Privacy Policy

Last updated: 6 July 2026

Cuenta turns photos of receipts into posted Xero transactions. Doing that means handling some of your information, and this page explains, in plain terms, what we collect, why, who we share it with, how long we keep it, and the rights you have.

1. Who we are

Cuenta ("Cuenta", "we", "us" or "our") is a receipt capture service operated by We UC Ltd. We UC Ltd is a company registered in England and Wales under company number 15200847, with our registered office at Ariadne House, Town Quay, Southampton, SO14 2AQ, United Kingdom. Our VAT registration number is 479947117 (GB479947117).

For anything in this policy, you can reach us at hello@cuenta.so or by post at the registered office above, marked for the attention of the Data Protection Lead.

2. What this policy covers

This policy covers the cuenta.so website, the Cuenta iPhone app, the Cuenta web app at app.cuenta.so, and our early access programme. It explains what personal information we handle, why we handle it, who we share it with, how long we keep it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Cuenta is a tool for businesses. For your business records, including the receipts you upload, your business decides why and how that information is used and we process it on your instructions. For the information described below that we collect to run the service itself, such as your account details and technical logs, We UC Ltd is the data controller.

3. The information we collect

• Account and sign-in information. When you sign in with Xero we receive your name and email address from Xero's identity service. We also generate a device identifier and a session token so the app can talk to our servers securely.
• Receipts. The photos and PDF files you upload, and the details we extract from them: merchant, date, totals, VAT, currency and category. Receipts sometimes incidentally contain personal information printed on them, such as a name on a booking confirmation.
• Xero information. The names of the Xero organisations you connect, their chart of accounts, bank account names and currencies, and the identifiers of the transactions Cuenta creates, so that we can post, update and delete them on your instruction.
• Technical information. Server logs (IP address, timestamps, request details), push notification tokens, and basic diagnostics needed to keep the service running and secure.
• Website visitors. The cuenta.so marketing site sets no cookies and runs no analytics. If you email us, we hold your message and address so we can reply.

4. How we use it, and our legal grounds

• To provide the service: capturing receipts, extracting their details, posting transactions to Xero, showing you your list, and sending you Submitted and Review notifications. Legal ground: performance of our contract with you.
• To keep the service secure and reliable: authentication, access control, logging, abuse prevention and debugging. Legal ground: our legitimate interest in running a safe service.
• To improve Cuenta: understanding failures and fixing extraction mistakes you correct. Legal ground: our legitimate interest in improving the product.
• To meet legal obligations: responding to lawful requests and keeping records we are required to keep. Legal ground: legal obligation.
• We do not sell personal information, and we do not use it for third party advertising.

5. AI processing of receipts

Cuenta reads receipts using an AI model provided by Anthropic (the Claude API). The image or PDF you upload is sent to Anthropic to extract the merchant, date, amounts and category, and the result is returned to us. Under the terms that govern our use of the Claude API, Anthropic does not use this data to train its models. Extraction is assistive: anything Cuenta is not confident about is flagged for your review in plain words, and you can correct any field before it reaches your books.

6. Who we share information with

• Anthropic PBC (United States), which provides the AI extraction described above.
• Xero Limited, the accounting platform you connect. What Cuenta sends to Xero (transactions and receipt images) is governed by your own agreement with Xero.
• Apple Inc., which distributes the iPhone app through the App Store and TestFlight.
• Hosting: the Cuenta backend, database and image store run on infrastructure operated by We UC Ltd in the United Kingdom and the European Economic Area.
• Professional advisers, insurers, courts or authorities where the law requires it or where it is necessary to establish or defend legal claims.

7. International transfers

Where information leaves the UK, for example to Anthropic in the United States, we rely on safeguards recognised by UK law: the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses otherwise. You can ask us for details of the safeguard applied to any specific transfer.

8. How long we keep information

• Account information: for as long as your account is active, then deleted or anonymised within a reasonable period after closure.
• Receipts and extracted data: for as long as you keep them in Cuenta. When you delete a receipt, the record is retained in the audit trail (marked deleted) so that your books remain explainable, and the underlying image is removed from our working storage on our retention schedule.
• Server logs and diagnostics: kept for a short rolling window, typically no more than 90 days.
• We may keep information for longer where the law requires it, for example records relevant to tax or accounting obligations.

9. Security

All traffic between your device and our servers is encrypted with TLS. Access to your data requires a session token issued when you sign in with Xero, and no Xero credentials are ever stored on your phone. Receipt images are held in access-controlled storage, and access to production systems is restricted to the small number of people who operate the service.

10. Your rights

Under UK data protection law you have the right to ask for access to your personal information, to have it corrected or erased, to restrict or object to our use of it, and to receive a copy in a portable format. Where we rely on consent you can withdraw it at any time. To exercise any of these rights, email hello@cuenta.so and we will respond within one month.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve any concern first, but you can go to the ICO at any time.

11. Children

Cuenta is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 18.

12. Changes to this policy

We will update this policy as Cuenta evolves. If a change meaningfully affects how we handle your information we will tell you in the app or by email before it takes effect. The date at the top shows when this policy was last revised.