Skip to content

Legal

Data Processing

When you connect your accounts, bank, sales and ads, you remain in control of that data. These terms set out how we process it on your behalf.

1. Roles

For business data from your connected sources, you decide what is processed and why, and we process it on your instructions to provide the Service. These terms form part of the Terms of Service.

2. What we process

  • Financial records: sales, purchases, ledgers, receivables, payables, tax figures and bank transactions.
  • Sales records: bills, returns, discounts, orders and stock.
  • Marketing records: ad spend, clicks and conversions.
  • Personal data contained in those records, such as customer and supplier names on invoices.

3. Purpose

Data is processed only to prepare your briefs, answer your questions, detect unusual changes against your own history, and display your dashboards. It is not combined with other customers' data and not used to train AI models for anyone else.

4. How connections work

  • Read-only permissions are requested wherever a source supports them.
  • Bank data is obtained through regulated consent flows or statements you provide, and consent can be revoked at any time.
  • Desktop accounting data is sent by a sync app over an encrypted connection.

5. Security measures

  • Encryption in transit with TLS 1.2 or higher, and at rest with AES-256.
  • Source credentials and tokens stored in a separate, restricted vault.
  • Each business's data is logically separated from every other.
  • Staff access only for support you request, limited in scope and logged.
  • Regular backups, encrypted, with restore testing.

6. Sub-processors

We use carefully chosen providers for cloud hosting, message delivery, AI model processing and payments. Each is bound to equivalent data protection obligations. We will notify account holders by email before adding a sub-processor that handles business data.

7. Location

Business data is stored on servers in India. Where a provider processes data outside India, it is done under safeguards that meet applicable law.

8. Incidents

If we become aware of a breach affecting your data, we will notify you without undue delay and within 72 hours, with what happened, what data was involved and what we are doing about it.

9. Deletion and return

You can export your reports at any time. When you close your account or ask us to, we delete business data from active systems within 30 days and from backups within 90 days, and disconnect every source.