Privacy policy
What we do with your data
Proovva Inbox reads a client’s email and the figures in your ledger, and writes a draft reply for you to check. This policy says what it touches, who else sees it, and how long we keep it.
Who we are
Proovva Inbox is provided by Allen Living Limited, registered in England & Wales, company number 14787139. In this policy “we”, “us” and “our” mean Allen Living Limited; “you” means the accounting practice that uses Proovva Inbox, and its users.
For privacy questions or to use any of your rights in section 11, write to hello@move37.fun. We reply within one month.
Our role: controller or processor
A processor for your clients’ data
When Proovva Inbox reads a client’s email or looks up a figure in your ledger, it acts on your instruction and for your purposes. You are the controller and we are your processor. We don’t use that data for anything else. If one of your clients asks about their data, the request is yours to answer, and we help you answer it.
A controller for your own account data
For the data that makes you our customer (your users’ names and work email addresses, sign-in records, billing details and anything you send us), we are the controller, and this policy is our notice to you about it.
What data we handle
Your account
- Name and work email address for each user, and the practice they belong to.
- Sign-in records: identifiers from Microsoft, session records and timestamps.
- Billing details for your subscription, held by Stripe (section 07).
Your clients’ data
- Client emails that arrive in a connected mailbox. They are read from Outlook to decide whether to draft a reply and what to put in it, and shown to you, not kept as a copy of your mailbox.
- Figures looked up in your ledger to answer a question: bank balances and transactions, invoices, bills, aged debts and VAT.
- The client records you keep in Proovva, such as each client’s year end and email addresses.
- Dates from the public register at Companies House.
- Each draft, the figures in it and where each figure came from, kept with the draft’s history.
Client emails and ledger records contain personal data about real people: directors, sole traders, employees, suppliers and customers. It is financial and sensitive in the ordinary sense, though not normally “special category” data.
The record of what it did
Proovva Inbox records what it did and on whose behalf: which emails it drafted for, which figures it used and where they came from. That record can’t be edited from inside the product, because it is how you can show later where a figure in a reply came from.
Technical data
- Server and security logs: IP address, time, request and outcome.
- Error diagnostics. These carry ids, counts and status codes, never email content.
If you join the waitlist or the founding offer
Your name, email, practice name, the answers you choose to give about your set-up, and whether you asked for updates or the Reconciled newsletter.
Services you connect
Proovva Inbox works only through each provider’s documented interfaces, never by driving a browser or scraping a portal. Nothing is connected until one of your users authorises it, and you can disconnect any service at any time, in Proovva or in the provider’s own security settings.
| Service | What Proovva Inbox does with it |
|---|---|
| Microsoft Outlook (Microsoft 365 or a personal Outlook account) | Reads incoming client emails, writes each draft reply into your own Drafts folder, adds the “Check figures” category to drafts that give advice, and removes only drafts it created that you have not touched. It never sends on its own. |
| Xero | Read-only. The figures a client asks about: bank, invoices, bills, aged debts and VAT. |
| FreeAgent | Read-only. The same figures, and the VAT dates on its tax timeline. |
| Companies House | Reads the public register for filing and confirmation statement dates. |
Your relationship with each provider is your own, under their terms. We hold an access token for the permissions you granted, and nothing wider.
Two limits, stated plainly. Proovva Inbox never changes your books. And it never sends an email on its own: a reply goes only when you send it.
Why we process it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Drafting replies to client emails from your records | Our contract with you. For your clients’ personal data we act on your instruction as processor, relying on your lawful basis as controller. |
| Your account, billing and support | Our contract with you. |
| Connecting your mailbox and ledger | Your authorisation through each provider’s consent screen, which you can withdraw at any time. |
| Keeping the record of what it did | Our legitimate interest, and yours, in being able to show where a figure came from. |
| Security, preventing abuse and fixing faults | Our legitimate interest in running a secure service. |
| The waitlist, launch updates and the Reconciled newsletter | Your consent, given when you sign up, which you can withdraw at any time. |
How AI is used, and training
Proovva Inbox uses a large language model to read a client’s email, decide which figures answer it, and write the draft. The email and the figures looked up for it are sent to the AI processors named in section 07 to do that.
Our providers may not use your data to train or improve their models, and requests go out with data collection turned off. We don’t train models on your data, and we don’t let anyone else.
Each draft is a proposal for a qualified person to check, edit and send, or not. No decision with legal effect on anyone is made by automated means.
Who processes it for us
We use these processors. Each is bound by a written contract to act only on our instruction, with confidentiality and security duties at least as protective as ours to you.
| Processor | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, the queue that receives new-mail notifications, CDN and DNS. Processes requests in transit. | Global edge network |
| Supabase, Inc. | Managed database and authentication: your account, client records, drafts and their sources. | EU (Frankfurt) |
| OpenRouter, Inc. | Routes each request to the AI model, with prompt logging and data collection turned off. | US, under standard contractual clauses |
| Anthropic, PBC | The AI model that reads a client email and the figures looked up for it, and writes the draft. Not permitted to train on it. | US, under standard contractual clauses |
| Functional Software, Inc. (Sentry) | Error monitoring. Receives technical diagnostics, never email content. | EU (Frankfurt) |
| Stripe | Takes payment for your subscription. We never see your full card number. | UK, EU and US |
| beehiiv, Inc. | Holds waitlist sign-ups and, if you ask for them, launch updates and the Reconciled newsletter. | US, under standard contractual clauses |
We will tell you before adding or replacing a processor, so you can object. The services you connect yourself (section 04) are not our processors; you engage them directly.
International transfers
Our database is hosted in the EU. Some processors work from, or route traffic through, countries outside the UK, most significantly the AI providers in the United States. Where data leaves the UK for a country without UK adequacy regulations, the transfer is made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. A copy of the safeguard for a given transfer is available from hello@move37.fun.
How long we keep it
| Data | How long |
|---|---|
| Drafts, their figures and sources, and client records | While your account is open, then deleted within 90 days of it closing, unless you ask us to delete them sooner. |
| The record of what it did | Seven years, the period UK practices are usually expected to keep engagement records. |
| Access tokens for connected services | Until you disconnect the service or revoke access with the provider. |
| Account and user records | While your account is open, then 12 months, to deal with any later question. |
| Security logs and error diagnostics | 90 days. |
| Waitlist and newsletter sign-ups | Until you unsubscribe or ask us to delete them. |
How we protect it
- Encryption in transit and at rest.
- Each practice’s data kept apart in the database itself, not only in the application.
- Inside Proovva Inbox, only you see your inbox and drafts, not colleagues or practice admins.
- Credentials for connected services held as secrets, never in source code.
No system is perfectly secure. If a personal data breach is likely to put people’s rights at risk, we will tell you without undue delay, and within 72 hours of becoming aware of it, with what you need for your own reporting.
Your rights
Under the UK GDPR you have the right to:
- be told what personal data we hold about you, and have a copy;
- have it corrected or completed;
- have it deleted, where there is no overriding reason to keep it;
- restrict how we use it while a dispute is resolved;
- receive it in a portable, machine-readable form;
- object to processing based on legitimate interests; and
- withdraw any consent you have given.
Write to hello@move37.fun. There is no charge, and we may need to confirm who you are first. If your request is about your data in a practice’s client records, the practice is the controller: send it to them, and if it reaches us we will pass it on and tell you.
Changes and complaints
When this policy changes we update the date at the top. If a change materially affects how we handle your data, we tell account holders before it takes effect.
If you’re unhappy with how we’ve handled your data, tell us first at hello@move37.fun. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. The terms for the founding offer are on the terms page.