Privacy policy
Last updated: 15 November 2026.
1. Who we are and what this notice covers
Statemint keeps your accounting records on your own computer, and we do not receive them. This notice explains the small amount of personal data we do hold, and the optional features that send data to other services.
Statemint is made by Home Brunch LTD ("we", "us"), a company registered in England and Wales, company number 16084993, registered office 915a Honeypot Lane, Stanmore, England, HA7 1AR.
We are the controller, meaning we decide why and how personal data is used, for:
- your Home Brunch account and purchase from homebrunch.co.uk, and your Statemint account and licence in the app, including the computers you activate it on;
- messages you send to our support team;
- information about you that you give us when you buy or ask about Statemint; and
- your pre-registration for Statemint online filing on our website, if you make one.
The books you keep in Statemint are different. You decide what goes into them, and they stay on your computer. Section 11 explains what that means if your books contain other people's personal data.
This notice covers the Statemint app, its licence and account service, your Home Brunch account and purchase, and pre-registration for online filing.
2. What stays on your computer
Everything you enter or import into Statemint is stored on your computer, not on our servers. That includes clients, transactions, invoices, bills, payroll, tax figures, reports and the documents you attach.
- Encrypted at rest. The database and the documents you attach are both encrypted.
- The key stays with you. It is created on your computer and held in your operating system's secure storage. We never receive it.
- Recovery key. Statemint shows you a recovery key and asks you to confirm you have saved it. We cannot recover your data or your key if you lose both.
- Backups. Statemint saves backups on your computer, in the default folder or one you choose. They are encrypted like the database. If you choose a folder that your own cloud storage syncs, that provider's terms apply to the copy.
- Deleting. Settings, Backups, Delete all my data removes the database, attachments, backups and local settings the next time Statemint starts. It does not remove your licence or account (section 8).
Because we hold none of this, we cannot see it, restore it or hand it to anyone.
3. Information we collect and why
We collect only what we need to run your licence and account and to help you when you ask. Statemint contains no advertising or analytics tools, and it does not send usage statistics or crash reports to us.
| Information | When we get it | What we use it for |
|---|---|---|
| Name, email address, password; two-step verification and recovery codes if you turn them on | You create or sign in to a Statemint account | Running your account, logging you in, resetting your password, contacting you about your licence |
| Licence key, client token, plan and expiry | You activate Statemint, and each time it starts | Checking that your licence is valid and which plan you have |
| A device identifier derived from your computer's system ID, the computer's name, whether it runs Windows or macOS, and a public key created on the computer | You activate Statemint, and each time it starts | Tying a licence to the computers it is allowed on, enforcing the plan's computer limit, and blocking copied or stolen licences |
| A six-digit code we email to the address on the licence | You activate or move a licence | Proving you control that mailbox |
| Your name, email address and message | You use the contact form in About, Contact Support | Answering your question |
| Name, email address, billing details and what you ordered | You buy Statemint on homebrunch.co.uk, which creates a Home Brunch account | Taking payment, issuing your licence, keeping our records and contacting you about your order |
| Your name, email address, whether you are a sole trader, landlord, company director or accountant, which filing you would most like (optional), a pre-register code if you have one, and your agreement to be contacted | You pre-register for online filing on our website | Telling you about Statemint online filing, including when it launches and your free year |
| Your IP address and the time of each request | Automatically, when Statemint contacts our licence and account service. Our network provider, which protects that service, records it | Keeping the service secure and finding faults |
We do not collect the contents of your books, your bank statements, your clients' details or your tax figures through any of the above.
4. Features that send data to other services
These features only send data when you use them. Each one goes straight from your computer to the service named, not through our servers.
Statemint AI
Statemint AI reads bank statements, suggests categories, reads receipts and bills, and answers questions in the chat. It is run by our AI service provider, using an account we hold. Here is what each part sends:
- Bank statement import. Statemint first removes the account holder's name and address, and account numbers, sort codes, IBANs, phone numbers, email addresses, postcodes and National Insurance numbers, on your computer. The cleaned statement text is then sent. Names of people or businesses in transaction descriptions are not removed, because Statemint needs them to record each transaction, and they are sent as they appear on the statement.
- Categorising transactions. The description text of each transaction, and whether money came in or went out. Descriptions can contain names of people or businesses, and are sent as they appear.
- Receipt and bill capture. For a PDF with selectable text, Statemint masks account, card, email and phone numbers and sends the text. For a photo or scanned PDF, it sends the image itself, after a one-time notice. You can switch capture off in Settings, AI Prompts.
- Chat. Your question, plus a short briefing about the books you have open: business name and type, your plan, the financial year, VAT status, director's loan balance, estimated Corporation Tax, total income and expenses, the number of overdue deadlines and the selected client's name.
Statemint AI never receives your Statemint account details: your name, email address, licence or device details. Under our agreement with the provider, it may not use this content to train its models, and it keeps it only for a limited period under its own retention policy. Descriptions on a statement can contain names, so avoid importing statements you would not want processed this way.
HMRC
If you connect Statemint to HMRC, you sign in on HMRC's own Government Gateway page. Returns and figures you submit (VAT, Making Tax Digital for Income Tax, Corporation Tax and so on) go from your computer to HMRC. We never receive your Government Gateway details or your returns. We supply the application credentials Statemint needs to talk to HMRC, and HMRC's own privacy notice covers what it does with the data.
Companies House
When you look up or refresh a company, Statemint sends the company number to Companies House and receives the public register entry.
HMRC exchange rates
Statemint downloads HMRC's monthly exchange rates from the UK government's trade tariff service. No personal data is sent, although that service sees your IP address like any website.
Stripe (optional)
If you add a Stripe key in Invoice settings, Statemint asks Stripe to create a payment link for an invoice. It sends the amount, the currency, the invoice number and Statemint's internal invoice number, and no customer details. Later it asks Stripe which links were paid and, if you use Import from Stripe, reads your balance history. Your key is stored encrypted on your computer. Stripe's terms and privacy notice apply to your Stripe account.
Email from Statemint
Invoices, quotes, purchase orders, payment reminders and similar emails are sent through the email account you set up in Settings. They go from your computer to your own email provider, and we never see them.
Contact Support
The form in About, Contact Support sends your name, email address and message through our email delivery provider to our support mailbox. It does not attach your books or log files.
5. How we use your information, and our legal bases
Under UK data protection law we need a lawful basis for each use of your personal data. These are ours:
| What we do | Lawful basis |
|---|---|
| Create and run your account and licence, and sign you in | Contract: we need it to provide Statemint to you |
| Check your licence on each start and tie it to your computers | Contract, and our legitimate interest in stopping copied or shared licences. We keep this to a device identifier and nothing about what you do in Statemint |
| Email you the verification code, and send licence, renewal and security messages | Contract |
| Take payment for Statemint and issue your licence | Contract |
| Answer support messages | Contract, and our legitimate interest in helping our customers |
| Keep the service secure and find faults, using network logs | Legitimate interest in keeping our systems safe |
| Keep records of purchases and invoices | Legal obligation (tax and company law) |
| Keep your pre-registration and email you about online filing, including your free year when it launches | Consent: you agree when you tick the box on the form, and you can withdraw it at any time by emailing [email protected] |
| Use Statemint AI, HMRC, Companies House, Stripe or email features | You choose to use them. Where your books include other people's data, you are the controller (section 11) |
Automated decisions. Licence checks are automatic. They can stop Statemint opening if a licence has expired, been revoked or is used on more computers than the plan allows. If you think that is wrong, contact us and a person will review it. We do not otherwise make automated decisions about you.
6. Who we share information with
We do not sell your personal data. We share it only with the service providers below, who act on our instructions, and where the law requires.
| Provider | What it receives | Why |
|---|---|---|
| Our hosting provider | Account, licence and device details (section 3), and the details you enter on the pre-registration form | Runs our licence and account service, and passes pre-registrations on to us by email |
| Our email delivery provider | The name, email address and message from the support form, the details from the pre-registration form, and your email address and the content of the licence and verification emails we send you | Delivers email |
| Our AI service provider | What Statemint AI sends when you use it (section 4) | Reads statements and receipts, suggests categories and answers chat questions |
| Stripe | Purchase and billing details | Takes payment for Statemint on homebrunch.co.uk |
| Our network and security provider | Your IP address and the details of each request to our licence and account service | Protects and delivers our service, and keeps network logs |
| Our website and shop provider | Your Home Brunch account, order and billing details when you buy on homebrunch.co.uk | Hosts our website, shop and customer accounts |
HMRC and Companies House are not our service providers, and neither is your own Stripe account if you add a Stripe key in the app (section 4). Statemint sends them data on your behalf when you choose to use those features, and each has its own privacy notice.
We may also disclose information to our professional advisers, to courts, the police, HMRC or the ICO where the law requires it, and to a buyer if we sell the business, who would have to honour this notice.
7. International transfers
Some of the services in section 6 may process data outside the United Kingdom. Where that happens, we rely on a transfer mechanism that UK law recognises. Statemint AI is not part of this: it never receives your name, email address, licence or device details, so it sends none of the personal data we hold about you outside the UK (section 4 lists what it does send).
You can ask us for a copy of the safeguards in place (section 10).
8. How long we keep information
Your books are yours to keep or delete at any time. The periods below cover only the account details we hold, and we keep personal data only as long as we need it for the reasons in section 5.
| Information | How long |
|---|---|
| Account, licence and device details | While your account or licence is active, then five years after it ends, after which we delete it |
| Support messages | 24 months after the conversation ends |
| Pre-registration details | Until you ask us to delete them, or 24 months after you pre-register if online filing has not launched by then |
| Network logs (IP address and request times), kept by our network provider | 30 days |
| Emailed verification codes | Expire after 10 minutes |
| Purchase and invoice records | Six years from the end of the financial year they relate to |
| Your books, attachments and backups | They are on your computer, so you decide. Delete all my data removes them |
Delete all my data does not delete your account or free your licence, because people sometimes use it to start their books again. To free a licence, use Move to another computer in Settings, Licence. Closing your Home Brunch account at homebrunch.co.uk does not remove your Statemint app account. We keep your account, licence and purchase details for five years after your account or licence ends, then delete them.
9. Security
The main protection is that your books are not on our servers. For the data we do hold, and for the data on your computer, we use these measures:
- Encryption on your computer. The database and attached documents are encrypted (section 2), and the keys are held in your operating system's secure storage.
- Device-bound licences. Each licence is tied to a key pair made on your computer. The private key never leaves it, and every request to our licence server is signed with it, so a copied licence file or token does not work on another computer.
- Protected secrets. Passwords for your email account, Stripe and similar services are stored encrypted on your computer. Keys for our own services are fetched from our licence server when needed and are not kept in the app.
- Encrypted connections. Statemint contacts our servers, our AI provider, HMRC, Companies House and Stripe over HTTPS. Email uses the security settings of your own mail account.
- Cleaning before AI. Statements are stripped of the account holder's name and address and of account and contact numbers, and receipts of account, card and contact numbers, before leaving your computer (section 4).
No system is completely secure. Please keep your computer up to date, lock it when you are away, and keep your recovery key somewhere safe and separate. If you think your account has been misused, contact us straight away.
10. Your rights
Under UK data protection law you can ask us to:
- tell you whether we hold personal data about you, and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, where we no longer need it;
- restrict how we use it while a concern is looked into;
- give you the data you provided in a portable format, where we use it under a contract;
- stop using it, where we rely on our legitimate interest; and
- review an automated licence decision (section 5).
To use any of these, email us (section 12). We will reply within one month. We may need to check who you are first.
We can only act on data we hold. Your books are on your computer, so for those you already have full control: you can read, correct, export or delete them in Statemint.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11. Your clients and customers
If you put other people's personal data into Statemint, such as clients, customers, suppliers, employees or directors, you are the controller of that data under UK data protection law. If you are an accountant working for clients, you are normally their processor. In both cases you are responsible for having a lawful basis, for telling those people how you use their data, and for answering their requests.
That data stays on your computer, and we cannot see it. The one exception is Statemint AI (section 4): when you use it, the parts described there go to our AI provider.
Files you export from Statemint, such as client packages, reports and backups, are yours to look after. Keep them as carefully as the books themselves.
12. Children, changes and contact
Children. Statemint is business software for adults. We do not knowingly collect personal data from anyone under 18.
Changes. We may update this notice. We will change the date at the top and, for a change that matters to you, tell you in Statemint or by email before it takes effect.
Contact. For any question about this notice or your data, or to use your rights, write to Home Brunch LTD, 915a Honeypot Lane, Stanmore, England, HA7 1AR, or email [email protected].