it with. Only the sub-processors listed in section 5 (and in our Data Processing Agreement), acting on our instructions and only where needed to provide, secure or support the Service, including Google Gemini to match documents to your chart of accounts. By connecting Xero, you consent to this processing. We do not sell Xero data, use it for advertising, aggregate it across customers, or supply it to any other app or third party for its own purposes.
    • No AI training. We do not use Xero data, or any other data received from a connected accounting platform, to train, fine-tune, adapt or enhance any artificial intelligence or machine-learning model, whether our own or a third party’s.
    • Disconnecting. You can disconnect Xero at any time from your Outworx settings or from the Connected Apps page in Xero. When you disconnect, we delete our access tokens and can no longer access your Xero organisation. Xero data already held in your Outworx account is kept and deleted under section 8. You can ask us to delete it sooner by emailing legal@outworx.ai.
    • Data we send to Xero. Once records we post on your behalf reach Xero, Xero’s own Privacy Notice and terms apply to them, not this notice.

    Xero is a trade mark of Xero Limited. Outworx is an independent product and is not owned, operated or endorsed by Xero.

    7. International data transfers

    Outworx is hosted in the UK. Some of our service providers are located outside the UK or may process personal information from locations outside the UK. Where a restricted transfer is involved, we use a legally recognised transfer mechanism under UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

    Details of the relevant safeguards and applicable transfer mechanisms for our sub-processors are listed in our Data Processing Agreement or available on request.

    8. How long we keep your information

    We keep your data only for as long as we need it. Our standard retention periods are:

    • Active account data — for as long as your account is active.
    • After you close your account — personal account data is deleted within 90 days, except where we are required to retain it by law.
    • Financial records required by HMRC — retained for 6 years from the end of the relevant accounting period, then deleted.
    • Lead and prospect data — retained for up to 12 months from your last interaction, then deleted.
    • Support communications — retained for up to 3 years.
    • Server access logs — retained for up to 90 days.

    You can ask us to delete your data sooner by contacting our DPO. We will comply unless we have a legal obligation to retain it.

    9. Cookies

    Outworx uses a small number of cookies. The essential ones keep you signed in, remember your selected client/organisation, and maintain your preferences. We do not use advertising cookies. If we add analytics or non-essential cookies in future, we will ask for your consent before placing them.

    10. Your rights

    Under UK data protection law, you have the following rights. To exercise any of them, email legal@outworx.ai. We will respond within one month and we will not charge you for ordinary requests.

    • Right of access — to be told what personal information we hold about you and to receive a copy.
    • Right to rectification — to have inaccurate or incomplete data corrected.
    • Right to erasure — to have your data deleted, subject to any legal obligation we have to retain it.
    • Right to restrict processing — to ask us to stop using your data while a query is being resolved.
    • Right to data portability — to receive your data in a structured, machine-readable format and have it transferred to another provider.
    • Right to object — to object to processing based on our legitimate interests, or to direct marketing.
    • Rights related to automated decision-making — Outworx’s extraction and reconciliation are tools to assist human decision-making, not to make decisions about you on their own. You always have the final say on what is posted to your accounts.

    If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner’s Office:

    11. How we keep your information secure

    We take the security of your data seriously. The measures we have in place include:

    • Encryption in transit using TLS 1.2 or higher for all connections.
    • Encryption at rest for the database and document storage.
    • Role-based access controls so that only staff who need access to your data have it.
    • Multi-factor authentication for all administrative access.
    • Regular vulnerability scanning and dependency monitoring.
    • Backups stored in the same region with the same access controls and encryption.
    • Audit logs for sensitive actions in the system.

    No service can promise absolute security, but if we ever become aware of a personal data breach that is likely to affect you, we will tell you and the ICO without undue delay, in line with UK GDPR.

    12. Children

    Outworx is a service for businesses and is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact legal@outworx.ai and we will delete it promptly.

    13. Changes to this notice

    We may update this notice from time to time. The “last updated” date at the top of the page will reflect any change. If a change materially affects how we use your data, we will notify you by email before it takes effect.

    14. Contacting us and complaints

    If you have any questions about this notice, or about how we handle your data, please contact us:

    • General enquiries: general@outworx.ai
    • Data Protection Officer: legal@outworx.ai
    • Postal address: Outworx Ltd, 415c Margaret Powell House, Midsummer Boulevard, Milton Keynes, United Kingdom, MK9 3BN