Privacy Policy
Last updated: 2 July 2026
1. Who we are
Acctora is a trading name of Griffin Services Limited, a company registered in England and Wales under company number 09775705 (“we”, “us”). We provide invoice-intelligence software for accountants and businesses, and act as the data controller for this website and your account data. For any questions about this policy or your data, contact privacy@acctora.com.
2. What we collect
- Account data — name, work email, role, and workspace details.
- Uploaded documents — invoices, credit and debit notes, and the fields extracted from them.
- Usage data — basic, privacy-friendly analytics (see “Cookies & analytics”).
3. How we use it & our lawful basis
We process personal data to provide and secure the service, on the basis of the contract with your organisation and our legitimate interests in operating the product. Where we process documents on behalf of an accounting practice or business, we act as a processor and that processing is governed by our Data Processing Agreement (DPA). Where a firm opts in, we may also use its data to help improve and train Acctora’s models, as described in that DPA; this is optional and can be withdrawn at any time.
4. Sub-processors & where data is held
We use vetted sub-processors for cloud infrastructure/CDN, application hosting, and — only when enabled — AI model inference, all configured for UK/EU data residency and zero data-retention for model requests. The named sub-processors are available in our DPA.
5. Retention & erasure
We keep your account data and uploaded documents for as long as your account remains open — we do not automatically delete your records, so your accounting history stays available and you remain able to meet your own statutory record-keeping obligations. We delete your data when you close your account, or earlier if you ask us to. You can request erasure of specific documents or your entire workspace at any time by emailing privacy@acctora.com (or from the Settings page in the app), and we will action it promptly.
When we action an erasure, we remove the data from our live systems straight away. Any residual copies held in our routine, access-controlled backups are then cycled out automatically and fully purged within 45 days — an approach recognised by the ICO, where live data is erased immediately and backups age out on a documented schedule. During that window the backup copies are not used for any purpose other than disaster recovery.
6. Your rights (UK GDPR)
You may request access, correction, deletion, restriction, or portability of your personal data, and object to certain processing. To exercise these rights, contact privacy@acctora.com. You may also complain to the Information Commissioner’s Office (ico.org.uk).
7. Cookies & analytics
This site uses privacy-friendly, cookieless analytics — no tracking cookies and no cross-site profiling — so no consent banner is required.
8. Changes
We may update this policy from time to time; material changes will be posted here with a revised date.