Privacy Policy

1. Scope

This policy explains how Clarity Ledger handles personal data for its UK beta, which is open for public signup. Contact no-reply@clarityledger.uk for privacy questions, access, correction, deletion, objection, or portability requests.

2. Data we handle

• Account, beta-invitation, legal-acceptance, MFA, support, and billing contact data.
• Accounting reports, account mappings, balances, and company metadata you authorise us to obtain from Xero, QuickBooks Online or FreeAgent.
• Exchange-rate observations, reviewed rate overrides and versioned GBP report evidence, including the source report amounts and selected rates.
• Security, processing, operational, billing, and audit events needed to run and protect the service.

AI commentary, deal analysis, and portfolio planning are unavailable in this release. We do not send customer data to an AI provider.

3. Purposes and lawful basis

We process data to provide the contracted reporting service, secure accounts, administer subscriptions, meet legal obligations, support users, and protect our legitimate interests in reliable and fraud-resistant operations.

4. Processors and international transfers

Our principal service providers include your selected accounting provider (Xero, Intuit QuickBooks Online or FreeAgent for authorised accounting access), Stripe (billing), Vercel (application hosting), Neon (PostgreSQL), Upstash (request limits), and Amazon Web Services in eu-west-2 (KMS, SES, and immutable audit archives).

Our application and database are configured for London. Provider hosting locations alone do not guarantee UK-only processing; applicable international transfers require lawful safeguards.

We do not opt API data into model training and do not use accounting API data to train our own AI or machine-learning models. ECB reference-rate requests contain currency codes and dates, not your company reports or account identity.

5. Retention and deletion

• The active imported-report cache retains snapshots for no more than 30 days.
• Saved GBP report versions retain a copy of their source amounts and selected rate evidence while the company remains connected, so earlier calculations remain reproducible. Disconnect or account deletion removes the company’s imported reports and saved report evidence.
• Rate versions and review records are retained with the portfolio; account deletion removes portfolio rate records.
• Audit events are retained for 90 days in the application database after verified export and for 365 days in an immutable encrypted archive.
• Password-reset and beta-invitation tokens expire automatically and are stored only as cryptographic hashes.

We may retain limited records longer where required by law, to resolve disputes, or to establish legal claims. A deletion or data-subject request can be started through no-reply@clarityledger.uk.

6. Security and choices

Accounts require TOTP multi-factor authentication. Provider and MFA secrets are encrypted using AWS KMS in production. You can disconnect accounting companies and request account deletion through support. If remote revocation is unavailable or unconfirmed, the app asks you to remove its access in the provider’s connected-app settings.

Optional analytics and advertising measurement

With your analytics consent, we send limited usage events, pseudonymous account and portfolio identifiers, campaign information, and subscription payment amounts to PostHog (EU hosting). With your separate advertising measurement consent, we send Google Ads click identifiers and confirmed trial, activation, and first-payment events to Google. We do not send accounting report contents, provider tokens, passwords, names, email addresses, or form text to these analytics services. Session replay is disabled.

With a separate Google Analytics choice, we use Google Analytics 4 to measure sanitized page views, trial buttons, signup progress, and server-confirmed trial, activation and payment milestones. This permission is independent of PostHog and Google Ads; earlier choices do not grant it. Google receives a pseudonymous browser client and session identifier, safe route names, controlled campaign source and numeric campaign IDs, product plan information and confirmed first-payment value/currency. We exclude names, emails, form text, account and portfolio IDs, accounting report contents, dynamic URLs, query strings and OAuth/reset tokens. Google advertising signals and ad personalization are disabled. Google Analytics events are used for reporting; the separately consented server-confirmed Google Ads trial remains the advertising conversion. Google may process data outside the UK under applicable transfer safeguards. Contact no-reply@clarityledger.uk to exercise access, correction, deletion, objection, restriction or portability rights. Google privacy information is available at https://policies.google.com/privacy.

Cookie preferences apply across the marketing website and app. Preferences last 180 days; Google Analytics cookies last up to 180 days; attribution cookies, client/session context and click identifiers last up to 90 days. Local delivery payloads are cleared after 90 days, while minimal deduplication records remain until account deletion. External service retention and deletion are managed separately. You can change your choices using Cookie preferences. Withdrawal stops future capture and pending exports; it does not recall data already sent. Contact support for deletion requests.

In-app support conversations

Signed-in customers can send support messages and screenshots, including during onboarding or billing problems. Authorised support staff can read and reply to those conversations. Email notifications contain a sign-in link rather than message contents or screenshots.

If you choose Ask AI, your chat text and our help guidance are sent to OpenAI to generate an answer. You can choose human support instead or switch to human support at any time. Screenshots, account records and financial reports are not supplied to the AI assistant. The assistant cannot inspect your account or make changes. Avoid including passwords, MFA codes, recovery codes or sensitive financial details in messages or screenshots.

Support screenshots are held in private encrypted AWS storage in London and are available only to you and authorised support staff. We use the OpenAI UK regional endpoint with approved retention controls when AI support is enabled; UK regional storage does not guarantee that inference takes place in the UK. We request no stored response state. OpenAI processes support text under our service-provider arrangements.

Conversations and screenshots are deleted 90 days after resolution. Unsent screenshots and empty conversations are removed after 24 hours. Account deletion removes access immediately and queues support content and screenshot deletion for the support cleanup worker. Backup retention follows our existing backup policy. Minimal AI budget totals contain no customer or conversation identity.

7. Changes

We will present material policy changes for acceptance before continued use of authenticated features.