Privacy Policy

Last updated: 10 October 2026

This policy explains how Finavate Ltd ("Finavate", "we", "us") handles personal data and business data when we provide bookkeeping, accounting and reporting services, including through the Finavate platform and the apps we use to connect it to your business tools: the "Finavate Platform" app for Shopify and the "Finavate Platform" app for Klaviyo.

1. Who we are

Finavate Ltd, a company registered in England and Wales, company number 15961335. Registered office: 42 Watling Street, Centre 42, Radlett, WD7 7NN, United Kingdom.

For our clients' business data, which we handle to do their bookkeeping and reporting, we act as a processor on our client's behalf: the client decides what we do with it under our engagement letter. For our own client relationship (who our contacts are, how to reach them, billing) and for the security of our platform, we act as a controller.

ICO registration: Registration applied for October 2026 (application C2050529).

2. What the platform reads, and from where

We only connect a tool when our client asks us to, through a connection they authorise in their own account (or, for some tools, through a read-only key they create for us). Every connection is checked to make sure it opens that client's own account and no one else's, and is refused if it does not. All connections below are read-only unless stated otherwise.

Xero. The client's accounting records: chart of accounts, invoices, bills, payments, bank transactions and statement lines, contacts, journals, tax rates and reports. Where the client asks us to, we also post bookkeeping entries (for example matching bank lines, or coding a receipt) on their behalf. Personal data involved: names and contact details of the client's customers and suppliers as they appear in Xero contacts and transactions.

Shopify. Orders (amounts, taxes, discounts, statuses, dates), refunds, products, inventory, fulfilment status, Shopify Payments payouts and balance transactions, and Shopify's sales and traffic reports. We do not store customers' names, email addresses, phone numbers or addresses. Order and customer webhooks are cut down to figures and statuses before anything is saved; the only customer-level detail kept is a Shopify customer ID with an order count and total spend.

Klaviyo. The account's name, currency and time zone; "Placed Order" revenue totals by day, split by the email flow or campaign that earned them; and the number of subscribers on each list. None stored. We read totals and counts only; we do not read or store subscriber profiles or email addresses.

Meta Ads. The ad account's name and daily performance figures: spend, impressions, clicks, reach, conversions and conversion values. No personal data; figures are aggregated by Meta.

Google Ads and Google Analytics 4. Daily campaign spend and performance figures, and daily site analytics totals (such as sessions, users and revenue). No personal data; figures are aggregated by Google.

Google Drive, Sheets and Gmail. Only the folders and spreadsheets a client shares with the dedicated Finavate identity created for them. For Finavate's own account only, we also create email drafts (never sent automatically) and read our own calendar. Personal data involved: whatever the shared documents contain.

Companies House. The public register entry for a client company: officers and directors, persons with significant control, filing history and deadlines. Personal data involved: directors' and PSCs' names, month and year of birth, nationality and correspondence address, as published on the public register.

Fathom. Recordings, transcripts and summaries of meetings we hold with our clients, and the action items from them. Personal data involved: names, voices and what was said by meeting participants.

Dext. Receipts and invoices the client submits through Dext, with the details Dext extracts (supplier, date, amounts, tax). Personal data involved: whatever appears on a receipt, such as a supplier's or employee's name.

Slack. Messages in the shared channels our client uses to talk to us, so that requests reach the right person. Personal data involved: names and messages of people in those channels.

Email. Emails sent to our client-service addresses. Personal data involved: senders' names, addresses and what they write.

3. Why we use it (purpose and lawful basis)

We use this data only to provide bookkeeping, accounting, reconciliation and management reporting to the client it belongs to: for example, matching Shopify payouts to bank lines, checking that sales recorded in Xero agree with Shopify, and reporting marketing spend and revenue alongside the accounts.

Where we are a processor: we act on our client's documented instructions under our engagement letter. The client is the controller and decides the lawful basis.

Where we are a controller: contract (to deliver the service our client engaged us for), legal obligation (for example anti-money-laundering checks and keeping accounting records), and legitimate interests (keeping the platform secure and monitoring that connections work).

We do not sell data, use it for advertising, build profiles of individuals, or use one client's data for another client. We do not use anyone's data to train AI models, and the AI services we use are contracted not to train on it either.

4. Data minimisation

We read what the service needs and no more:

• Every connection asks for read-only access, apart from the Xero entries a client asks us to post for them.
• Shopify webhooks are trimmed to figures and statuses before they are stored. Customer names, emails, phone numbers and addresses in a webhook are discarded, not saved.
• Klaviyo, Meta, Google Ads and Google Analytics are read as totals, never as individual people.
• Error logs automatically mask anything that looks like a password, key or token.

5. How long we keep it, and deletion

• While a client is with us, we keep their data for as long as we need it to provide the service.
• When a client leaves, or disconnects a tool, we stop reading from it. We delete the client's data within 90 days of the end of the engagement, except records we must keep by law.
• Accounting records we must keep to meet our own legal and professional obligations (including anti-money-laundering records, which must be kept for five years after the relationship ends) are kept for that period and then deleted. Accounting and tax records are kept for six years after the end of the relevant accounting period.
• Meeting recordings and transcripts are kept for two years.
• Backups are overwritten on a rolling basis within 30 days.

Shopify privacy requests. Our Shopify app answers Shopify's mandatory privacy webhooks:

• Customer data request (customers/data_request): when a shop's customer asks what data is held about them, we tell the merchant what we hold (at most the customer's Shopify ID, order count and total spend) so the merchant can answer the customer.
• Customer erasure (customers/redact): we delete everything we hold for that customer.
• Shop erasure (shop/redact, sent 48 hours after a shop uninstalls our app): we delete the customer records we hold for that shop. The shop's order and payout totals are the client's accounting records, so we keep them for as long as the law requires (see section 5) without the customers' personal details.

Klaviyo. A client can disconnect us at any time by uninstalling the Finavate Platform app in Klaviyo (Settings, Integrations). Access stops at once on Klaviyo's side.

6. Security

• All data is encrypted in transit (TLS).
• Access tokens, keys and passwords for connected tools are stored encrypted in our database and are never shown back on any screen once entered.
• Each connection is checked on every use to make sure it opens the right client's account.
• Access to the platform is limited to Finavate staff who need it, by role, and every connection is created through the client's own consent. Every staff account must use two-step sign-in (an authenticator app or passkey) on top of its password.
• Connection failures alert our team so problems are dealt with quickly.
• Uploaded files are held in private storage, not on public links.
• If we become aware of a security incident affecting your data, we will investigate, take steps to contain it, and notify you and, where the law requires it, the ICO, without undue delay.

7. Who else handles the data (sub-processors)

We use these service providers to run the platform. Each processes data only to provide its service to us.

• netcup GmbH — hosting the platform's server and database. Germany (EU).
• Cloudflare, Inc. (R2 storage) — storing uploaded files and documents, such as receipts and email attachments. European Union.
• Postmark (ActiveCampaign, LLC) — sending the platform's emails, and receiving emails sent to our service addresses. United States.
• Anthropic, PBC — AI reading of receipts and invoices, and drafting meeting minutes and replies for our team to review (Anthropic does not train its models on this data). United States.
• Fathom — recording and transcribing client meetings, where the client agrees. United States.
• Discord, Inc. — internal alerts to our team when a connection fails (alerts name the client and the tool, not its data). United States.
• Slack Technologies — messaging with clients in shared channels, and internal alerts. United States.
• Google LLC — shared documents and spreadsheets, where a client shares them with us. United States / EU.
• GitHub, Inc. — our source code and change tracking (no client data is stored there). United States.

International transfers. Where a provider is outside the UK, we rely on UK adequacy regulations (for the EU) or on the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework (for the United States).

Google user data. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Analytics and Google Ads data only to show the client the reporting feature they connected it for. We do not use it to serve advertisements, and no one reads it except for security purposes, to comply with the law, or with your affirmative consent for something specific. We do not sell it, and we do not share it with anyone except as needed to provide that feature or as the law requires.

8. Your rights under UK GDPR

If we hold personal data about you, you have the right to:

• ask for a copy of it (subject access);
• ask us to correct it;
• ask us to delete it;
• ask us to restrict or object to how we use it;
• ask for it in a portable format; and
• withdraw consent where we relied on it.

Where we hold your data as a processor for one of our clients (for example, you are a customer of a shop we do the books for), please contact that business first; we will help them answer you. You can also contact us directly and we will pass your request on.

We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would like the chance to put things right first.

9. Contact

Finavate Ltd
42 Watling Street, Centre 42, Radlett, WD7 7NN, United Kingdom
Email: privacy@finavate.co.uk

10. Changes to this policy

We will update this page when what we do with data changes, and change the "Last updated" date above. If a change is significant, we will tell our clients directly.