Who we are

Translucent Ltd (“Translucent”, “we”, “us”) is a company registered in England and Wales, company number 14096714, registered office 86-90 Paul Street, London EC2A 4NE. We provide accounting and reporting software for businesses, accountants and bookkeepers.

For questions about this policy or your personal data, contact [email protected]. To report a security issue, contact [email protected].

How do you use my data?

• When you create and log into your account, we collect your name, email address, phone number, company name and address (if applicable) and your payment details. We collect this to take steps to enter into a contract with you and to let you buy our services.
• When you sign up to receive our news updates, we collect your name and email address to send you updates in line with any preferences you’ve told us about. We rely on your consent to contact you. You can unsubscribe at any time by replying to any email from us.
• When you contact us by phone, email, our “contact us” page or social media, we usually collect your name and contact details, because it’s in our legitimate interest to respond properly to your query.
• When you use our website and consent to cookies, we collect information about how you use our website, to improve it and understand how people use it. Our Cookie Policy has more detail.
• If our business is sold, we process your personal information because we have a legitimate interest in making sure the buyer can continue the business. If you object, the buyer may not be able to provide services to you.

Accounting data we process for our customers

When a customer connects an accounting system such as Xero or QuickBooks, or uploads documents, we process their accounting records to provide our services. These records can include personal data about the customer’s own customers, suppliers and staff, such as names, contact details, bank details and amounts paid or received, and documents attached to transactions such as invoices and receipts.

For this data we act as a processor on our customer’s behalf. Our customer is the controller and decides what data is shared with us. We process it only to provide the services they’ve asked for and as set out in our agreement with them. If your data is held in a Translucent customer’s accounting records and you want to exercise your rights, please contact that business first; we’ll help them respond.

AI features

Some Translucent features, including our accounting agent, use AI models to read and work on accounting data, for example to review transactions, prepare schedules and journals, and answer questions about the books. These models are provided by third-party AI providers and run on Amazon Web Services, Google Cloud or the provider’s own infrastructure. The data is used only to provide the feature you asked for. Our AI providers are contractually bound not to use customer data to train their models, and to keep it for a limited time or not at all. Nothing is posted to an accounting system without a user approving it.

Checking supplier tax registrations

When a user runs a VAT or BAS review, we check the tax registration of suppliers that appear in their client’s accounting records:

• UK: we send the supplier’s VAT number to HM Revenue & Customs and receive back whether it is registered, and the registered name and address. If the user provides their client’s own VAT number, HMRC also returns a reference number confirming the check was made.
• Australia: we send the supplier’s ABN to the Australian Business Register and receive back whether it is active, the registered name and the supplier’s GST registration dates.
• Companies: we may look up UK companies on Companies House’s public register.

We only check suppliers that are already in the client’s records, only when a review is run, and we show the results only to the users reviewing that client. We use this information under our legitimate interest, and our customers’, in making sure VAT and GST are reclaimed correctly. We don’t download these registers in bulk, build copies of them, or sell or publish the results.

Google Sheets integration: how do you use my data?

For the Live Sheets app, our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We require the following permissions:

• See your primary Google Account email address and your personal info, including any personal info you’ve made publicly available, and associate you with your personal info on Google, so that we can identify you.
• See, edit, create and delete all your Google Sheets spreadsheets, so that we can create, edit and keep your spreadsheets up to date.
• Allow this application to run when you are not present, so that we can sync the reports automatically based on your settings.
• Display and run third-party web content in prompts and sidebars inside Google applications, to open a sidebar where you configure your report filters and settings.
• Connect to an external service, so we can bring in data from the accounting platforms you have connected.

Who do you share my data with?

• Business partners, suppliers and subcontractors who help us provide our services, for the performance of our contract with you or with them. These include our hosting providers (Google Cloud and Amazon Web Services), AI model providers, and authentication, payment, analytics and error-monitoring providers.
• Tax authorities and official registers (HMRC, the Australian Business Register and Companies House), only as described in “Checking supplier tax registrations”.
• Regulators, authorities and enforcement agencies, if we have a duty to disclose or share your personal data to comply with a legal obligation, to enforce or apply our terms of use and other agreements, or to protect the rights, property or safety of our clients or others. This includes exchanging information with other companies and organisations for fraud protection.
• Prospective buyers of our business, under our legitimate interest in making sure the business can be continued by the buyer.

Where do you store my data?

We store and process your data on Google Cloud in London. Encrypted backups are stored in Google Cloud data centres in the EU. Our AI features run on the providers’ infrastructure described in “AI features”.

Some of our suppliers may process personal data outside the UK and the EU. Whenever that happens, we make sure it receives the protection required by law, for example a UK adequacy decision or the UK International Data Transfer Agreement or Addendum. Contact us for more information about these safeguards.

How do we keep your data secure?

We encrypt data in transit and at rest, keep each customer’s data logically separate, and limit staff access to what their role needs. Our security controls are independently assessed and we are in the SOC 2 Type 2 audit period, and an independent tester checks our systems for weaknesses (a penetration test) at least once a year.

If you find a security issue, please report it to [email protected].

How long do you keep my data for?

We only keep your personal information for as long as we need it, unless we’re required to keep it longer to meet legal, accounting or regulatory requirements. Customer accounting data is kept for as long as the customer’s account is active and deleted 7 days after the account is closed. If we suspend an account for non-payment, we keep its data for up to 365 days so it can be reopened, then delete it 7 days later. Copies in our backups and system records are deleted automatically within 90 days, and copies in our logs within 1 year.

In some circumstances we may anonymise your personal data so it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you, to improve the way we work and our services.

What happens if there’s a data breach?

1. Notification process. When we discover a data breach, we promptly start an internal investigation to assess its scope and impact. Once we have the necessary information, we notify affected clients in line with applicable laws and regulations.
2. Timing. We aim to notify affected clients promptly. Timing depends on the nature and severity of the breach and the information available, though a thorough investigation or legal requirements can cause delays.
3. Content. Our notification explains the nature of the breach, the types of data affected, the potential risks to clients, and what we’re doing to mitigate the breach and prevent future incidents, in clear and plain language.
4. Channels. We notify affected clients through appropriate channels, such as email or secure in-app messages, prioritising the security and confidentiality of the information shared.
5. Support. We give affected clients resources and support to understand the breach and reduce any potential harm.
6. Reporting to regulators. Where required, we report personal data breaches to the Information Commissioner’s Office within 72 hours of becoming aware of them. If a breach is likely to put people at high risk, we also tell those people without undue delay. Where a breach affects data connected to HMRC services, we also report it to HMRC.

What are my rights under data protection law?

You have various rights under applicable data protection laws, including the right to:

• access your personal data (a “subject access request”);
• correct incomplete or inaccurate data we hold about you;
• ask us to erase the personal data we hold about you;
• ask us to restrict how we handle your personal data;
• receive your personal data in a portable format, or ask us to transfer it to a third party;
• object to how we’re using your personal data; and
• withdraw your consent to us handling your personal data.

You also have the right to complain to us or to the Information Commissioner’s Office, the supervisory authority for data protection in the UK. If you are based in the EU, you can contact your local supervisory authority.

Privacy law is complicated, and these rights won’t always be available to you in every situation.

If you have any questions about this policy, including requests to exercise your rights, contact us at [email protected].

This policy was last updated on 28 October 2026.