Privacy policy
Last updated: 2 November 2026
The short version
- Xelo stores the work, money and tax details you enter so it can show your profit and estimate your tax. That's what your data is used for.
- Your app data is stored on servers in London.
- We never ask for your bank login, and we never sell your data or use it for advertising.
- Nothing is sent to HMRC. Xelo is for tracking and planning only.
- You can delete your account and your data from inside the app at any time.
1. Who we are
Xelo is run by Fanol Thaqi, a sole trader trading as Xelo, based in the United Kingdom. For this policy, we are the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Contact: support@xelo.one
Postal address: [business address]
ICO registration number: [ICO number]
2. What we collect
Information you give us
- Account details: your email address, and your name if you sign in with Apple or Google and choose to share it.
- Work and income: clients, shifts, hours, rates, overtime rules, platform fees and amounts earned.
- Expenses and bills: names, amounts, dates, categories, repeat settings and whether a cost is for business or personal use.
- Photos you add: receipt photos and client logos.
- Tax settings: for example your tax year, region, any salary from a job, student loan plan and your choices about allowances. We use these only to estimate your tax.
- Messages: anything you send us by email or through TestFlight feedback.
Information collected automatically
- Sync information: technical details needed to keep your data in step across devices, such as record IDs and the time a change was made.
- Sign-in information: when you signed up and last signed in, handled by our authentication provider.
- Website logs: our web host keeps standard server logs (such as IP address, browser type and pages requested) for security and to keep the site running.
We don't currently use analytics, advertising or tracking tools in the app or on this website. If we add any (for example crash reporting to fix bugs), we will update this policy before we do.
What we don't collect
We don't connect to your bank, we don't ask for bank login details, and we don't access your contacts, location or other apps.
3. How we use your information
| What we do | Why we're allowed to (lawful basis) |
|---|---|
| Create your account, sign you in and keep it secure | To provide the service you asked for (contract) |
| Store and sync your shifts, clients, expenses and settings across your devices | Contract |
| Calculate your profit, take-home and tax estimates | Contract |
| Send sign-in codes and important account emails (for example, if your email address changes) | Contract |
| Answer your questions and feedback | Our legitimate interest in supporting users |
| Keep backups so your data can be restored if something goes wrong | Legitimate interest in keeping the service reliable |
| Prevent misuse and keep our systems secure | Legitimate interest; legal obligation where it applies |
We don't use your data to make automated decisions that have legal or similarly significant effects on you. Tax figures are estimates shown to you only.
4. Who we share it with
We use a small number of trusted providers to run Xelo. They only process your data on our instructions:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and storage for your app data and photos | London, UK |
| Resend | Sends sign-in code emails | United States |
| GitHub | Stores encrypted database backups | Outside the UK (may include the US) |
| Apple | Sign in with Apple, TestFlight and the App Store | United States and others |
| Sign in with Google (only if you choose it) | United States and others | |
| ImprovMX | Forwards emails sent to our support address | Outside the UK |
| Krystal | Hosts this website | UK |
Where your data is handled outside the UK, we rely on the protections UK law requires, such as adequacy regulations (including the UK–US data bridge) or approved contract clauses.
We will never sell your data. We would only share it with anyone else if the law requires us to, for example in response to a valid legal request.
5. How long we keep it
- While you have an account: we keep your data so the app works.
- When you delete your account: your account, app data and photos are deleted from our live systems straight away. Copies in our encrypted backups are removed automatically within 90 days.
- Unfinished sign-ups: accounts that were never confirmed are deleted after 7 days.
- Photos you remove: photos no longer linked to anything are cleaned up automatically, usually within a week or two.
- Support emails: kept for as long as needed to help you, then deleted.
6. How we protect it
Your data is sent over encrypted connections and stored with encryption at rest. Each account can only see its own data. Backups are encrypted before they're stored. You can also lock the app with Face ID. No system is perfectly secure, but we take reasonable steps to protect your information, and we'll tell you and the ICO if a serious breach ever happens.
7. Your rights
Under UK law you have the right to:
- ask for a copy of your data
- ask us to correct it
- ask us to delete it (you can also do this yourself in the app)
- ask for your data in a portable format
- object to or ask us to restrict certain uses
Email support@xelo.one and we'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.
8. Children
Xelo is for adults managing their own work and tax. It's not intended for anyone under 18, and we don't knowingly collect data from children.
9. Changes to this policy
If we make important changes, we'll update the date at the top and let you know in the app or by email before they take effect.