Privacy Policy
Effective 7 September 2026. This policy explains how ANOVYR LTD handles personal data when people visit our website, create or use an ANOVYR account, participate in a pilot, connect an accounting platform, upload information or contact us.
1. Who we are
ANOVYR LTD is a private limited company registered in England and Wales under company number 17434874. Our registered office is 82A James Carter Road, Mildenhall, IP28 7DE. Privacy questions can be sent to hello@anovyr.com.
2. Our data-protection roles
For account administration, website operation, service security, commercial administration, product communications and support, ANOVYR LTD generally acts as a controller. Where a business customer supplies or connects accounting, transaction, supplier, employee, customer or evidence data for ANOVYR to analyse on that customer's instructions, the customer will generally act as controller and ANOVYR LTD will generally act as processor. The applicable Data Processing Addendum governs that processing.
3. Information we may process
Depending on how ANOVYR is used, we may process account and identity information such as name, organisation, role and login details; contact and support information; authentication, device, IP, audit and security-event information; accounting and transaction information authorised by a customer; personal information that appears within business accounting records; files and evidence uploaded for an investigation; investigation outcomes, comments, feedback and usage events; and optional AI-assistant questions together with the minimum relevant context required to answer them where that feature is permitted and enabled.
4. Why we use information
We use information to provide, authenticate, secure and administer ANOVYR; connect authorised accounting services; analyse customer-supplied financial activity and present potential anomalies for human investigation; maintain customer-specific statistical and behavioural baselines; provide investigation, evidence and reporting functionality; provide optional AI-assisted explanations where permitted; provide support; detect abuse and security incidents; maintain audit trails; and meet legal, regulatory and record-keeping obligations.
ANOVYR LTD will not use Xero API Data to train, fine tune, adapt or enhance an ANOVYR AI or machine-learning model. Customer-specific Xero baselines used by ANOVYR are statistical or rules-based profiles used only to analyse that customer's data and are not model-training datasets.
5. Lawful bases
Where ANOVYR LTD acts as controller, we rely on one or more lawful bases appropriate to the activity, which may include performance of a contract, legitimate interests in operating and securing a business software service, compliance with legal obligations, and consent where required. Where a customer acts as controller, that customer is responsible for identifying its lawful basis for supplying personal data to ANOVYR.
6. Automated analysis and human review
ANOVYR uses automated rules, statistical analysis and software-assisted techniques to identify financial activity that may warrant investigation. Findings are risk indicators and investigative prompts. They are not determinations that fraud, misconduct, legal liability, debt or an accounting error has occurred. ANOVYR is designed for human review before consequential action is taken.
7. Accounting-platform integrations
When a user connects an accounting platform, ANOVYR accesses information within the permissions authorised by that user and subject to the relevant provider's terms. Customers are responsible for ensuring they are authorised to connect the organisation and data. Provider-specific restrictions may limit how connected data can be used or whether it can be passed to another service.
For the Xero integration, ANOVYR is designed to request only the read permissions needed for the current financial-analysis workflow. The current connector uses supplier-contact, purchase-invoice and payment information for forensic analysis. ANOVYR does not use Xero API Data to train, fine tune, adapt or enhance an artificial-intelligence or machine-learning model.
8. AI-assisted features
Where enabled and permitted for the relevant data source, ANOVYR may use OpenAI as a third-party AI service provider to generate an explanation or help a user interrogate an ANOVYR finding. The external AI feature is optional and separate from ANOVYR's rules-based and statistical forensic analysis.
For Xero-derived data, ANOVYR will only enable external AI processing where the connected user has affirmatively consented to that processing and ANOVYR has confirmed that the relevant OpenAI API organisation or project is not configured to share API inputs or outputs for model training or improvement. The user can withdraw that preference in the Xero connection settings; future Xero-derived Ask ANOVYR requests will then remain in local evidence mode.
When external AI is enabled for Xero-derived data, ANOVYR sends only the minimum relevant context needed for the requested explanation, such as a selected finding, limited transaction references or read-only evidence retrieved for that question. ANOVYR does not send an entire Xero organisation to the AI provider by default, and raw bank-account details are intentionally excluded from the AI context.
ANOVYR sends OpenAI API requests with response storage disabled for the feature. OpenAI states that API inputs and outputs are not used to train its models by default unless an API customer explicitly opts in to data sharing. OpenAI may retain API inputs and outputs for up to 30 days to provide its services and identify abuse, except where an eligible Zero Data Retention arrangement applies or where a longer period is legally required. Provider-side retention and access remain subject to OpenAI's applicable API terms and data controls.
9. Service providers and subprocessors
ANOVYR uses service providers to host and operate the service and may use an AI provider for optional AI-assisted features. Our current pilot infrastructure includes Render for application/database hosting and OpenAI for conditional AI-assisted functionality. A provider being contractually approved as a subprocessor does not override any separate restrictions imposed by a connected accounting platform. ANOVYR will not knowingly configure a third-party AI provider to use Xero API Data to train, fine tune, adapt or enhance that provider's models.
10. International transfers
If personal data is transferred outside the United Kingdom, ANOVYR will use an appropriate lawful transfer mechanism, adequacy arrangement or other safeguard where required. We maintain relevant provider and transfer information as part of our compliance records.
11. Retention and deletion
ANOVYR retains personal data only for as long as reasonably necessary for the relevant purpose, customer relationship, security, dispute handling or law. Pilot workspace data is intended to be deleted within 90 days after the pilot or account ends unless the customer requests earlier deletion or a lawful reason requires longer retention. OAuth tokens are revoked or deleted when a connection is removed. Audit and security records are generally retained for up to 12 months. Backup copies expire through the applicable rolling backup lifecycle.
Where a user has opted into an external AI feature, provider-side handling is also subject to the provider's retention controls described above. ANOVYR treats disabling response storage and Zero Data Retention as separate controls and will not describe response-storage settings as guaranteeing zero provider retention.
12. Security
ANOVYR uses technical and organisational safeguards appropriate to the risk, including authenticated access, tenant separation, access controls, secure secret management, encryption where appropriate, audit logging, backups and incident-response procedures. No online service can guarantee absolute security. More information is available on our Security page.
13. Cookies and analytics
The hosted application may use cookies or similar mechanisms that are necessary for authentication, session security and core functionality. The marketing website does not currently enable advertising cookies. If analytics or additional tracking technologies are enabled, ANOVYR will assess whether additional notice or consent controls are required and update this policy accordingly.
14. Your rights
Depending on the circumstances, UK data-protection law may provide rights including access, correction, erasure, restriction, objection and data portability. Requests relating to ANOVYR LTD's own controller data can be sent to hello@anovyr.com. Where ANOVYR processes personal data solely on behalf of a business customer, requests relating to that customer dataset should normally be directed to the customer as controller.
15. Complaints
You can raise a privacy concern with ANOVYR at hello@anovyr.com. You may also have the right to complain to the Information Commissioner's Office.
16. Changes
We may update this policy as the service, law or provider requirements change. Material changes will be communicated where appropriate and the effective date will be updated.