What we do with your data, and what we will never do with it

01Who we are

Accountancy Automations is a working-papers preparation service for UK accounting practices, operated by Move 37. In this policy, "we", "us" and "our" mean Move 37; "you" means the accounting practice that holds an account with us, and its authorised users.

For privacy questions, data-protection requests, or to exercise any of the rights in section 12, write to hello@move37.fun. We aim to respond within five working days and are required to respond substantively within one month.

02Our role: controller or processor

Which role we occupy under the UK GDPR depends on whose data it is, and the distinction matters because it determines who you should approach with a request.

We are a processor for your clients' accounting data

When we read a ledger, open a bank statement or draft a query about a director's loan account, we are acting on your instruction, for your purposes, as your processor. You are the controller. We do not decide what to do with that data beyond what you have asked the service to do, and we do not use it for our own purposes. If one of your clients asks about their data, that request properly comes to you; we will support you in answering it.

We are a controller for your own account data

For the data that makes you our customer (your users' names and work email addresses, their roles, authentication records, billing details and support correspondence), we are the controller, and this policy is our notice to you about it.

03What data we handle

Your account

• Name, work email address and role for each user you invite.
• Authentication data: a password hash or single-sign-on identifier, session records, and sign-in timestamps.
• An audit trail of actions taken in the service, described below.

Your clients' accounting records

• Ledger data pulled from your bookkeeping system: trial balances, nominal accounts, transactions, bank accounts and statement lines.
• Source documents you make available: bank statements, invoices, loan agreements, completion statements, stock counts and similar evidence.
• Information from the public register at Companies House, used to prove share capital and group structure.
• Correspondence with your clients that the service drafts, and, where you connect a Microsoft 365 mailbox, replies it reads in order to chase outstanding queries.

Accounting records inevitably contain personal data about identifiable people: directors, employees, sole traders, suppliers and customers. Some of it is financial and sensitive in the ordinary sense, though it is not normally "special category" data under Article 9. We ask you not to upload special category data or criminal-offence data unless it is genuinely necessary for the engagement.

The audit trail

The service records what it did and who approved it: which figures it proved, which journals it proposed, which queries it raised, and the named user and timestamp for every approval. This record is deliberately append-only and cannot be edited or deleted from within the application, because its integrity is the whole point: it is what lets a partner or a regulator reconstruct how a set of accounts was prepared.

Technical data

• Server and security logs: IP address, timestamp, request path, and outcome. Used to run the service and investigate abuse.
• Error diagnostics, which may incidentally include fragments of the data being processed at the moment a fault occurred.

04Services you connect

The service is deliberately API-only: it reads and writes through documented interfaces, and never by driving a browser or screen-scraping a portal. Nothing is connected until one of your authorised users explicitly authorises it, and any connection can be revoked by you at any time, either in our Settings screen or in the provider's own account security page.

Your relationship with each of these providers is your own, governed by their terms and their privacy policy. We hold an access token that lets us act within the permissions you granted, and nothing wider.

05Google user data and Gmail

If you choose to send client correspondence from a Google Workspace or Gmail account, you authorise our application through Google's OAuth consent screen. This section describes exactly what that grants and how the resulting data is handled. It applies in addition to everything else in this policy.

The single scope we request

We request one Gmail scope and no others: https://www.googleapis.com/auth/gmail.send

This is a send-only permission. It allows our application to submit a message for delivery from the connected account. It does not grant the ability to read, search, list, download or modify anything in the mailbox.

What we do with it

• We send a single email (a client query, a document request, or a chaser) at the moment a named user of your practice clicks "Approve & send" in our application.
• We record in the audit trail who approved it, when, and what was sent, so the correspondence can be evidenced later.

What we do not do with it

• We do not read your mailbox. We cannot: the scope above confers no read access, so no message, thread, label, attachment or contact is available to us.
• We never send anything autonomously. No email leaves the connected account without a specific, recorded human approval of that specific message.
• We do not use Google user data for advertising, we do not sell it, and we do not transfer it to data brokers or information resellers.
• We do not use Google user data to train, retrain or fine-tune any generalised artificial intelligence or machine-learning model.
• No human at Move 37 reads Google user data, except with your explicit prior consent for a specific issue you have raised with us, where it is necessary for security purposes such as investigating abuse, or where we are compelled to by law.

Withdrawing the permission

You can disconnect the account inside our application at any time, which discards the token we hold. You can also revoke it directly from Google, independently of us, at myaccount.google.com/permissions. Revoking stops any further sending immediately. It does not retract emails already sent, and it does not erase the audit record that they were sent, which we are required to retain as described in section 10.

A Google Workspace administrator can also control this centrally, allowing or blocking our application for the whole domain, in the Google Admin console under Security, API controls, App access control.

06Why we process it, and our legal basis

07How AI is used, and training

The service uses a large language model to read ledger and document data and to prepare the working papers: proving each balance against its evidence, flagging what does not tie, and drafting the proposed journals and queries. Data is sent to our AI sub-processor, named in section 08, in order to do that work.

Our contract with that sub-processor does not permit your data to be used to train or improve its models. We do not train models on your data ourselves, and we do not permit anyone else to.

The model's output is a proposal, not a decision. Every figure, journal and query is presented for a qualified human to accept, amend or reject, and nothing reaches a live ledger, a client, or a filing without that step. There is no automated decision-making producing legal effects on any individual within the meaning of Article 22.

08Sub-processors

We use the following processors to deliver the service. Each is bound by a written contract that restricts them to processing on our instruction, with confidentiality and security obligations at least as protective as those we owe you.

We will tell you before adding or replacing a sub-processor, so that you have a fair opportunity to object. The providers you connect yourself (listed in section 04) are not our sub-processors; you engage them directly.

09International transfers

Our database and file storage are hosted in the European Union. Some sub-processors operate from, or route traffic through, countries outside the UK (most significantly our AI sub-processor in the United States).

Where data leaves the UK to a country without UK adequacy regulations, the transfer is made under the International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement, together with a transfer risk assessment. A copy of the mechanism relied on for any particular transfer is available on request to hello@move37.fun.

10How long we keep it

Where you are the controller, we follow your documented instructions on deletion, save where retention is required by law or by the integrity of the audit trail described in section 03.

11How we protect it

• Encryption in transit over TLS, and encryption at rest for the database and file storage.
• Tenant isolation enforced in the database itself, so that one practice's data cannot be read from another practice's session even if the application layer is at fault.
• Role-based access, so a user sees only the companies and jobs their role permits.
• Credentials for connected services held as secrets, never in source code, and rotatable without redeployment.
• An append-only audit log, so that any access or approval leaves a record that cannot be quietly removed.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify you without undue delay and in any event within 72 hours of becoming aware of it, with the detail you need to meet your own notification duties.

12Your rights

Under the UK GDPR you have the right to:

• be told what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected, and incomplete data completed;
• have data erased, where there is no overriding reason for us to keep it;
• restrict how we process it while a dispute about it is resolved;
• receive it in a portable, machine-readable form;
• object to processing we carry out on the basis of legitimate interests; and
• withdraw any consent you have given, without affecting what was done before.

To exercise any of these, write to hello@move37.fun. There is no charge. We may need to confirm your identity before we act.

If your request concerns accounting data about you that a practice has put into the service, we are the processor and the practice is the controller. Send the request to the practice; if it reaches us, we will pass it on promptly and tell you that we have.

13Cookies

This marketing site sets no cookies and carries no analytics or advertising trackers.

The application itself sets only strictly necessary cookies: those that keep you signed in and protect the session. They are exempt from the consent requirement under the Privacy and Electronic Communications Regulations because the service cannot function without them. We do not use cookies to profile you or to advertise.

14Changes and complaints

When this policy changes we will update the date at the top of the page. If a change materially affects how we handle your data, we will tell account holders directly before it takes effect, rather than relying on you to notice.

If you are unhappy with how we have handled your data, please raise it with us first at hello@move37.fun so that we have the chance to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.