Privacy policy

The summary above is a plain guide. The full policy below is the complete picture, and it is the version that counts.

Who is responsible for your information

Zappsy is operated by Kernow Accountancy Ltd, a company registered in England and Wales with company number 12125991, whose registered office is at Kernow House, Water-Ma-Trout, Helston, Cornwall, TR13 0LW. The app is built by Fourteen Seed.

Because Zappsy runs a council direct payment scheme, more than one organisation has a role in your information:

• Cornwall Council is the data controller for the EOTAS direct payment information in Zappsy. The council decides why and how this information is used as part of running the scheme.
• Kernow Accountancy Ltd is the data processor. We handle the information on the council's documented instructions, to provide and run the Zappsy service.
• We use a small number of trusted technology suppliers as sub-processors. They act only on our instructions and are listed under “The suppliers we use” below.

If your question is about the scheme itself or a decision about your budget, the council is responsible for that. If it is about how the app stores or protects your information, we can help. Either way, contact us first and we will point you to the right place.

The information we handle

• Family details, such as your name, your child's name, your email address, and the family record you are linked to.
• Financial information, such as receipts and their photographs, bank or account statements you upload, amounts, dates, categories, suppliers, and your budget and how it has been spent.
• Limited location information, such as the start and end postcodes or addresses you enter to work out a mileage distance. Zappsy does not track your location.
• Camera and photo library. The app uses your device's camera or photo library only when you choose to photograph or upload a receipt or statement. Zappsy never looks at your photos in the background.
• Messages and notes between you and your coordinator in the app.
• Sign-in and technical information. You sign in with your email address and a password, and we send a six-digit code to your registered email address to check it is really you. We also keep records of access to the account, basic device information, and error logs, needed to run the app reliably and securely.

Your child and sensitive information

EOTAS support concerns a child, often a child with additional needs. Some of what you upload or write, for example a receipt from a therapist, could reveal something about health, disability, or additional needs. Information like this is treated as special category data under data protection law and given extra protection. We do not ask for health or diagnosis information, and we ask that you include only what is needed to evidence your spending.

How we use your information

We use your information only to provide and run Zappsy:

• Managing your budget and showing what has been spent and what is left.
• Receiving, storing and organising your receipts and statements, and using an automated service to read the supplier, price and date from a receipt photograph, and pick out the VAT details where there are any, so you do not have to type them in. You always check and confirm these details before they are saved, and no decision about you is made automatically.
• Working out mileage distances for journeys you log.
• Letting you and your coordinator message each other.
• Letting your coordinator and our team review, query, and reconcile spending as part of running the scheme.
• Signing you in securely and keeping the service safe and working.

We do not use your information for advertising, we do not sell it, and we do not use it for profiling or automated decisions about you.

Our lawful basis

Under UK GDPR, organisations must have a lawful basis for using personal information. Because Zappsy runs a council scheme, the lawful bases generally flow from Cornwall Council as the controller. For most information this is expected to be the council's public task, and for any special category information a condition under Article 9.

Who can see your information

Zappsy is built so families are kept separate from one another. You can only see your own family's records and files, and other families can never see yours. This is enforced by the database itself, using row-level security, not just by the app screens.

• You, and anyone in your family set up on your account.
• Your council coordinator, for the families they are assigned to, in order to review and reconcile spending.
• The Kernow team who administer the service.
• Fourteen Seed, our technical administrator, only where needed to keep the service running and secure.

The suppliers we use

We use a small number of trusted suppliers to provide the technology behind Zappsy. They act as our sub-processors, only on our instructions, and are not allowed to use your information for their own purposes.

If we add or change a supplier, we will update this list and, where the change is significant, let you know.

Where your information is kept and international transfers

Your account, receipts, statements, and budget records are stored by Supabase in the United Kingdom, in London. Some of our other suppliers are based outside the UK. Where your information is transferred outside the UK, it is protected either by the UK's adequacy arrangements (for suppliers in the European Union) or by the UK approved transfer terms (the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses) under a data processing agreement with each supplier.

• Sentry (error monitoring) stores fault reports in the European Union, in Germany.
• Anthropic (receipt reading) processes the receipt image in the United States. Only the image is sent, with nothing that identifies you or your child.
• Vercel (hosting) may process information in the United States.
• Resend (email) may process your email address in the United States when sending you sign-in codes and other emails.

How we keep your information safe

Zappsy holds financial documents and information about children, so we take security seriously. Our measures include:

• Encryption of your information in transit and at rest.
• Row-level security in the database, so each family can only ever reach its own records and files.
• Secure sign-in with a password and a six-digit code sent to your registered email, and access limited to those who need it.
• Access and activity logging, and checks on uploaded files.
• Regular updates, and procedures to respond to any security incident or data breach.

No system can be guaranteed perfectly secure, but we work to protect your information and keep our measures up to date.

How long we keep your information

Because Zappsy involves public money and financial records, how long information is kept is generally set by the council and by the rules for financial records, rather than chosen by us. We keep your information for as long as needed to run the scheme and meet those requirements, and then delete it securely. If you would like more detail about the periods that apply to your records, email us at hello@zappsy.co.uk and we will tell you.

Your rights

Under UK data protection law you have the right to:

• Be told how your information is used, which is what this policy is for.
• Ask for a copy of your information.
• Have inaccurate information corrected.
• Ask for your information to be deleted, in certain circumstances.
• Ask us to restrict, or object to, certain uses.
• Data portability, in certain circumstances.
• Withdraw consent, where we rely on it for anything.

Because Cornwall Council is the data controller for the scheme, some requests, especially about scheme records, may need to go to the council. Start with us and we will help you direct your request to the right place. You will not usually be charged, and we will respond within the time limits the law sets.

Deleting your account and information

You can ask for your Zappsy account and the personal information held in it to be deleted, and you do not need to be signed in to ask.

• In the app: tap your initials in the top corner to open your profile, then choose Delete my account.
• On the web: follow the steps on our account deletion page, or email hello@zappsy.co.uk.

When you ask us to delete your account, we will delete or anonymise the personal information we hold about you, except where we are required to keep certain records, for example financial records connected to public money, for a set period. Where that applies, we keep only what we must, keep it secure, delete it when the period ends, and tell you what is being kept and for how long.

Children's information

Zappsy is used by parents and carers to manage support for a child, and it necessarily holds some information about that child. We treat children's information with particular care, limit who can see it, and never use it beyond running the scheme. The account is held and managed by the parent or carer, not by the child, and the app is not directed at children.

Cookies and analytics

This website is a simple information site. It does not use analytics or tracking cookies, and it does not profile visitors. Zappsy is an invitation-only scheme, so there is no need for us to track or profile anyone. The app stores only what it needs to keep you signed in securely on your device, and does not track you across other apps or websites.

Changes to this policy

We may update this policy from time to time, for example if the way the scheme works or the technology behind it changes. When we make a significant change, we will update the date at the top and, where appropriate, let you know.

Complaints and contact

If you have any question about this policy or your information, or you want to exercise any of your rights, contact us first and we will do our best to put things right:

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection: online at ico.org.uk, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also raise concerns about the scheme with Cornwall Council as the data controller.