This Pilot notice explains the roles and data paths visible in the current product. A customer data-processing agreement must complete the production arrangement.
Pilot · plain-language notice assessed 9 October 2026For a hosted service, Predictive Labs Ltd acts as controller for account, support and service-administration data, and as processor for business, customer, supplier and employee data entered by an organisation. The customer remains controller of that organisation data. In a self-hosted deployment, the operator determines its own roles and notices.
The current code uses Google for optional sign-in and Postmark for account, invoice and reminder email when those features are configured. Postmark is not used when its credentials are absent. The repository does not identify the managed-infrastructure provider; any production hosting provider must be named in the customer DPA before production customer data is accepted. Connected accounting, HR or banking providers are customer-directed integrations, not default recipients.
Accounting records are retained according to the customer’s policy and applicable statutory periods: the product roadmap records six years for ordinary UK VAT records and seven years from the end of the financial year for Estonian accounting records, with longer holds where required. Deletion requests cannot silently remove posted ledgers or records under a statutory or legal hold. Planned: automated retention execution for managed hosting.
A self-hoster chooses its data location. In the hosted pilot, Google or Postmark may process data under their own service terms and transfer safeguards. The production DPA must record the hosting location, every subprocessor and any transfer mechanism; this page does not invent a location that is not documented in the repository.
The public site and application contain no analytics or advertising SDK. A deployment may keep operational web, authentication and audit logs needed to run and secure the service. Those logs must not contain provider credentials, and their retention must be documented for production hosting.
For access, correction, deletion, restriction or another data-protection request, first contact the organisation that controls the relevant books. For FastAccounts account or service data, email info@predictivelabs.ai. We may need to verify identity and preserve records that must legally remain.
Contact data protection