Privacy policy

Account information

• Name, email address, phone number
• Company name, logo, and business address
• Authentication data (password hash, social login tokens)
• Profile preferences and settings

Financial data

• Income and expense records with descriptions, amounts, and dates
• Invoice data including client information, line items, and payment status
• Client and vendor contact information and business details
• Tax rates, VAT registration numbers, and tax compliance data
• Bank account details for payment processing (encrypted)
• Currency preferences and exchange rate data

Business intelligence data

• Industry type and business size for AI categorisation
• Transaction patterns and spending habits (anonymised)
• AI-generated suggestions and categorisation data
• Usage analytics and feature adoption metrics

AI chatbot interactions

• Chat conversations: Your text and voice conversations with SmartCFO AI, including questions, commands, and confirmations
• User context data: Business type, industry, location, and business stage information you provide to personalise AI responses
• Interaction logging: Records of AI-suggested actions (confirmations, corrections, rejections) to improve future suggestions
• Pattern analysis: Learned patterns from your financial data (typical amounts, categories, descriptions per client/vendor)
• AI preferences: Your favourite clients, typical transaction values, and custom shortcuts
• Confidence scores: AI-calculated confidence levels for auto-fill suggestions based on your history

Files and documents

• Receipt images and expense documentation
• Imported CSV/Excel files for bulk data entry
• Generated PDF invoices and reports
• Company logos and branding materials

Voice and audio data (AI assistant)

• Voice recordings: When you use the “Talk to CFO” voice feature, your microphone audio is captured for speech-to-text conversion
• Processing: Voice data is sent to third-party AI services (such as OpenAI) for transcription and response generation
• Storage: Voice recordings are processed in real time and are not permanently stored on our servers
• Consent: Your browser will request microphone permission before any audio capture; you can revoke this permission at any time through browser settings
• Text transcripts: The text transcription of your voice input may be temporarily stored as part of your chat session for context continuity

File uploads to AI assistant

• Document uploads: You may upload documents (PDFs, images, spreadsheets) to the AI chatbot for analysis and assistance
• AI processing: Uploaded files are processed by AI services to extract relevant information and provide insights
• Temporary storage: Files uploaded to the AI assistant are stored temporarily for the duration of your chat session
• Data extraction: Information extracted from uploaded files may be used to create or update financial records with your confirmation
• Security: All file uploads are encrypted in transit (TLS) and processed in secure environments

Communication data

• Email notifications and delivery status
• Support ticket messages and chat logs
• Team collaboration and invitation data

Core services

• Provide accounting, invoicing, and expense tracking functionality
• Generate financial reports and tax compliance documents
• Process payments and manage subscription billing
• Enable team collaboration and multi-user access

AI-enhanced features

• Automatically categorise transactions using machine learning
• Provide intelligent business insights and recommendations
• Detect patterns in spending and revenue trends
• Suggest tax deductions and compliance improvements

Communication

• Send invoice delivery and payment notifications
• Provide security alerts and account notifications
• Deliver feature updates and service announcements
• Respond to support requests and technical issues

AI voice and file interactions

• Voice commands: Convert your spoken requests into text to process queries and perform actions on your behalf
• File analysis: Analyse uploaded documents to extract financial data, categorise transactions, and provide insights
• Contextual assistance: Use conversation history (including voice transcripts) to provide relevant, personalised responses
• Data creation: With your approval, create invoices, expenses, or income records based on voice or document input
• Real-time processing: Voice and files are processed in real time to minimise data retention

Administrative access

Our authorised platform administrators may access your account and financial data for the following legitimate purposes:

• Providing customer support and troubleshooting technical issues
• Investigating and resolving reported bugs or data discrepancies
• Verifying data integrity and preventing fraud or abuse
• Conducting service quality assurance and improvement
• Complying with legal obligations or valid legal requests

Security measures: All administrative access is strictly controlled:

• Limited to a small number of authorised personnel
• Every access is logged in our audit trail with timestamp and reason
• Administrators are bound by strict confidentiality agreements
• Access is monitored and subject to regular security reviews
• Unauthorised access attempts are logged as security violations

Service providers

We share data with trusted partners who help us provide our services:

• Supabase: Database hosting, authentication, and file storage
• Stripe: Payment processing and subscription management
• Resend: Email delivery and notification services
• Cloud storage: Secure document and backup storage

AI and machine learning services

• OpenAI: Powers the SmartCFO AI chatbot, including:
  • Text-based chat conversations and financial queries
  • Voice-to-text transcription (Whisper API)
  • Document analysis and data extraction from uploaded files
  • Transaction categorisation suggestions
• Data sent to AI services:
  • Your chat messages and voice transcriptions
  • Relevant financial context (client names, categories, amounts) for accurate responses
  • Uploaded documents for analysis
  • Your business context (industry, location) for personalised advice
• Data NOT sent to AI services:
  • Your password or authentication credentials
  • Bank account numbers or payment card details
  • Your complete financial database
• AI provider policies: Data sent to OpenAI is subject to their Privacy Policy. OpenAI does not use API data to train their models.

Legal requirements

We may disclose information when required by law, court order, or to protect our rights, property, or safety, or that of our users or the public.

Business transfers

In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the business transaction.

Technical safeguards

• End-to-end encryption for data transmission (TLS 1.3)
• Encrypted data storage with AES-256 encryption
• Multi-factor authentication support
• Regular security audits and vulnerability assessments
• Role-based access controls and audit logging

Compliance measures

• GDPR compliance for European users
• SOC 2 Type II certified infrastructure
• Regular penetration testing and security reviews
• Employee security training and background checks

Financial data protection

• VAT submission data locking to prevent tampering
• Audit trails for all financial record modifications
• Automatic backups with point-in-time recovery
• Secure API endpoints with rate limiting

SmartCFO operates globally and may transfer your data to countries outside your jurisdiction. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for EU data transfers
• Adequacy decisions where available
• Data Processing Agreements with all service providers
• Regional data residency options for enterprise customers

Retention periods

• Financial records: 7 years (or as required by local tax law)
• Account data: Duration of account plus 30 days after deletion
• Audit logs: 2 years for security and compliance
• Support communications: 3 years after resolution
• Marketing data: Until consent is withdrawn
• AI chat conversations: Session-based; cleared when you close the chat
• AI interaction logs: 180 days (automatically deleted thereafter)
• AI learned patterns: Duration of account (used to improve auto-fill suggestions)
• Voice recordings: Not stored; processed in real time and discarded
• Uploaded files to AI: Session-based; deleted when chat session ends

Deletion policy

When you delete your account, we will permanently delete your data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).

Data subject rights (GDPR)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Portability: Export your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests

How to exercise your rights

To exercise any of these rights, contact us at info@smartcfo.app or use the data export/deletion tools in your account settings. We will respond within 30 days of receiving your request.

Essential cookies

• Authentication tokens and session management
• Security and fraud prevention
• User preferences and settings

Analytics cookies

• Usage statistics and feature adoption (anonymised)
• Performance monitoring and error tracking
• A/B testing for user experience improvements

You can control cookie preferences through your browser settings. Note that disabling essential cookies may affect app functionality.

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Notify you via email at least 30 days before changes take effect
• Post prominent notices in the app
• Update the “Last Updated” date at the top of this policy
• Maintain an archive of previous policy versions

If you have questions about this Privacy Policy or our data practices, please contact us: