Privacy policy

EMBLA PRACTICE LIMITED (“Embla”, “we”) operates the Embla onboarding platform for UK accountancy practices. We are registered in England & Wales, company number 17501220, registered office Holt Hall, Holt Lane, Matlock, Derbyshire, DE4 3LY. Our registration number with the Information Commissioner's Office (ICO) will be published here once confirmed.

This policy explains what personal data we handle and why. It is a first draft under review — see the note above.

Embla acts in two roles, and which one applies depends on whose data it is. Under review

We are the controller for data about the practices that use Embla and their staff — the people who hold accounts with us — and for running and securing our own service.

We are a processor acting on each practice's instructions for that practice's own client data. When a business owner completes an enquiry or uploads documents, the accountancy practice is the controller of that data; Embla processes it on their behalf to provide the onboarding tooling. Each practice's data is kept isolated from every other practice.

When a practice registers and its staff use Embla, we hold:

• name, work email and phone number;
• the practice's professional body, anti–money-laundering (AML) supervisor, ICO registration, and professional-indemnity insurer and policy details, where provided;
• authentication data (sign-in, multi-factor authentication) and security logs.

When a practice onboards a client through Embla, we process — on that practice's instructions — data such as:

• name, email and business details from the enquiry;
• for sole traders: home address, National Insurance number and Unique Taxpayer Reference (UTR);
• AML / identity-verification documents (for example photo ID and proof of address);
• company information retrieved from Companies House on the client's behalf;
• where a client connects their accounting software, the OAuth access tokens we hold per client to read that data (for example Xero). Tokens are held per client and per practice and are not shared across practices.
• the read access a practice grants when it connects its own Xero login can also cover its clients' payroll (employees' names, addresses, National Insurance numbers and pay), files and fixed assets. Embla does not read or keep that data: the practice's own tools read it through the practice's connection.

A practice can also connect its LinkedIn company page and post case studies its clients have approved there. We send LinkedIn the approved text only when a colleague at the practice presses the button, and we hold the connection to the page encrypted.

For practice and staff account data, our lawful bases are:

• Contract — to provide the service to the practice;
• Legitimate interests — to keep the service secure and to improve it.

For client data we process as a processor, the practice sets the lawful basis as controller; we act on their instructions. Identity-verification and AML data is processed to support the practice's obligations under the Money Laundering Regulations 2017 — a legal obligation basis. Under review

We use a small number of trusted providers to run Embla. Several are used only when a practice enables the relevant feature, so not every practice's data touches every provider. Under review

• Google (Chrome) — Your browser's own speech service, used only if you press Dictate (USA/global)
• Microsoft (Edge) — Your browser's own speech service, used only if you press Dictate (USA/global)
• Apple (Safari) — Your browser's own speech service, used only if you press Dictate (USA/global)
• Supabase — Database, authentication and file storage (London, UK)
• Vercel — Application hosting and content delivery (EU/global edge network)
• Resend — Transactional email delivery (proposals, links, notifications) (USA)
• Companies House — Public company-data lookups on a client's behalf (UK)
• GoCardless — Direct Debit mandate setup and collection (UK/EU)
• Xero — Per-client accounting-data access where a practice connects it (EU/global)
• SignWell — Engagement-letter e-signature (where enabled) (USA)
• Anthropic — Optional AI assistance over documents and text (where enabled), including reading the handover documents a practice uploads to fill in a client's record, and writing a short summary of a client from the facts and notes held about them when a colleague asks for one, when the practice switches that on. Also asked the practice's own search questions for the visibility checks (where enabled). Also drafting the About this client note from the entity type, the stage, the services, the year end, the Companies House sector and a contact's first name only (no free text), when the practice switches that on and a colleague presses Draft with AI. Nothing is saved until the colleague saves it (USA)
• OpenAI — Asked the practice's own search questions for the visibility checks (where enabled); no client data is sent (USA)
• Google (Gemini) — Asked the practice's own search questions for the visibility checks (where enabled); no client data is sent (USA/global)
• Perplexity — Asked the practice's own search questions for the visibility checks (where enabled); no client data is sent (USA)
• Google Search Console — Search statistics for the practice's own website (where enabled); the site address is sent (USA/global)
• Microsoft Bing Webmaster — Search statistics for the practice's own website (where enabled); the site address is sent (USA/global)
• HMRC (VAT number check) — Checks a client's VAT registration number is valid (where enabled); the VAT number is sent (UK)
• Google (Places) — Finds a prospect business's public listing for prospecting (where enabled); the business name and town are sent (USA/global)
• LinkedIn — Posts an approved case study to the practice's own LinkedIn page, only with the client's recorded consent (where enabled); the case study's title and text are sent (USA/global)
• Microsoft (Graph) — Shared-mailbox routing of client email, and copies of documents into a practice's SharePoint or OneDrive (where enabled) (EU/global)
• Dropbox — Per-client document folders, and copies of documents into the practice's own Dropbox (where enabled) (USA/EU)
• Twilio — SMS delivery for the assisted-digital channel (where enabled) (USA/global)

Embla does not send anything it reads from Xero to an AI provider.

The feedback box shown during testing has an optional Dictate button. It uses your own browser’s speech recognition: while the button is on, your browser sends what you say to its maker’s speech service to turn it into text (Google for Chrome, Microsoft for Edge, Apple for Safari), under that company’s terms. Embla does not receive the audio, only the text you choose to send.

Our primary database, authentication and file storage are hosted in the UK (London). Some providers listed above are based outside the UK, including in the USA. Where personal data is transferred outside the UK, we rely on UK GDPR transfer safeguards such as the UK International Data Transfer Agreement or an adequacy decision. Under review

We keep practice and staff account data for as long as the account is active and for a reasonable period afterwards. Client data is kept according to the practice's instructions and retention policy. Identity and AML records are subject to the Money Laundering Regulations 2017, which generally require retention for five years after the end of the business relationship. Retention periods under review

Under UK GDPR you have rights to access, correct, erase, restrict, port and object to the processing of your personal data, and rights relating to automated decisions. Where Embla is the processor for a practice's client data, please raise a request with that practice; we will assist them in responding. Where Embla is the controller (practice and staff accounts), contact us directly.

You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to put things right first.

For any privacy question or request, email joe@fintone.co.uk.