Your data stays local by default.

1. Who we are and what this covers

RachelsTools is operated by Comtek Accounts Ltd (company number 03255917). For personal data we receive through the RachelsTools website, account portal, support service or optional synchronisation service, Comtek Accounts Ltd is the data controller.

This policy covers the RachelsTools website, Chrome extension, account portal and optional cloud synchronisation service. It does not replace the privacy policies of Google Chrome, QuickBooks Online, Intuit or Xero. RachelsTools is independent software and is not operated by or endorsed by those providers.

Questions or privacy requests can be sent to hello@rachelstools.com or through our QuickBooks contact page or Xero contact page.

2. Local-first extension processing

RachelsTools works inside the QuickBooks Online or Xero pages already open in your browser. It may read or change page content needed to perform the action you request—for example, duplicating a line, preparing a transaction summary, showing a recent item or opening a related record.

By default, extension settings, favourites, recent lists and temporary working data stay in the browser profile on your device. The extension does not ask for or store your QuickBooks or Xero password, authentication cookies or provider access tokens.

3. Information we may handle

4. Synchronisation is your choice

Cloud synchronisation is off by default. To use it, you must connect RachelsTools to your account, choose the categories you want to sync, review how local and cloud versions will be combined, and select Apply choices and start sync. That is the first point at which eligible extension data is uploaded.

• Settings and favourites: selected settings, RachelsTools favourites and favourite report shortcuts can be shared across your connected computers and, where your account is assigned to a team, with that team.
• Recent history: this is a separate optional category. It remains private to your user account and starts only after your review and consent.
• Local operation: core local extension features continue to work if sync is unavailable or you choose not to use it.
• Disconnecting: disconnecting stops future sync and removes the connection credentials from that browser. Your local preferences remain unless you clear or uninstall them.

Clearing a local recent list does not automatically erase an existing cloud copy while synchronisation remains enabled. You can manage connected computers in the account portal or contact us to request deletion of cloud-held personal data.

5. How synced information is protected

• Data sent between the extension and sync service is protected in transit using HTTPS/TLS.
• Eligible synchronisation records are encrypted at rest using AES-256-GCM, with encryption keys held separately from the database in a managed key vault.
• Extension connection credentials are kept in extension-origin IndexedDB and are not exposed to QuickBooks or Xero page scripts or placed in ordinary page storage.
• Access is scoped to the signed-in user, their authorised devices and, only where applicable, their assigned team.
• We use access controls, key management, monitoring, backups and security updates appropriate to the service.

Synchronisation is not end-to-end encrypted. The service must be able to decrypt eligible records to provide synchronisation, and limited operational metadata—such as record type, routing identifiers and timestamps—may remain visible to the service. No internet service can guarantee absolute security.

6. Why we use information

We process personal data only where there is a lawful basis:

• Contract: to provide the extension, account, subscription, support and optional synchronisation services you request.
• Legitimate interests: to secure and troubleshoot the service, prevent misuse, understand reliability and improve RachelsTools, where those interests are not overridden by your rights.
• Consent or an explicit choice: for optional synchronisation categories or communications where consent is required. You may withdraw that choice, although doing so does not make earlier lawful processing unlawful.
• Legal obligation: where we must retain or disclose information to comply with law, tax, accounting or regulatory requirements.

7. Sharing and service providers

We use carefully selected providers for cloud hosting, encrypted database and key management, account authentication, extension distribution, payments, email and support. They may process information only for the service they provide to us and under appropriate contractual and security controls.

We may also disclose information where the law requires it, to protect users or the service, or as part of a business reorganisation. If personal data is processed outside the United Kingdom, we use an applicable adequacy decision or approved contractual safeguards.

We do not sell personal data, accounting data or synced data, and we do not share it for third-party behavioural advertising.

8. Retention and deletion

• Local extension data remains in the browser until you clear it, remove the browser profile or uninstall the extension.
• Account and sync data is kept while the account or service is active and for as long as reasonably necessary to provide the service, resolve disputes, maintain security and meet legal obligations.
• Support records and technical logs are kept only for as long as needed for support, security, service improvement and legal record-keeping.

After a verified deletion request, information will be deleted or anonymised unless we must retain part of it for legal, fraud-prevention, security or backup purposes. Residual backup copies are isolated from normal use and expire through the backup cycle.

9. Website cookies and payments

The public RachelsTools website does not use advertising cookies or build advertising profiles. Our hosting provider may create basic access and security logs. If you sign in to the account portal or purchase a subscription, essential authentication, security and payment services may process the information needed to complete that request under their own notices.

10. Your controls and rights

You can turn features off, leave synchronisation disconnected, change selected sync categories, disconnect a computer, clear local lists or uninstall RachelsTools. You may also ask us to:

• provide a copy of personal data we hold about you;
• correct inaccurate or incomplete information;
• delete information where the law allows;
• restrict or object to certain processing;
• provide eligible information in a portable form; or
• recognise the withdrawal of consent for an optional activity.

Send requests to hello@rachelstools.com. We may need to verify your identity before acting. You also have the right to complain to the Information Commissioner’s Office (ICO).

11. Children

RachelsTools is a business productivity service and is not intended for children under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy when RachelsTools, our providers or the law changes. We will change the date at the top of this page and provide additional notice where a change materially affects your rights or choices.