This notice explains what personal data Actuly Limited collects, why we collect it, who we share it with, how long we keep it and what rights you have over it. It covers visitors to www.actuly.co, people who contact us or sign up for a trial, and people who use the Actuly application.
1. Who we are
Actuly Limited ("Actuly", "we", "us") is the data controller for the personal data described in this notice.
- Company number: 15702372, registered in England and Wales
- ICO registration number: ZB880414
- Registered address: International House, 10 Churchill Way, Cardiff, United Kingdom, CF10 2HE
- Data protection contact: hello@actuly.co
We do not have a statutory data protection officer. Questions and requests about your data go to the address above and are handled by the company's directors.
2. Data in your workspace, where your organisation is the controller
The Actuly application holds financial data that your organisation connects from Xero, QuickBooks or FreeAgent, imports from files, or types in: charts of accounts, trial balances, tracking categories and business unit tags, forecasts, reports and any documents you upload, such as loan agreements. That data may contain personal data, for example a supplier's name in an account line or a director named in a loan agreement.
For that data your organisation is the controller and Actuly is its processor. We use it only to provide the service to your organisation, on the terms set out in section 6 of our Terms of Service, which also lists the sub-processors we use. If you want to exercise rights over personal data held in a workspace, contact the organisation that runs the workspace. We will help them respond.
The rest of this notice covers the personal data for which Actuly is the controller.
3. What we collect and where it comes from
| Source | What we collect |
|---|---|
| Contact and early access forms on this website | Your name, work email address, company name, company size, your message and the page you sent it from. Early access also asks for your role, reporting cycle and current tools. |
| Trial signup form | Your first and last name, email address, phone number, workspace name and web address, company size, how you heard about us and the page you signed up from. |
| Your account, held with Auth0 | Your email address, name, a hashed password that we never see, the workspaces and role you belong to, and Auth0's own record of sign-in dates and IP addresses. |
| Using the application | If you allow analytics when you first sign in, Google Analytics records which workspace you are in, the pages you open, dialogs you use and reports you download. Comments you write in workflows, with your display name. Feedback you send from the app, with your name, email address and the page you were on. |
| Security and audit records | Sign-ins, permission checks, admin actions and data changes, with your user id, IP address and browser type. |
| Support correspondence | What you tell us by email or through our help centre, held in our support system. |
| Browsing this website | Standard web server information such as IP address and browser type. If you accept analytics cookies, Google Analytics also records the pages you visit. See our Cookie Policy. |
Connecting an accounting platform sends nothing about you to Actuly beyond the login you authorise. When you connect FreeAgent as a practice, we also receive the list of client companies on your FreeAgent account, so you can choose which to bring in.
4. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Answering an enquiry you send us | Our legitimate interest in responding to people who contact us |
| Setting up your trial workspace, verifying your email address, letting you sign in and running the application | Performing our contract with you, or taking steps you ask for before it starts |
| Emails about your trial and account: verification, workspace ready, getting started, a check-in halfway through, a reminder the day before the trial ends, a notice when it ends, invitations and password links | Performing our contract with you. These are service messages, not marketing, and you cannot opt out of them while you hold an account |
| Following up your trial or enquiry personally, to help you get set up and to find out whether Actuly suits you | Our legitimate interest in following up business enquiries. See section 5 for how to stop this |
| Telling our team about new signups, enquiries and feedback so someone can act on them | Our legitimate interest in running the business |
| Keeping the service secure, investigating misuse and keeping audit records | Our legitimate interest in protecting the service and its users |
| Understanding how the website and the application are used, so we can improve them | Your consent to analytics cookies, asked for in the banner on this website and the first time you sign in to the application |
| Providing support when you ask for it | Performing our contract with you |
| Invoicing and keeping accounting records | Our legal obligations under company and tax law |
| Dealing with legal claims and complaints | Our legitimate interest in defending our rights |
We do not make decisions about you by automated means that have legal or similarly significant effects. The AI features in the application draft commentary about financial figures; they are not used to decide anything about individuals.
5. Sales follow-up and marketing
After you sign up for a trial or send an enquiry, a member of our team may email or phone you to help you get set up and to ask how you are finding Actuly. We do not send newsletters or automated marketing campaigns, and we do not share your details with anyone else for their marketing.
If you would rather we did not follow up, reply to any message from us or email hello@actuly.co and we will stop. Service messages about your trial or account continue while you hold one.
6. Who we share it with
We do not sell personal data. We share it with the providers below, who process it on our instructions, and otherwise only where the law requires it, to protect our rights or the safety of others, or as part of a sale or reorganisation of the business, in which case the buyer takes on the commitments in this notice.
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, databases, file storage and sending our emails | UK (London) |
| Anthropic, via Amazon Bedrock | AI models that draft commentary and suggest account mappings. The models run inside AWS in the EU. Data is not sent to Anthropic's own systems or used to train models | EU |
| Auth0 (Okta) | Sign-in, passwords and account security | UK |
| Better Stack | Application logs and monitoring | EU |
| Microsoft (Teams) | Notifying our team of new signups, enquiries and feedback | UK and EU |
| Freshworks (Freshdesk) | Support tickets, only when you contact support | EU and USA |
| Google (Google Analytics) | Usage statistics for the website and the application, only with your consent | USA |
7. Where your data is held and transfers outside the UK
Our servers, databases and file storage are in AWS's London region. AI processing takes place in AWS's EU regions, and our logs are held in the EU. Transfers from the UK to the EU are covered by the UK's adequacy regulations for the European Economic Area.
Two providers process data in the United States: Google for analytics and Freshworks for support tickets. Both are certified under the UK Extension to the EU-US Data Privacy Framework, which the UK government recognises as providing adequate protection, so no further safeguard is needed for those transfers. If we ever use a provider that is not certified, we will rely on the International Data Transfer Addendum to the EU Standard Contractual Clauses approved by the Information Commissioner.
8. How long we keep it
| Data | How long |
|---|---|
| Website enquiries, early access requests and support correspondence | 12 months after our last contact with you |
| Trial signups that are never verified or never lead to a subscription | 12 months after the signup, or after the trial ends |
| Your account and workspace data while you have a trial or subscription | For as long as it runs |
| Workspace data after a trial ends without a subscription, or a subscription is cancelled | 90 days, so you can return without starting again, then deleted. Copies leave our backups within a further 30 days. See section 7 of the Terms of Service, which also lets you ask for earlier deletion |
| Your login, held with Auth0 | Until the last workspace you belong to is deleted, then deleted with it. If you belong to other Actuly workspaces, your login stays so you can keep using them |
| Security, audit and application logs | 12 months |
| Invoices and accounting records | 6 years after the end of the financial year they relate to, as company and tax law require |
| Your cookie choice on this website | 1 year |
Where we need to keep something for longer to deal with a complaint or legal claim, we keep only what that requires.
9. How we protect it
Data is encrypted in transit using TLS and at rest using AES-256. Each customer workspace has its own database and its own isolated file storage. Access to our systems is restricted by role and every sign-in and permission check is recorded. Passwords are held only by Auth0 in hashed form. Our staff are bound by confidentiality obligations, and we have procedures for handling security incidents, including telling you and the Information Commissioner where the law requires it.
10. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct data that is inaccurate or incomplete.
- Delete your data where we no longer need it or you withdraw consent, subject to any legal duty to keep it.
- Restrict how we use your data while a dispute about it is resolved.
- Receive the data you gave us in a portable, machine-readable form, where we process it under contract or consent.
- Object to processing based on our legitimate interests, including sales follow-up, which we will stop unless we have compelling grounds to continue.
- Withdraw consent at any time where consent is our basis, for example analytics cookies on this website, without affecting what was done before.
To exercise any of these rights, email hello@actuly.co. There is no charge in most cases. We may ask you to confirm your identity, and we respond within one month, or tell you within that month if a complex request needs longer. If your request concerns data inside a workspace, see section 2.
If you are unhappy with how we handle your data, we would like the chance to put it right, so please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
11. Cookies and analytics
This website sets one strictly necessary cookie to remember your cookie choice, and loads Google Analytics only if you accept it in the banner. You can change your choice at any time using the Cookie Preferences link in the footer. Our Cookie Policy lists each cookie, what it does and how long it lasts.
The Actuly application sets the cookies and browser storage needed to keep you signed in. The first time you sign in it asks whether you will allow Google Analytics to record which pages and features are used. If you say no, analytics does not load. Your answer is saved to your account so you are asked once; to change it, email hello@actuly.co.
12. Links to other sites
This website links to other sites, for example to book a demo or to our help centre. Those sites have their own privacy notices, which we do not control.
13. Children
Actuly is a business service and is not aimed at anyone under 18. We do not knowingly collect personal data from children.
14. Changes to this notice
We will post any changes on this page and update the date at the top. Where a change materially affects how we use your data, we will also tell account holders by email.
15. Contact
Questions, comments and requests about this notice or your personal data should be sent to hello@actuly.co, or by post to Actuly Limited, International House, 10 Churchill Way, Cardiff, CF10 2HE.