Legal
Privacy notice
Version 1.0 · Last updated 11 November 2026
This notice explains how personal information is used when you visit the VexLedger website, contact us, or use VexLedger. It is written in plain English. To make a privacy or data request, use our contact form and choose A privacy or data request.
Who we are
VexLedger is a trading name of NORTHLIGHT MEDIA LTD, registered in England and Wales, company no. 16897842. Our registered office is 86-90 Paul Street, London EC2A 4NE. We are registered with the Information Commissioner’s Office (ICO), registration number ZC264384. In this notice “we”, “us” and “VexLedger” mean that company.
Two different roles
We are the controller (we decide why and how the information is used) for:
- people who visit our website or contact us;
- the account details of people who use VexLedger (who they are, what they can access, how they sign in);
- security and service records.
We are a processor (we act on a business’s instructions) for the accounting records a business enters into VexLedger, such as the names and contact details of its customers and suppliers, invoices, bills, bank transactions and notes. The business using VexLedger decides what to put in and is the controller of that information. We handle it under our data processing addendum.
If you are a customer or supplier of a business that uses VexLedger and you want to exercise a right over information held in its books, contact that business first. We will help it respond.
What we collect, why, and our legal basis
| When | What | Why | Legal basis |
|---|---|---|---|
| You use the contact form | Your name, email address, business name, what you want to talk about, your message, and signals used to check you are a person (such as your IP address) | To reply to you and to stop the form being abused | Our legitimate interests in answering enquiries and keeping the form secure; steps you ask us to take before a contract |
| You have a VexLedger account | Your name, email address, your organisation, the brands you can access and your role, your password (kept only in a scrambled, one-way “hashed” form), and your two-step sign-in settings | To set up your account and control who can see what | Performing our contract with the business that gave you access; our legitimate interests in keeping accounts secure |
| You sign in and use VexLedger | Sign-in sessions, times, IP address and device information, and a record of changes made in the books (who did what, and when) | To keep accounts and books secure, to prevent fraud and misuse, and to provide the audit trail businesses rely on | Our legitimate interests; performing our contract |
| We send you service emails | Your name and email address | To send invitations, password resets, security notices and, on a customer’s instructions, invoices and quotes | Performing our contract; the customer’s instructions |
| The law requires us to keep records | Information we must keep for tax, accounting or legal reasons | To meet our legal obligations | Legal obligation |
We do not use advertising or analytics tracking on our website, we do not sell personal information, and we do not make decisions about individuals by automated means that have legal or similarly significant effects.
Features that read documents
If a business uses a feature that reads documents such as receipts, the content of the document is sent to an artificial intelligence provider to extract details like the supplier, date and amount, and the result is returned to the business. This happens only when the feature is used.
Who we share information with
We use trusted providers to run VexLedger. They process information for us under contract:
- Cloudflare, which hosts VexLedger, stores its data and protects it and our forms from attack and abuse.
- Amazon Web Services, which delivers the emails we send (from its London region).
- Anthropic, which provides the document-reading feature described above.
At a customer’s direction, VexLedger exchanges information with services the customer chooses to connect, such as Stripe, GoCardless, a bank-data provider for bank feeds, HMRC and Companies House. Those services have their own privacy notices.
We may also share information with professional advisers, with regulators, courts or law enforcement where the law requires it, and with a buyer if our business is sold. The current list of providers that process customer data is on our sub-processors page.
Where information is stored
The database that holds accounting records and account details, and the storage that holds uploaded files such as receipts, are in the European Union, and the application code that processes them runs in the EU. The public website is delivered from Cloudflare’s global network, close to each visitor, and connections reach VexLedger through that network before being passed to the EU. The EU is covered by UK adequacy regulations.
Transfers outside the UK
Some of our providers process information outside the UK. Where that happens we use only providers that offer lawful transfer safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
How long we keep information
| Information | How long |
|---|---|
| Contact form messages | Up to two years after your last message |
| Account details | While the account is active. After an account is closed, 12 months, so the business can reopen it or ask for its data, and then they are deleted |
| Backup copies | Removed within 90 days after the live data is deleted |
| Sign-in sessions | A sign-in lasts for up to seven days, then expires |
| Technical and security logs | A limited time, normally weeks, unless we need them to investigate a security incident |
| Our own financial records | Six years, which is how long the law requires us to keep them |
| Accounting records and the audit trail | These belong to the business that entered them. They are kept while its account is active and for as long as the law requires businesses to keep accounting records. Posted entries are never edited or deleted in place; corrections are made by reversal so the history stays complete |
Your rights
You have the right to ask us to give you a copy of your personal information, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent you may withdraw it. We answer within one month.
- If you have a VexLedger account, you can download your personal data and erase your account yourself from your account page. Erasing your account removes your sign-in and anonymises your name and email. Accounting records are kept for the legal retention period without identifying you, because businesses are required by law to keep them.
- Otherwise, use our contact form and choose A privacy or data request. We may ask you to prove who you are.
Complaints
If you are unhappy with how we have handled your information, tell us through the contact form. We acknowledge complaints promptly and aim to reply in full within 30 days. You can also complain to the ICO, the UK’s data protection regulator, at ico.org.uk/make-a-complaint.
Keeping information safe
Passwords are stored hashed, never in plain text. Sign-in can be protected with a code from an authenticator app. Access is limited by role and by brand, connections are encrypted, and changes to the books are recorded in an audit trail. Read more on our security page.
Children
VexLedger is for businesses and is not aimed at children.
Changes to this notice
If we change this notice in a way that matters, we will update the date and version above and tell account holders in the service or by email.