Legal

Privacy Policy

Version 1.0 · Updated 24 August 2026 · Borun Studios Ltd

In short

Takin helps you organise your own income, expenses and mileage and prepare your monthly Universal Credit report. To do that it holds financial information, and, if you turn it on, your work mileage.

The part to know before any other: when you import a bank statement, a receipt or a screenshot, an AI reads it. The file goes to Google, or to Anthropic if Google cannot read it, and it is read outside the UK. This is the one place the financial detail itself leaves the country. It happens only to a document you choose to import, and nothing goes to an AI unless you import one. You can type your figures in by hand instead.

We do not sell your data. We do not use it for advertising. We never show on a notification that you are a Universal Credit claimant.

The rest stays closer to you. Your data is on your phone first, and on our servers as well once you are signed in, so it survives a lost phone and reaches your other devices. The sections below name every company that touches your data and the country it is in, and explain what we hold, why, the law that allows it, how long we keep it, and the rights you have.

This policy is version 1.0, effective 24 August 2026.

Who we are

Takin is provided by Borun Studios Ltd, a company registered in England and Wales (company number 16757096, registered office Flat 28 Ravensbourne Court, 1 Amias Drive, Edgware HA8 8EY, United Kingdom). We are the data controller for the information described here, and we are registered with the UK Information Commissioner’s Office (ICO) under fee-registration reference ZC161251.

We operate Takin and the website gotakin.com. For anything about your data, or to use any of the rights below, contact us at info@borunstudios.co.uk.

What we use, why, and the law that allows it

Under UK data protection law we must have a lawful basis for each way we use your data. Here is each purpose, the data it uses, our lawful basis, and how long we keep it.

Running Takin for you

What: your account details, and the money, mileage and documents you put in (transaction amounts, dates, descriptions, the categories you pick, and business or personal flags).
Why: to give you the app you signed up for, and back it up and sync it across your devices.
Lawful basis: performance of our contract with you.
How long: until you delete it, or delete your account.

Reading your documents

What: the statement, receipt or screenshot you import or email in, and the figures read from it.
Why: to save you typing, by pulling out the amounts, dates and likely categories.
Lawful basis: performance of our contract with you (you asked us to read the document).
How long: receipts are kept as your own proof of an expense. A statement file is kept so we never read the same one twice, and until you delete your data or your account, at which point it is deleted with everything else. Of an email you send in, we never store the body: only the attachment, and who it came from and its subject line, which we use to label it for you.

Keeping your account secure

What: your sign-in details and phone number, and basic security records.
Why: to send a one-time code, sign you in, check that a statement emailed in came from your registered address, and prevent fraud and abuse.
Lawful basis: our legitimate interest in a secure, working service, and, for the sign-in code, our contract with you.

Logging your mileage

What: your device’s location while you drive for work.
Why: to log your work miles and measure the distance (see Location and mileage below).
Lawful basis: your consent, which you can withdraw any time by turning mileage off.

Sending you updates

What: your email address.
Why: to send occasional updates, only if you ask for them.
Lawful basis: your consent, which you can withdraw any time.

Providing your account details is necessary to give you an account and sync your data. Location and marketing are optional, and the app works without them.

Where your data is processed and stored

Your data lives on your phone first. When you are signed in, it is also stored on our servers so it survives a lost phone and reaches your other devices.

Your account and transaction data: our database (Supabase), in the EU.
Your statement and receipt files: our file storage (Cloudflare R2), in the EU.
Reading a document: the file is sent to our reading service, which passes it to an AI model run for us by Google, or by Anthropic if Google cannot read it. Anthropic processes it in the United States. Google does not commit to a country for this service, so it may be processed outside the UK and the EU.
Tidying a route: your trip coordinates are sent to our own map server in the EU.

Importing a document is the one place where the financial detail itself leaves the UK and the EU. The other providers below process only limited data outside the EU. See Sending data outside the UK.

Who helps us run Takin

We use a small number of trusted providers (processors) to run the service. They act only on our instructions and may not use your data for their own purposes:

Supabase, for the database, sign-in and sync (EU).
Cloudflare, for file storage, our inbound email address, and route map-matching (EU).
Google, for the AI model that reads your documents (US).
Anthropic, for the AI model that reads your documents when Google cannot (US).
Apple and Google, for sign-in and, on the App Store, subscriptions (US).
Twilio, to send a one-time code to your phone when you sign in by phone (US).
Brevo, to send a one-time code to your email address when you sign in by email (EU).
RevenueCat, to manage your subscription status (US).
Expo, to deliver app notifications to your device (US).

We do not sell your data to anyone, and we do not share it with advertisers or data brokers.

Sending data outside the UK

Some of the providers above are outside the UK. Two kinds of data leave it, and they are not the same size, so we separate them.

The document you import. When you import a statement, receipt or screenshot, the file itself goes to Google’s AI, or to Anthropic’s if Google cannot read it, so it can be read. That file carries what is printed on it: the dates, amounts, payees and balances. This happens only for a document you choose to import, and it is the largest thing that leaves. Anthropic processes it in the United States. Google does not commit to a country for this service, so it may be processed elsewhere.
Everything else, which is small. Apple and Google (sign-in and subscriptions), Twilio (your phone code), RevenueCat (subscription status) and Expo (notifications) are in the United States and process only limited data such as your phone number, sign-in identifiers, subscription status and notification token. Brevo (your email code) processes your email address in the EU.

Where data goes outside the UK, we rely on the transfer safeguards UK law requires: the UK Extension to the EU Standard Contractual Clauses (the UK Addendum) or the UK International Data Transfer Agreement, or the UK-US Data Bridge where the provider is certified under it and the transfer is to the United States. You can ask us for a copy of the safeguards for any provider by emailing info@borunstudios.co.uk.

AI and automated reading

To save you typing, Takin uses automated processing, including an AI model, to read your statements, receipts and screenshots and suggest amounts and categories.

This reading can be wrong. It may misread a number, miss a row, or pick the wrong category. Nothing it suggests is applied to your figures until you review and confirm it, so a person, you, always makes the final decision. It is not used to make any decision about you, and it is not used for advertising or profiling. You can ask us to review any automated processing by emailing us.

You should always check the figures yourself before you report anything to the DWP or HMRC.

Location and mileage

Location is only used if you turn mileage on, and only to log the miles you drive for work.

Your location is recorded on your device as you drive. To turn a raw track into a clean route and an accurate distance, the trip’s coordinates are sent to our own map server (self-hosted, in the EU). We use this only to tidy your route and measure the distance. We do not share your location with advertisers, and we do not track you when you are not recording a drive.

You can turn mileage and location off at any time in Settings, and in your phone’s settings.

How long we keep your data

Data on your phone stays there until you delete it or remove the app.

Data we sync stays until you delete your account. We do not delete your financial history if you stop paying: on the free plan we keep everything you recorded and simply limit how far back you can view and export it.

When you delete your account, we delete your synced data and your stored files, and we remove them from our routine backups within 30 days. The app’s own diagnostics are kept for 90 days and then deleted, and a diagnostics log you choose to send us for support is kept only as long as needed to resolve the issue. We may keep the minimum necessary for longer where the law requires it, or to establish or defend a legal claim.

You can delete your account, and its synced data, inside the app under your profile.

Your rights

Under UK data protection law you have the right to:

be told how your data is used (this policy);
see the data we hold about you;
correct it if it is wrong;
have it deleted;
restrict or object to how we use it;
receive a copy in a portable form;
withdraw any consent you gave (such as for location or marketing), without affecting what we did before.

To use any of these, email us at info@borunstudios.co.uk. You can also delete your account and its synced data yourself, inside the app.

Cookies and analytics

The app does not use advertising, and it does not use third-party advertising or analytics trackers to profile you. There is no third-party analytics in the app at all: the only diagnostics are our own, described below, and they stay on our own servers in the EU. The gotakin.com website uses only the cookies needed to make it work.

Diagnostics

So we can find and fix problems, the app keeps a short record of what it did: things like “the bank import ran and saved 62 transactions”, “reading Apple Wallet failed”, or “syncing a table did not work”. Each entry has the app version, the phone’s operating system, and a random code for the handset that we create ourselves and that says nothing about you or your device.

These records are sent to our own servers in the EU while you are signed in, so we can look into a problem without asking you to describe it.

They never contain the details of your money or your life. No amounts, no shop or company names, no addresses or postcodes, no locations, and nothing about your claim. The app strips anything of that kind out before an entry is stored, let alone sent. Your transactions, your journeys and your report are not part of this and are only ever synced as described above.

Our lawful basis is our legitimate interest in keeping the app working correctly for you. We keep these records for 90 days and then delete them. They are deleted with the rest of your data if you delete your account, and you can ask us to delete them at any time.

Keeping your data safe

Your data is encrypted in transit, stored on your own phone and on our servers in the EU (with the processing outside the UK described above, including the AI reading of any document you import), and access to our systems is restricted. No system can be guaranteed perfectly secure, but we take protecting your financial information seriously and design the app to keep as much as possible on your own device. If a data breach ever put your rights at risk, we would handle it as UK law requires, including telling the ICO and, where needed, you.

Children

Takin is for adults managing their own self-employment and Universal Credit. It is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy as the app changes. When we do, we will change the version and date below, and for important changes we will tell you in the app.

Version 1.0. Last updated: 24 August 2026.

How to contact us and complain

For any question, request or complaint about your data, email us at info@borunstudios.co.uk. You have the right to complain to us directly, and we will acknowledge your complaint within 30 days and respond without undue delay.

If you are not happy with our response, you can also complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk.