Privacy policy

EMBLA AI LTD(“Embla”, “we”) operates the Embla onboarding platform for UK accountancy practices. We are registered in England & Wales, company number [company number — to confirm], registered office [registered office address — to confirm]. We are registered with the Information Commissioner's Office (ICO) under [ICO registration number — to confirm].

This policy explains what personal data we handle and why. It is a first draft under review — see the note above.

Embla acts in two roles, and which one applies depends on whose data it is. [CONFIRM in review.]

We are the controller for data about the practices that use Embla and their staff — the people who hold accounts with us — and for running and securing our own service.

We are a processoracting on each practice's instructions for that practice's own client data. When a business owner completes an enquiry or uploads documents, the accountancy practice is the controller of that data; Embla processes it on their behalf to provide the onboarding tooling. Each practice's data is kept isolated from every other practice.

When a practice registers and its staff use Embla, we hold:

• name, work email and phone number;
• the practice's professional body, anti–money-laundering (AML) supervisor, ICO registration, and professional-indemnity insurer and policy details, where provided;
• authentication data (sign-in, multi-factor authentication) and security logs.

When a practice onboards a client through Embla, we process — on that practice's instructions — data such as:

• name, email and business details from the enquiry;
• for sole traders: home address, National Insurance number and Unique Taxpayer Reference (UTR);
• AML / identity-verification documents (for example photo ID and proof of address);
• company information retrieved from Companies House on the client's behalf;
• where a client connects their accounting software, the OAuth access tokens we hold per client to read that data (for example Xero). Tokens are held per client and per practice and are not shared across practices.

For practice and staff account data, our lawful bases are:

• Contract — to provide the service to the practice;
• Legitimate interests — to keep the service secure and to improve it.

For client data we process as a processor, the practice sets the lawful basis as controller; we act on their instructions. Identity-verification and AML data is processed to support the practice's obligations under the Money Laundering Regulations 2017 — a legal obligation basis. [CONFIRM in review.]

We use a small number of trusted providers to run Embla. Several are used only when a practice enables the relevant feature, so not every practice's data touches every provider. [CONFIRM in review.]

• Supabase — Database, authentication and file storage (London, UK (eu-west-2))
• Vercel — Application hosting and content delivery (EU/global edge network)
• Resend — Transactional email delivery (proposals, links, notifications) (USA)
• Companies House — Public company-data lookups on a client's behalf (UK)
• GoCardless — Direct Debit mandate setup and collection (UK/EU)
• Xero — Per-client accounting-data access where a practice connects it (EU/global)
• SignWell — Engagement-letter e-signature (where enabled) (USA)
• Anthropic — Optional AI assistance over documents/text (gated, off by default) (USA)
• Microsoft (Graph) — Shared-mailbox routing of client email (gated, off by default) (EU/global)
• Dropbox — Per-client document folders where a practice enables it (USA/EU)
• Twilio — SMS delivery for the assisted-digital channel (gated, off by default) (USA/global)

Our primary database, authentication and file storage are hosted in the UK (London). Some providers listed above are based outside the UK, including in the USA. Where personal data is transferred outside the UK, we rely on UK GDPR transfer safeguards such as the UK International Data Transfer Agreement or an adequacy decision. [CONFIRM in review.]

We keep practice and staff account data for as long as the account is active and for a reasonable period afterwards. Client data is kept according to the practice's instructions and retention policy. Identity and AML records are subject to the Money Laundering Regulations 2017, which generally require retention for five years after the end of the business relationship. [CONFIRM retention periods in review.]

Under UK GDPR you have rights to access, correct, erase, restrict, port and object to the processing of your personal data, and rights relating to automated decisions. Where Embla is the processor for a practice's client data, please raise a request with that practice; we will assist them in responding. Where Embla is the controller (practice and staff accounts), contact us directly.

You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to put things right first.

For any privacy question or request, email joe@fintone.co.uk.