Kingpost privacy notice

Last updated 14 November 2026

Kingpost is stock, order and accounting-link software made and run by Scale Rule Consultancy Limited, a company registered in England and Wales, company number 17406773, registered office 26 Brook Road, Horsham, West Sussex RH12 5FY. It trades as Scale Rule Consulting. Contact: hello@scaleruleconsulting.com.

Who is responsible for your data

Each business that uses Kingpost (the customer) decides what goes into its own copy and is the data controller. Scale Rule runs Kingpost for that customer as its data processor, under a written contract that says what Scale Rule may and may not do. If you are a customer of a business that uses Kingpost, contact that business first about your data.

What Kingpost holds

• People who sign in: name, work email address, role, and a record of what they did in Kingpost (the audit trail).
• The customer's own business records: products, stock, customers and their contacts and addresses, quotes, orders, returns, prices and documents.
• If the customer connects an accounting system (for example QuickBooks Online): the connection's sign-in tokens, the accounting organisation's ID, and the records Kingpost sends or reads. Kingpost sends customers, invoices and credit notes, and reads back payment status and balances. It does not read bank feeds, payroll, purchases or journals.

Why

To run the customer's stock and orders and to keep its accounts in step without typing things twice. Lawful basis: the contract with the customer, and the customer's legitimate interest in running its business.

What Kingpost does not do

It does not sell or rent data. It does not use customer data for advertising. Kingpost does not send customer data to any AI service, and no customer data is used to train AI models. It sets no tracking or analytics cookies; the only browser storage is the sign-in session.

Where data is held and who else handles it

• Supabase: database, sign-in, server functions and backups. London, UK.
• Cloudflare: serves the Kingpost screens and passes traffic. Stores no business data. Cloudflare works under its data processing addendum, which includes the recognised safeguards for any transfer outside the UK.
• GitHub: holds Kingpost's code only, no customer data.
• The accounting system, email system and payment provider a customer connects (for example Intuit QuickBooks, Microsoft 365, Stripe) belong to that customer and work under the customer's own agreement with them.

Accounting sign-in tokens are kept encrypted in the database's secrets store and are never shown on screen or written to logs.

Disconnecting an accounting system

An admin can disconnect at any time in Kingpost under Settings, Accounting, or from inside the accounting system. Kingpost then deletes the tokens straight away and stops sending. Records already sent stay in the accounting system, and Kingpost's own copies stay in Kingpost, as the customer's business records.

How long data is kept

As long as the customer's contract says. When a customer leaves, it gets a full export of its data and Scale Rule then deletes the copy within 30 days, apart from backups, which expire on their own within 7 days. A customer can ask Kingpost to anonymise one of its own customers at any time; order records keep their totals for the accounts.

Your rights

You can ask for a copy of your data, a correction, deletion, restriction, a portable copy, or object to its use. Ask the business that uses Kingpost; if you contact Scale Rule we will pass it to them and help them answer within one month. You can complain to the Information Commissioner's Office at ico.org.uk.

Security

Every table is locked by role. Changes go through checked functions that record who did what. Sign-in uses multi-factor authentication for admins. Releases need a named approval. We will tell the customer without undue delay if we find a breach affecting its data.

Changes

When this notice changes, the date changes, and material changes are listed here.