Privacy Policy

1. Introduction and Data Controller

This privacy policy explains how FourFourFive Limited (a company registered in Scotland) collects, uses, stores, and protects your personal data when you use our services.

FourFourFive Limited is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC118959.

We are committed to protecting your privacy and handling your data in a transparent, lawful, and fair manner. If you have any questions about this policy or our data practices, please contact us at team@445innovation.com.

Our registered address is: FourFourFive Ltd, 4 Hughes Close, Edinburgh, EH7 4FU.

2. Information We Collect

(a) Account Information

When you create an account, we collect and store:

Your full name
Email address
Company name
Password (stored as a secure hash - we never store your password in plain text)

If you sign in using Xero Single Sign-On (SSO), we receive the following from Xero's identity service: your email address, first name, last name, and Xero user identifier. We use these solely to create or sign you into your account. This uses Xero's OpenID Connect scopes (openid, profile, email) and does not grant us access to your accounting data.

(b) Xero Data (Accessed via OAuth with Your Explicit Consent)

Important: Signing in via Xero SSO and connecting a Xero organisation are separate actions. SSO only accesses your basic identity (email, name). The scopes listed below are only requested when you explicitly connect a Xero organisation to use accounting features.

If you choose to connect your Xero account, we request access to specific data via Xero's OAuth 2.0 authorisation flow. You explicitly grant consent for each scope before any data is accessed. The scopes we request are:

openid - OpenID Connect profile identification
profile - Your Xero user profile information
email - Your email address registered with Xero
accounting.banktransactions.read - Read bank transactions (used by Recurring Spend for Xero to identify recurring outgoings)
accounting.payments.read - Read payment records (used by Recurring Spend for Xero to detect recurring spend patterns)
accounting.invoices - Create purchase orders (used by Purchase Order Importer to push purchase orders into your Xero account at your explicit request)
accounting.journals.read - Read journal entries (used by Recurring Spend for Xero to analyse spend patterns)
accounting.contacts.read - Read your contact list (used by Purchase Order Importer to look up suppliers)
offline_access - Allows us to maintain your connection using refresh tokens so you do not need to re-authorise each session

(c) Payment Information

Payment processing is handled entirely by Stripe. We do not store your credit or debit card details on our servers. Stripe is PCI DSS Level 1 compliant - the highest level of payment security certification. We receive only a confirmation of payment status and a reference to your Stripe customer record.

(d) Usage Data

We collect records of feature usage, including which products you use, scan metadata (such as timestamps and result counts), and credit consumption. This data helps us monitor service usage and improve our products.

For our free tools we record each use, so we know which tools people rely on. For Bank-Bridge that is each file you convert: which bank format you chose, the type of file you uploaded and how many payments it held. For Purchase Order Importer it is each batch you send to Xero: how many purchase orders it contained and how many Xero accepted. We never record the contents of your files: no payee names, account numbers, references or amounts. Bank-Bridge files are still processed entirely in your browser and never uploaded.

When you create an account we also record how you first arrived at FourFourFive: the page you landed on, the domain of the website that linked to it (for example google.com) and any campaign (UTM) tags in the link. This tells us which pages and channels bring people to FourFourFive. It is collected in your browser, and you can switch it off, as described in section 11 ("Sign-up source").

(e) Communications

If you contact us for support or send us feedback, we retain the content of those communications along with your email address so we can respond and improve our services.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide and operate our services - including authenticating your identity, managing your account, and delivering the features you have subscribed to.
To process Xero data for specific product features - Recurring Spend for Xero reads your journals, bank transactions, and payments to analyse recurring spend patterns and identify trends. Purchase Order Importer reads your contacts and creates purchase orders in Xero at your explicit request.
To process payments - subscription and one-off payments are processed securely via Stripe.
To send transactional emails - including welcome emails, scan result notifications, team invitations, and password reset emails, delivered via Resend.
To improve our services - usage data and feedback help us understand how our products are used and where we can make improvements.
To comply with legal obligations - including maintaining financial records as required by UK tax law.

4. Xero Data Handling

This section provides detailed information about how we access, process, and protect data from your Xero account. We take our responsibilities as a Xero app partner seriously and are committed to handling your accounting data with the utmost care.

Consent and Access

We only access your Xero data after you have explicitly granted consent via Xero's OAuth 2.0 authorisation flow. You are presented with a clear list of permissions (scopes) before authorising, and you may decline at any time. We request only the scopes necessary to deliver the features you use.

What Each Scope Is Used For

openid, profile, email - Identifying your Xero user account and linking it to your FourFourFive account.
accounting.banktransactions.read - Reading bank transactions to identify recurring outgoings (Recurring Spend).
accounting.payments.read - Reading payment records to detect recurring spend patterns (Recurring Spend).
accounting.invoices - Creating purchase orders in your Xero account at your explicit request (Purchase Order Importer). Note: this is Xero's bundled scope that also covers invoices, credit notes, and related transaction types; we only use it to write purchase orders.
accounting.journals.read - Reading journal entries to identify and analyse recurring spend patterns.
accounting.contacts.read - Reading your supplier and contact list so you can select recipients when creating purchase orders.
offline_access - Maintaining your connection via refresh tokens so you do not need to re-authorise each time you use the service.

How Xero Data Is Processed

Xero transactional data (journals, bank transactions, payments, contacts) is fetched on demand when you initiate an action such as running an analysis or creating a purchase order. This data is processed in isolated server-side edge functions (secure, sandboxed compute environments) and is not persistently stored in our database. Once processing is complete, the raw Xero data is discarded.

The only outputs we retain are:

Scan findings - pattern matches and summary data generated from the analysis (stored in our database and associated with your account)
Xero OAuth tokens (access and refresh) - stored securely to maintain your connection
Xero tenant metadata - your connected organisation name, ID, and connection status

What We Will Never Do with Your Xero Data

We will never sell your Xero data to any third party.
We will never share your Xero data with third parties for their own purposes.
We will never use your Xero data for artificial intelligence, machine learning, or model training purposes.
We will never use your Xero data for advertising or marketing purposes.
We will never access your Xero data beyond what is necessary to deliver the specific features you have chosen to use.

Disconnecting Your Xero Account

You can disconnect your Xero account at any time via Settings > Connections in your dashboard. When you disconnect:

Your OAuth tokens are revoked on Xero's side, immediately ending our access to your Xero data
Your locally stored OAuth tokens (access and refresh) are deleted from our database
Your Xero tenant records are marked as revoked

After disconnecting, we can no longer access any data from your Xero account.

5. Data Retention

We retain your data only for as long as necessary to fulfil the purposes described in this policy:

Account data (name, email, company name) - retained while your account is active. Permanently deleted when you delete your account.
Xero OAuth tokens - retained while your Xero account is connected. Deleted immediately when you disconnect your Xero account or delete your FourFourFive account.
Xero transactional data (journals, bank transactions, payments, contacts) - not retained. This data is fetched on demand, processed in memory, and discarded after each operation.
Scan findings - retained while your account is active. Permanently deleted when you delete your account.
Payment records - retained for a minimum of six years as required by UK tax law (HMRC record-keeping requirements).
Usage logs - retained for service improvement and billing accuracy while your account is active. Deleted when you delete your account.

6. Data Security

We take the security of your data seriously and implement appropriate technical and organisational measures to protect it:

Encryption in transit - all data transmitted between your browser and our servers is encrypted using TLS/HTTPS.
OAuth 2.0 authorisation - industry-standard protocol for secure, delegated access to your Xero account. We never see or store your Xero password.
Row Level Security (RLS) - database-level access controls ensure that users can only access their own data. Every database query is scoped to the authenticated user.
Isolated server-side processing - Xero data is processed in isolated edge functions (sandboxed compute environments) that are spun up per request and do not share state between users.
SOC 2 Type II compliant infrastructure - our database and authentication services are hosted on Supabase, which maintains SOC 2 Type II compliance for its infrastructure.
Secure password storage - passwords are hashed using industry-standard algorithms and are never stored in plain text.
Two-factor authentication (2FA) - optional TOTP-based second factor using an authenticator app (such as Google Authenticator or Authy). When enabled, a six-digit code from your authenticator app is required in addition to your password each time you sign in.
Token encryption at rest - Xero OAuth tokens are encrypted using AES-256-GCM before being stored in our database.
Audit logging - authentication events and Xero connection activities are recorded in an immutable audit log retained for a minimum of one year for compliance and security monitoring purposes.

8. International Data Transfers

Our database and server-side processing infrastructure is hosted by Supabase in the US East (Ohio) region on Amazon Web Services. This means your data is transferred from the United Kingdom to the United States for processing and storage.

For these transfers, we rely on appropriate safeguards as required by UK GDPR, including standard contractual clauses and the data processing agreements provided by our infrastructure providers. Supabase maintains SOC 2 Type II compliance for its infrastructure, providing assurance of robust security controls.

Stripe (payment processing) and Resend (email delivery) may also process data outside the UK. Both providers maintain appropriate certifications and contractual safeguards for international data transfers.

9. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data:

Right of access - you can request a copy of the personal data we hold about you.
Right to rectification - you can ask us to correct any inaccurate or incomplete personal data. You can also update your name, email, and company name directly in your account settings.
Right to erasure - you can request that we delete your personal data. You can also delete your account directly via Settings > Profile in your dashboard.
Right to restriction of processing - you can ask us to restrict the processing of your personal data in certain circumstances.
Right to data portability - you can request a copy of your data in a structured, commonly used, machine-readable format.
Right to object - you can object to our processing of your personal data where we rely on legitimate interests as the legal basis.
Right to withdraw consent - where processing is based on your consent (such as Xero OAuth authorisation), you can withdraw consent at any time. For Xero, you can do this via Settings > Connections.

To exercise any of these rights, you can use the self-service options in your account settings or contact us at team@445innovation.com. We will respond to your request within one month, as required by UK GDPR.

10. Data Deletion

We provide multiple ways to delete your data:

Disconnect Your Xero Account

Navigate to Settings > Connections in your dashboard. Disconnecting will revoke your OAuth tokens on Xero's side, delete your stored tokens from our database, and mark your Xero tenants as revoked. We will immediately lose all access to your Xero data.

Delete Your Account

Navigate to Settings > Profile in your dashboard. Deleting your account is permanent and irreversible. Cascade deletion automatically removes all associated data, including:

Your profile and account information
Xero OAuth tokens and tenant records
Scan findings and analysis data
Organisation membership records
Usage logs and notifications
User role assignments

Request Deletion by Email

You can also request data deletion by emailing us at team@445innovation.com. We will process your request and confirm deletion within one month.

11. Cookies and Local Storage

We use minimal cookies and browser storage: what our service needs to work, and one first-party record of how you first arrived:

sidebar:state (cookie) - stores your sidebar open/closed preference. Expires after 7 days. This is a functional cookie required for the user interface.
Authentication session token (localStorage) - stores your Supabase authentication session so you remain signed in between visits.
UI preferences (localStorage) - stores interface preferences such as theme selection and tab states.
Sign-up source (localStorage) - the page you first landed on, the domain of the website that linked to it and any campaign (UTM) tags in the link. Discarded after 90 days at most. If you create an account, it is stored with your account (see section 2(d)). It contains nothing that identifies you. You can switch it off (see "Sign-up source" below).
first_touch_optout (cookie and localStorage) - records your choice to switch the sign-up source off. It holds only the value 1 and lasts 12 months.

When you first visit, we record the page you arrived on, the website that sent you, and any campaign tags in the link. This is kept in your browser for up to 90 days (in local storage, and in a cookie, first_touch, that one of our own websites may already have set). If you sign up, it is saved with your account. We use it only to understand which of our pages bring people to us. It is never shared, sold or used to follow you on other websites. UK law allows this kind of statistical measurement without asking first, as long as you can switch it off, which you can do here. To remove it from an existing account, email team@445innovation.com.

We do not use any analytics cookies, third-party tracking cookies, or advertising cookies. There is no third-party tracking of any kind on our platform.

For more details, see our Cookie Policy.

12. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

Performance of a contract (Article 6(1)(b)) - processing your account data, delivering the services you have subscribed to, and processing payments are necessary for the performance of our contract with you.
Consent (Article 6(1)(a)) - accessing your Xero data is based on your explicit consent, granted via Xero's OAuth authorisation flow. You can withdraw this consent at any time by disconnecting your Xero account.
Legitimate interests (Article 6(1)(f)) - we process usage data and service analytics for the legitimate purpose of improving our products and ensuring service reliability. We have assessed that this processing does not override your rights and freedoms.
Legal obligation (Article 6(1)(c)) - we retain payment and transaction records as required by UK tax law and HMRC record-keeping requirements.

13. Children's Privacy

Our services are designed for business use and are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 16, please contact us at team@445innovation.com.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or legal requirements. If we make material changes, we will notify you by email or via a prominent notice within the application before the changes take effect.

We encourage you to review this policy periodically. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Complaints

If you have any concerns about how we handle your personal data, we encourage you to contact us first at team@445innovation.com so that we can try to resolve the matter directly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO via their website at ico.org.uk or by telephone on 0303 123 1113.

16. Contact Us

If you have any questions about this privacy policy or our data practices, please get in touch:

Company: FourFourFive Limited (a company registered in Scotland)
Email: team@445innovation.com
Registered address: FourFourFive Ltd, 4 Hughes Close, Edinburgh, EH7 4FU
ICO registration: ZC118959