Privacy Policy

1. Who we are

Flux is operated by Khanya AI Ltd, a company registered in England and Wales (Company No. 17194319), with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under registration number C1965560.

For any privacy-related queries, email hello@khanya.ai.

2. What data we collect

To deliver the Flux service we collect:

• Your name, email address and phone number.
• Your business name, Unique Taxpayer Reference (UTR) and National Insurance Number (NINO) — these are required for HMRC Making Tax Digital (MTD) submissions.
• Job, customer, invoice, expense, mileage and quarterly submission records you create in Flux.
• Payment data — processed entirely by Stripe. We do not see or store your card details.
• Device and usage data — IP address, browser type, app version and basic interaction events, used to keep the service working and improve it.

2b. Our lawful basis for processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

Contract — Article 6(1)(b)

Processing your name, email, business details, job and invoice data is necessary to deliver the Flux service you have contracted us to provide.

Legal obligation — Article 6(1)(c)

We retain financial records for 7 years as required by HMRC. We share your MTD data with HMRC as required by the Making Tax Digital legislation.

Legitimate interests — Article 6(1)(f)

We process device and usage data to keep Flux secure, fix bugs and improve the service. We have assessed that this processing does not override your rights, freedoms or reasonable expectations.

3. How we use your data

• To provide and operate the Flux service.
• To prepare and submit MTD ITSA quarterly updates and Final Declarations to HMRC on your behalf.
• To send invoices, payment confirmations, MTD deadline reminders and other service emails.
• To improve Flux — debug issues, measure performance and build new features. We never use your customer or financial data to train third-party AI models.
• To comply with our legal and regulatory obligations.

4. Who we share data with

We share the minimum data necessary with the following service providers to deliver Flux:

• Stripe — processes subscription and one-off payments.
• Clerk — handles user authentication and session management.
• Supabase — hosts the encrypted database that stores your Flux records.
• Resend — delivers transactional emails (invoices, confirmations, weekly summaries).
• HMRC — receives your MTD ITSA submissions when you ask us to file them.

We never sell your data, and we never share it for marketing purposes.

5. How long we keep data

• Active accounts — we keep your data for as long as your account is active.
• Deleted accounts — your account data is purged 30 days after you ask us to delete it, giving a recovery window for accidental deletion.
• Financial records — invoices, receipts, quarterly submissions and other records HMRC requires you to keep are retained for 7 years (the minimum HMRC retention period), even after account deletion, as required by law.

6. Your rights (UK GDPR)

You have the following rights over your personal data:

• Right to access — request a copy of the data we hold about you.
• Right to rectification — correct any inaccurate or incomplete data.
• Right to erasure — ask us to delete your data, subject to the HMRC retention requirement above.
• Right to portability — receive your data in a structured, machine-readable format. Settings → Download my data does this in-app.
• Right to object — object to any specific use of your data.

To exercise any of these rights, email hello@khanya.ai. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

7. Cookies

• Flux uses essential cookies only — for authentication, session management and security.
• We do not use advertising cookies.
• We do not run third-party analytics or tracking pixels on Flux.

8. Data security

• Your data is encrypted at rest and in transit.
• Flux is registered with the ICO under registration C1965560.
• Our infrastructure is hosted in the UK and EU (Vercel London, Supabase eu-west-2) so your data does not leave UK/EU jurisdiction.
• Access to production systems is restricted to authorised engineers and logged.

9. Contact us

For any privacy questions, data access requests or complaints: hello@khanya.ai. We respond within 48 hours.

10. Changes to this policy

If we make a material change to this policy we will email all active account holders before the change takes effect. Minor clarifications may be made without notice; the last-updated date at the top of the page reflects the most recent revision.