Privacy Policy

1. Who we are

Fynvro OS is operated by FYNVRO LTD, a company registered in England & Wales under company number 17287290, based in London. For any privacy question, contact us at support@fynvro.com.

2. Controller and processor roles

Two distinct relationships apply, and the difference matters:

• Your firm's own account data — the personal data of your firm and its staff users. For this, FYNVRO LTD is the data controller.
• Your clients' data — the client records you enter, and the financial data you connect via Xero and Companies House. For this, your firm is the data controller and FYNVRO LTD acts as a data processor, handling that data only on your documented instructions under our Terms and Data Processing Agreement.

3. What we collect

• Account & contact details — name, work email, firm name, role and login credentials.
• Firm & client records — the practice and client information you choose to add to your workspace.
• Integration data — financial data from Xero via the OAuth scopes you authorise, and public records from Companies House.
• Billing data — handled by our payment processor, Stripe. We do not store full card numbers.
• Usage & technical data — log data, IP address, browser and device information, used to operate and secure the service.

4. How we use your data, and our lawful bases

• To provide and operate Fynvro OS — performance of a contract.
• To secure and monitor the platform, including abuse detection — legitimate interests.
• To generate AI drafts and practice intelligence within your workspace, which a human then reviews — contract / legitimate interests.
• To process payments and manage subscriptions — performance of a contract.
• To send essential service communications — performance of a contract.
• To improve the product and meet legal obligations — legitimate interests / legal obligation.

5. AI features

Fynvro OS uses AI to draft client emails and surface practice insights. The principle is simple: the AI suggests, the accountant decides. Content processed for these features is used to generate your suggestions only — it is not used to train third-party foundation models.

6. Sharing and sub-processors

We do not sell personal data. We share data only with sub-processors that help us run the service, each bound by contract: a payment processor (Stripe), cloud hosting and database infrastructure, an AI processing provider, and the integrations you actively connect (Xero, Companies House). A current list of sub-processors is available on request from support@fynvro.com.

7. International transfers

Where personal data is processed outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

8. Retention

We retain data for as long as your account is active, plus a limited period afterwards as required by law. Our Forever Preservation archiving means records are archived rather than hard-deleted while your account is active. On account closure, data is deleted or returned in line with our Terms.

9. How we protect your data

Firm data is isolated by workspace with row-level security at the database layer, audit trails on every state-changing action, and encryption in transit. By design, our super-admin role cannot read firm content.

10. Your rights

You have rights to access, rectify, erase, restrict, port and object to the processing of your personal data. To exercise them, email support@fynvro.com. Where your firm is the controller of client data, please direct those requests to your firm. You may also complain to the UK Information Commissioner's Office at ico.org.uk.

11. Cookies

We use a small number of cookies, described in our Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. We will post the revised version here with a new "last updated" date.