MileageCalendar ("Company", "we", or "us") respects your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use the MileageCalendar mobile and web application ("App").

1. Information We Collect

We collect the following types of information:

Account information: name, email address, and authentication credentials when you register or log in
Location data: GPS coordinates when you use the journey tracking feature, used solely to calculate mileage
Mileage and expense data: journey records, distances, reimbursement amounts, receipts, and expense details you enter
Work profile information: work patterns, office addresses, and employer details you provide
Calendar data: event titles, start/end times, and locations from connected Google Calendar and Outlook Calendar accounts, used to identify business journeys and calculate mileage
Integration data: tokens and data exchanged with third-party services (Xero, QuickBooks, FreeAgent, Sage, Breathe HR) when you connect them
Usage data: how you interact with the App, including device information and app analytics

2. How We Use Your Information

We use your information to:

Provide mileage tracking, calculation, and reimbursement features
Import calendar appointments from Google Calendar and Outlook Calendar to automatically generate mileage entries
Generate expense reports and export data to connected accounting platforms
Display fuel prices and station information based on your location
Improve the App's features and user experience
Authenticate your identity and secure your account
Comply with legal obligations

3. Google Calendar Data Usage

When you connect your Google Calendar account to MileageCalendar, we request access to your calendar events for the following purposes:

Read access to calendar events: We read event titles, start times, end times, and locations to identify appointments that may involve business travel.
Mileage calculation: We use the location data from your calendar events to calculate the distance travelled for each business journey, enabling you to claim mileage reimbursement.
Journey categorisation: We help you categorise calendar appointments as business or personal journeys for HMRC mileage claims.

We do not modify, create, or delete events in your Google Calendar. We only read event metadata (title, time, location) and never access event attachments, comments, or attendee details. Your calendar data is processed to generate mileage entries and is stored as journey records linked to your account.

You can disconnect your Google Calendar at any time from the App settings, which revokes our access and stops calendar-based mileage import.

3a. Google Limited Use Compliance

MileageCalendar complies with Google's Limited Use requirements. We do not transfer Google user data to any third party unless strictly necessary to provide the features you have requested. We do not use Google user data for serving advertisements. We do not sell Google user data. Your Google Calendar data is used solely for the purpose of identifying business journeys and calculating mileage for HMRC claims, as described in this Privacy Policy. You may revoke our access to your Google data at any time from the App settings or from your Google Account security settings.

4. Outlook Calendar Data Usage

When you connect your Outlook Calendar, we similarly read event metadata (title, start/end times, locations) to identify business journeys and calculate mileage. We do not modify your Outlook Calendar events. You can disconnect at any time from the App settings.

5. Location Data

Location data is collected only when you actively use the journey tracking feature. We use your location to calculate distances travelled. Location data is processed in real time and stored as journey records. You can disable location access at any time through your device settings.

6. Third-Party Services

The App integrates with the following third-party services, each with its own privacy policy:

Google Calendar: for importing calendar appointments to generate mileage entries
Microsoft Outlook Calendar: for importing calendar appointments to generate mileage entries
Intuit QuickBooks: for exporting mileage and expenses as journal entries
Xero: for exporting mileage and expenses to your accounting organisation
FreeAgent: for exporting mileage and expenses to your FreeAgent account
Sage: for exporting mileage and expenses to your Sage accounting organisation
Breathe HR: for submitting expense claims to your employer's HR system
Fuel price providers: for displaying station prices

We do not share your personal information with these services without your explicit consent. Authentication tokens are encrypted at rest and never exposed to the frontend.

7. Data Storage and Security

Your data is stored on secure servers. OAuth tokens for third-party integrations are encrypted using AES-256 before storage. We use industry-standard security measures to protect your information, including encrypted connections (HTTPS) and access controls.

8. Data Retention

We retain your data for as long as your account is active. You may delete your account and all associated data at any time from within the App settings. Upon deletion, your data is removed within 30 days, except where retention is required by law (e.g. HMRC record-keeping requirements).

8a. Data Controller

MileageCalendar is the data controller for the personal data you provide through the App. We are responsible for protecting your data and complying with the UK GDPR and the Data Protection Act 2018. We process your personal data in line with the principles set out in those laws — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

8b. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR to process your personal data:

Contract (Article 6(1)(b)): to provide the mileage tracking, expense recording, and reporting services you have signed up for, including calculating reimbursements and exporting data to your accounting software.
Consent (Article 6(1)(a)): for connecting third-party services such as Google Calendar, Outlook, Xero, QuickBooks, FreeAgent, Sage and Breathe HR, and for any optional analytics. You can withdraw consent at any time.
Legal obligation (Article 6(1)(c)): where we are required to retain records to comply with HMRC Making Tax Digital requirements and other applicable tax or accounting laws.
Legitimate interests (Article 6(1)(f)): to keep the App secure, prevent fraud, and improve our service, where those interests do not override your rights and freedoms.

For special category data, we only process it where you explicitly provide it (for example, health information in a note) and only on the basis of your explicit consent, which you can withdraw at any time.

9. Your Rights (UK GDPR)

Under the UK GDPR and EU GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Erasure of your personal data ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent at any time

To exercise these rights, use the data export and account deletion tools in the App settings or contact us at mileagecalendar@mileagecalender.co.uk.

10. Cookies

The App uses essential cookies and local storage to maintain your session and preferences. We do not use advertising cookies or sell your data to third parties.

11. Children's Privacy

The App is not intended for use by children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, please contact us for removal.

12. International Data Transfers

Your data may be processed in countries outside the UK/EU. We ensure appropriate safeguards are in place, such as standard contractual clauses, to protect your data during international transfers.

12a. Security Breach Notification Process

We take the security of your personal and customer data seriously. In the event of a personal data breach, we follow the process below to meet our obligations under the UK GDPR and HMRC's requirements for Making Tax Digital software.

Internal response: Any suspected breach is reported immediately to our data protection lead, who assesses the scope, severity, and affected data within hours of discovery. We contain the breach, preserve evidence, and record the findings in an internal breach register.

Notifying HMRC: Where the breach affects personal or customer data processed for HMRC Making Tax Digital purposes, we log a support ticket with HMRC within 72 hours of becoming aware of the breach, providing a breach contact name and telephone number as required by the MTD for Income Tax supplier handbook.

Notifying the ICO: Where the breach is likely to result in a risk to the rights and freedoms of individuals, we notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, as required by Article 33 of the UK GDPR. Where the breach is likely to result in a high risk to individuals, we also notify the affected users without undue delay.

Breach contact: To report a suspected security issue, or to contact us about a breach notification, email mileagecalendar@mileagecalender.co.uk with the subject "Security Breach".

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through the App. Continued use of the App after changes constitutes acceptance of the updated policy.

14. Contact

For privacy questions or data requests, please contact us at mileagecalendar@mileagecalender.co.uk.