Privacy policy

1. Data we collect

• Account data: name, email address, password hash, organisation membership and role, two-factor authentication settings and recovery codes.
• Workspace content: cash flow entries, opening balances, scenarios, actual transactions, loan records, organisation logos and any PDF invoices or agreements you upload.
• Usage and security data: activity log entries, sign-in attempts, failed two-factor attempts, IP address, browser type and timestamps.
• Communications: notification preferences and emails we send you, such as report summaries and missing-invoice reminders.

2. Why we use it and our lawful basis

• To provide the Service, including forecasts, reporting and collaboration — performance of a contract.
• To secure accounts, prevent abuse, rate-limit sign-in attempts and keep an audit trail — legitimate interests and legal obligation.
• To extract data from invoices you upload using an AI model, so fields can be filled automatically — performance of a contract.
• To send service and report emails you have configured — performance of a contract or your consent, which you can withdraw at any time.
• To improve accuracy of categorisation using corrections you make — legitimate interests.

3. Sharing your data

We do not sell personal data. We share it only with the processors needed to run the Service: our cloud hosting and database provider (which stores data in secure managed infrastructure), our AI provider for invoice extraction and forecasting assistance, and our transactional email provider. Content you add to a shared workspace is visible to other members of that organisation according to their role. We may also disclose data where required by law.

4. International transfers

Some processors may process data outside the UK or EEA. Where that happens, transfers are covered by adequacy decisions or standard contractual clauses with appropriate safeguards.

5. Retention

We keep account and workspace data for as long as your account or organisation is active. When an organisation is deleted, its records, files and activity log are removed from live systems, with residual copies purged from encrypted backups within 30 days. Security logs are kept for up to 12 months.

6. Your rights

Under UK GDPR you can request access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Email privacy@profio.co.uk and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

7. Security

• Row-level access controls so members only see data for organisations they belong to.
• Optional and enforceable TOTP two-factor authentication with recovery codes.
• Private file storage with short-lived signed links for invoices and loan agreements.
• Encryption in transit and at rest, and lockout after repeated failed sign-in attempts.

8. Children

The Service is not intended for anyone under 16 and we do not knowingly collect their data.

9. Changes and contact

We will post any changes on this page and update the date above. Questions: contact privacy@profio.co.uk.