Privacy

Last changed 7 November 2026.

Neon Atlas Ltd runs Hikewatch and is the controller of your personal data under UK GDPR. Company number: 17390701, registered in England and Wales. Registered office: 61a Bridge Street, Kington, HR5 3DJ, United Kingdom. Contact: [email protected].

What we keep

• Your email address, plus your name and picture if you log in with Google.
• Your workspace: the tools you add, their renewal dates and how you pay for them.
• Receipts you forward to your Hikewatch address: the sender, subject, email text and the first PDF attached. We read the vendor, amount, plan and renewal date from them, keep what we read, and delete the email text and PDF after 14 days.
• If you ask for a calendar link, the random code in it, so your calendar app can read your workspace's upcoming bills. Making a new link replaces it.
• If an owner connects Xero or QuickBooks: read-only access to the company's bills and card spending, stored encrypted, and the company's name. Disconnecting deletes the access.
• When you read your bills, the supplier names, line wording, dates and amounts from the last 13 months, kept for the preview until you import, disconnect or a day passes, then deleted. For each tool you import, we keep the date and amount of each bill as its price history.
• If an owner connects HubSpot: access to create tasks in that HubSpot account, stored encrypted, its account number and domain, and the list of its users so you can pick who gets the tasks. Disconnecting deletes the access.
• When you say which tool a supplier in your books is, that supplier's name and the tool. Once two workspaces have picked the same tool for the same supplier name, that name matches the tool for every workspace. Only the name is shared, never amounts or your company.
• If you turn on alerts on a device, the address your browser gives us to reach it and which alerts it shows. Turning them off deletes it.
• A session cookie that keeps you logged in.
• Where you came from when you signed up. The sign-up links on our homepage carry the utm values from the link you arrived by (source, medium, campaign, term and content) and, when you came from another site, that site's origin, never the path or query. If the link had no utm values, the other site's name stands in as the source. When you create an account, we save those values on it. They are included when you download your data. We don't keep them in a cookie between visits.
• A first-party httpOnly cookie named hw_code, kept for about 30 days. It holds a discount code from a link, such as ?code=LAUNCH50, so it can be applied at checkout. A later link with a different code replaces it.
• A record of each email we send you (renewal reminders, price change emails and the Monday digest), so we never send the same one twice, and which kinds you have turned off.
• If you invite someone to your workspace, their email address until they join or the invite expires after 7 days.
• If you pay: your plan, its status, and the customer and subscription ids Paddle gives us. We never see or keep your card details.
• Your email address and IP address against login requests, to limit abuse. We delete these after about an hour.

Why we use it

• To provide the service you signed up for, which is our lawful basis of contract.
• To keep the service secure and stop abuse, which is our legitimate interest.
• To see which posts and sites bring signups, which is our legitimate interest.

We don't sell your data, and we don't use advertising cookies or third-party analytics cookies. hw_code is a cookie we set. We don't send it to advertising networks or analytics companies.

Who processes it for us

• Railway hosts the app and database.
• Cloudflare carries traffic to the site and receives the receipts you forward.
• Resend sends login, reminder, price change, digest and invite emails.
• Paddle sells paid plans as our merchant of record. If you upgrade, Paddle collects your payment details, name, address and tax details under its own privacy notice. Our pricing and billing pages also ask Paddle for prices in your currency, so Paddle sees your connection's IP address to work out your country.
• Anthropic's Claude AI model reads each receipt you forward, and its attached PDF when the email itself has no total. When you read bills from Xero or QuickBooks, it reads their supplier names, line wording, dates and amounts to say which tools they pay for.
• Xero or Intuit (QuickBooks), if an owner connects one, send us the company's bills and card spending under their own privacy notices.
• HubSpot, if an owner connects it, receives a task for each renewal and price rise: the tool's name, price and renewal date. HubSpot holds those tasks under its own privacy notice.
• Google handles sign-in, if you choose it.
• If you turn on alerts on a device, your browser's push service (Apple, Google, Microsoft or Mozilla) delivers each alert's title and workspace name to it.

Some of these companies handle data outside the UK, including in the United States. When the data goes to a country the UK recognises as protecting it adequately, such as an EU country or New Zealand, that recognition covers it. When a US company is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that certification. Otherwise our contract with the company includes the ICO's International Data Transfer Addendum to the EU standard contractual clauses. Email us to ask which applies to a company. We'll update this list before adding anything else that shares your data.

How long we keep it

We keep your account and workspace until you delete them. You can download your data or delete your account from the Account page in the app, or email us and we'll do it.

Your rights

You can ask for a copy of your data, or ask us to correct, delete or stop using it. If you're unhappy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.