Privacy Policy

This policy explains how Primority Ltd handles personal data when you use Agenta24 Finance at finance.agenta24.com (the "service"). It applies to advisers, client business users, and the customers of client businesses whose details appear in connected records.

Primority Ltd, a company registered in Scotland under company number SC389943, operates the service. For account data of people who use the service, we are the controller. For financial records and customer details a business brings into the service through its connected accounts, the business is the controller and we process that data on its behalf and on its instructions.

We collect only what the service needs to work:

• account details: your name, email address, the organisations you belong to and your role in each;
• business details: company name and, where you choose to look it up, public Companies House information;
• connected account data: records from services you connect, such as invoices, payments and customer contact details from QuickBooks Online;
• mailbox connection details: the mailbox address and the access tokens a provider issues when you connect Microsoft or Google mail to send email;
• activity records: actions taken in the service, such as connecting a service, approving a message or sending an email.

We do not use passwords. Sign-in is by one-time codes sent to your email address.

We use personal data to provide the features you enable: signing you in, controlling access to each organisation, analysing payment behaviour, preparing suggested messages, sending approved emails and keeping a record of what happened. We do not sell personal data and we do not use it for advertising.

Our lawful bases are performing our agreement with you, our legitimate interest in running a secure and reliable service, and, where a business is the controller, that business's instructions.

When a business connects a Microsoft or Google mailbox, the service asks only for permission to send email and to read the basic profile of the signed-in account. It does not read, change or delete messages in the mailbox. Any wider access would require the business to approve it separately through the provider's own consent screen.

Some features use AI models from OpenAI and Anthropic to suggest an approach and draft wording. Before any request is sent to a model, names, email addresses, company names and other identifiers are replaced with placeholders. Figures and real names are inserted afterwards by our own code. Model providers are not given customer identities.

Financial records, message drafts and mailbox tokens are encrypted separately for each client business. Access to each organisation's data is restricted to its members, and this is enforced by the database itself rather than only by the application screens.

We use a small number of service providers to run the service:

• Supabase, for hosting our database and authentication;
• Resend, for sending email;
• Microsoft Azure, for protecting encryption keys;
• OpenAI and Anthropic, for AI drafting using anonymised information only;
• Intuit, Microsoft and Google, when you choose to connect their services.

Some of these providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or adequacy regulations.

We keep account data while your account is active. When a business disconnects a service, we stop collecting new data from it. When an organisation is closed, we delete or anonymise its data within a reasonable period unless the law requires us to keep it longer.

You have the right to access, correct, delete or restrict the use of your personal data, to object to its use, and to receive a copy of it. Where a business is the controller, we will pass your request to that business. You can also complain to the Information Commissioner's Office at ico.org.uk.

We will update this policy as the service develops and show the date of the latest change at the top of this page. Where a change is significant, we will tell account holders by email.

Questions about privacy can be sent to jf@primority.com.