Last updated 31 August 2026.
Who we are
Kerbmile is operated by a sole trader in the United Kingdom. Contact: hello@kerbmile.co.uk.
For UK GDPR, we are the data controller for the information described here.
What Kerbmile holds
- Your email address, so you can sign in. There is no password: we email you a code.
- Your drives — start and end times, distance, and the route, recorded on your phone while the app is allowed to see your location.
- Your receipts — the photograph, and the merchant, date, total and VAT read from it.
- What you earned — the weekly figures you enter, by platform.
- Two answers about your tax: what you drive, and whether you have claimed capital allowances on it.
Where it lives
On your phone first. The database on your device is encrypted, and the key never leaves the phone's secure hardware store.
A copy is synced to our servers (Supabase, hosted in Ireland, EU) so that losing or replacing your phone does not lose your records. Every row is restricted to your account at the database level, and receipt photographs are held in private storage that only your account can read.
What Kerbmile does not do
- Receipts are read on your phone. The photograph is never sent to a third-party scanning service. Apple's and Google's on-device text recognition does the reading, offline.
- Your location is not tracked or sold. It is used to measure the length of a drive, and for nothing else. There are no advertising identifiers, no analytics software that carries your location or your receipts, and nothing is sold or shared for marketing.
- We do not send anything to HMRC. Kerbmile produces records and exports. What you file is yours to file.
Why we are allowed to hold it
Because you asked us to: you entered a contract with us to keep these records (UK GDPR Article 6(1)(b)). Location is only ever collected with the permission you grant, and you can withdraw it in iOS or Android settings at any time — the app keeps working, and you enter trips yourself.
How long
For as long as you keep your account. HMRC expects business records to be kept for five years after the 31 January filing deadline for the relevant tax year, and Kerbmile is built for you to be able to meet that.
Delete your account and everything goes: rows, photographs and the login, immediately and permanently. Settings → Delete my account. There is no grace period and no soft delete, so export your records first if you may still need them.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to how we use it. The app answers the first three itself: your records are in front of you, editable, and exportable as a spreadsheet, and account deletion is in Settings. For anything else, email hello@kerbmile.co.uk.
If you think we have handled your information badly, you can complain to the Information Commissioner's Office at ico.org.uk.
Processors we use
- Supabase — database, authentication and file storage, EU region.
- Resend — sends your sign-in code. It sees your email address and nothing else.
Both are bound by contract to process this information only on our instructions.
Changes
If this policy changes in a way that affects what we do with your information, the app will tell you before the change takes effect.