Privacy policy

1. Who we are

Brainwave Designs Ltd (company number 17063005, 22 Commerce Road, Lynchwood, Peterborough, PE2 6LR) operates Spendvora. For anything in this policy you can reach us at procurement@brainwavedesigns.co.uk.

2. We wear two hats

It matters which one applies, because it decides who answers to whom.

• We are the controller for data about our own relationship with you: the account holder's name and work email, the company details you give us, sign-in records, billing records and support conversations. We decide how that data is used, and this policy explains it.
• We are a processor for the content you put into your Spendvora tenant: supplier records, invoices, purchase orders, budgets, uploaded documents and the personal data that happens to sit inside them, such as a supplier contact's name and email. You are the controller of that content. We only process it to run the service for you and to follow your instructions.

If someone asks us to delete personal data that sits inside a customer's tenant, we point them at that customer, because it is not ours to delete.

3. What we collect

When you sign up: company name, your name, work email, phone number if you give it, the plan you chose, any notes you write in the form, and your password, which is stored only as an Argon2id hash. We never see or store the password itself.

When you use the app: sign-in sessions including IP address and browser user agent, an activity log of meaningful actions with the user, action, record and IP address, in-app notifications, and the records your team creates such as suppliers, items, purchase orders, invoices and budgets.

When you upload documents: the files themselves, plus the data extracted from them. Uploaded files are held on the application server only while the AI queue works on them, then archived into a private storage bucket and removed from local disk.

When you subscribe: billing contact details and payment records. Card details are entered on Stripe's own checkout pages and never reach our servers.

When you connect Xero: OAuth tokens for your Xero organisation, encrypted at rest, plus the reference data you choose to import such as suppliers, expense accounts, tax rates and tracking categories.

When you contact us: your name, email, company and the message you send.

We do not run analytics, advertising or tracking scripts on this site or in the app. See the cookie notice for the three cookies we do set.

4. Why we use it, and our legal basis

• To provide the service you asked for (contract): creating your tenant, signing you in, running scans, sending notifications, generating purchase orders, keeping your records available.
• To take payment (contract): trials, subscriptions and one-off yearly payments through Stripe.
• To keep the service secure and working (legitimate interests): sign-in records, the activity log, error logs, fair-use metering of AI scans, and investigating abuse.
• To support you and tell you about the account (contract and legitimate interests): replying to enquiries, trial reminders, billing notices and important service messages.
• To meet our own legal duties (legal obligation): accounting and tax records, and responding to lawful requests.

We do not sell personal data, we do not share it for anyone else's marketing, and we do not make automated decisions about people that have legal effects on them.

5. AI processing of your documents

To extract data from an uploaded invoice or purchase order, we send the document to the OpenAI API and receive structured fields back. That means the contents of documents you scan, including any personal data inside them, are processed by OpenAI in the United States.

OpenAI states that data submitted through its API is not used to train its models. If you would rather the platform key was not involved at all, add your own OpenAI API key in Settings, in which case the calls are made with your key under your own agreement with OpenAI. Your key is encrypted before it is stored.

If you do not want a document processed by AI, do not upload it for scanning.

6. Who else processes data for us

We use a small set of sub-processors, each under a contract that limits them to processing data for us. The current list, with purpose and region, is on our sub-processors page. In summary:

• OpenAI, L.L.C.: AI extraction of supplier, line item, VAT and total data from uploaded documents. United States.
• Amazon Web Services (S3): Private archive storage for uploaded documents after scanning. Ireland (eu-west-1).
• Stripe Payments Europe: Subscription and one-off payments after the free trial. Ireland, with group companies in the United States.
• Brainwave Designs mail server: Sending notification emails, purchase orders to suppliers and account emails. United Kingdom.
• Xero Limited (only if you enable it): Pushing draft bills and purchase orders into your own accounting ledger, and importing reference data from it. New Zealand and Australia.
• Hosting provider: Running the Spendvora application servers and database. United Kingdom.

We may also share data with professional advisers, or with authorities where the law requires it. If the business is ever sold or restructured, data may transfer with it, and your rights under this policy travel with the data.

7. Transfers outside the UK

Most processing happens in the UK and Ireland. Two exceptions are worth naming: AI extraction takes place in the United States with OpenAI, and Xero processes data in New Zealand and Australia if you connect it. Where data leaves the UK we rely on the UK's international data transfer agreement or addendum to the EU standard contractual clauses, together with the safeguards those providers publish.

8. How we protect it

• Every customer sits in a separate tenant, and application queries are scoped to that tenant so one customer cannot see another's records.
• Passwords are hashed with Argon2id. We cannot recover them, only reset them.
• API keys and Xero OAuth tokens are encrypted before they are written to the database.
• Uploaded documents live in a private bucket that is not publicly readable. Viewing a file goes through a short-lived signed link that expires within minutes.
• Traffic is served over HTTPS, session cookies are HTTP-only, and every action that changes data is protected against cross-site request forgery.
• Meaningful changes are written to an activity log so account owners can see who did what.
• Access to production systems is limited to the people at Brainwave Designs who need it.

No system is perfect. If a breach affects your personal data and creates a real risk to people, we will tell the ICO within 72 hours where required, and tell you without undue delay.

9. How long we keep it

• While your account is open: we keep your tenant data so the service works and your history stays intact.
• After you close the account: we keep the data for up to 30 days so you can ask for a copy, then delete or anonymise it.
• Sign-in sessions: expire after 14 days and are cleared out after that.
• Activity log: kept for the life of the tenant, because its point is to be an audit trail.
• Billing and accounting records: kept for six years plus the current year, as UK tax law requires.
• Enquiries: kept for up to two years unless they become part of a customer relationship.

10. Your rights

Where we are the controller, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable form. You can also object to processing we base on legitimate interests.

Email procurement@brainwavedesigns.co.uk and we will respond within one month. There is no charge unless a request is excessive.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can fix it.

11. Changes to this policy

When we change this policy the version and date at the top of the page change with it. If a change is significant we will tell account owners by email or in the app.