Privacy notice

1. Who is responsible

CODE MOORE LTD is responsible for operating Clarezan and is the controller of your account, support and service-security information. We also determine how optional bank-connection information is used within Clarezan.

If you use Clarezan for your business, you remain responsible for the personal information about customers, suppliers and other people that you put into your workspace. Where we store and process that information solely on your business's instructions, we act as its processor. Please upload only information you are authorised to use. People named in an invoice should normally contact the business that supplied it; we can help direct a request.

2. Information we handle

• Account information: your email address, optional first name and surname, a password hash, sign-in sessions and password-recovery records.
• Workspace information: uploaded invoice PDFs and filenames, extracted invoice details, company and contact details within them, invoice references, amounts, dates, notes, payment records and the history of changes. This may include information about people other than the account holder.
• Optional bank information: connected institutions and accounts, connection and consent status, transaction identifiers, amounts, currencies, dates, payment references and whether transactions are pending or booked. References and descriptions supplied by a bank may contain payer or payee names and other personal information.
• Support and technical information: information you send us, request times, service errors, security records and network information such as IP addresses processed by our hosting and network providers.

Information comes from you, people whose information you include in your workspace, your use of the service and, if you connect a bank, your chosen financial institution through Synci and its connectivity provider.

3. Why we use it

For processing where we are the controller, our purposes and UK data-protection bases are:

• Providing your account and requested features: managing access, storing and displaying records, recording payments and providing optional bank imports. We rely on performance of our contract with you where this processing is necessary to provide the service you request.
• Operating a reliable and secure service: preventing abuse, diagnosing failures, maintaining an audit trail and responding to support requests. We rely on our legitimate interests in protecting users and running the service. For business representatives who are not personally party to our contract, these interests also cover administering the business relationship.
• Meeting applicable legal obligations: responding to valid legal requests and retaining records where the law requires us to do so.

When processing workspace information on a business customer's instructions, that business is responsible for establishing its own lawful basis. Bank authorisation is a separate choice made through the provider's consent process; it does not authorise unrelated uses of your information.

We do not sell personal information or use invoice or bank data for advertising. Clarezan does not currently make solely automated decisions with legal or similarly significant effects on individuals. Automatic invoice matching is not currently enabled.

4. Optional bank connections

Choosing Connect bank opens Synci's hosted portal, where you select a supported institution and authorise access. We send Synci your Clarezan email address and an internal user reference to establish the connection. Bank login credentials are entered in the bank or provider's flow, not stored by Clarezan. This integration reads account information and transactions; it does not initiate transfers or move money.

We use imported information to display bank transactions and support payment reconciliation. Access tokens are encrypted on our server. Synci processes financial information for us, while the bank connectivity provider, such as GoCardless, has its own responsibilities and privacy notice. See the Synci Portal Privacy Notice and the notice shown for your selected provider.

You can stop future imports using Disconnect when the feature is available, and revoke bank-side consent through your bank or provider. Disconnecting does not erase transactions already imported into Clarezan or related invoice and payment history. Contact us separately to request deletion. A connection may need renewed authorisation when consent expires.

Transaction enrichment is currently off. We have disabled Synci's optional connection-status emails; Synci may still send portal authentication or essential service-access messages as described in its own notice.

5. Providers and sharing

We use providers as needed to operate the service:

• Railway: application hosting, background processing and the database.
• Cloudflare: private storage of original PDFs and domain/network services.
• Resend: requested account-recovery emails, including the recipient address and reset link.
• Synci and your selected connectivity provider: optional bank connections and transaction retrieval.

Authorised support personnel may access information where necessary to resolve a request or maintain the service. We may also disclose information when legally required or necessary to establish, exercise or defend legal claims. Invoice text extraction runs within our application infrastructure; the current parser does not send invoices to an external AI service.

International processing

Our providers operate internationally, including in Europe and the United States, so personal information may be processed outside the UK. Their published data-processing terms describe transfer safeguards, including standard contractual clauses and UK addenda where applicable: Railway, Cloudflare and Resend. Synci describes its arrangements in its portal notice. Contact our privacy contact for information about the locations and safeguards relevant to your data.

6. How long we keep information

Workspace records, original PDFs, recorded payments and audit history are kept while needed to provide your workspace. The current app does not automatically delete these records after a fixed period, and disconnecting a bank does not trigger deletion. Account or workspace deletion is handled by contacting us; there is currently no self-service account-deletion control.

When handling a deletion request, we consider whether the information is still needed for your requested service, outstanding support or security investigations, a specific legal obligation, or the establishment or defence of a legal claim. Where information must be retained, we explain the reason and applicable period. We distinguish deletion from active systems from copies in backups and provider systems, and explain any remaining retention when responding to your request.

Support and security records are retained according to the need to resolve the matter, protect the service and meet applicable obligations. Synci applies its own configured retention to its copy of financial data; that does not automatically delete Clarezan's imported copy. You can ask us about the retention applying to a particular record.

7. Security and browser storage

We use encrypted HTTPS connections, hashed passwords, access checks that separate users' workspaces and private document storage. Stored bank tokens are encrypted and kept on the server. No system can guarantee complete security.

Clarezan uses the invoice_session cookie to keep you signed in, with a seven-day session lifetime. Signing out removes the browser cookie. We also use local browser storage for your appearance preference and session storage to track an upload batch. These support the features you use. The current Clarezan application does not include advertising trackers or analytics cookies. Synci's hosted portal has its own browser-storage practices, described in its notice.

8. Your rights and complaints

Depending on the circumstances and lawful basis, you may ask to access, correct or erase personal information, restrict its use, or receive a portable copy. Where processing relies on consent, you can withdraw it without affecting processing already carried out lawfully.

Use the same address for any privacy request, including account deletion. We may need to verify your identity before releasing or changing information. We normally respond within one month; if a lawful extension or exception applies, we explain it.

You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. You can also contact the data-protection authority where you live. You do not need to contact us first.

Changes to this notice

We update this page when our practices change and show the revision date above. Where required, we will bring material changes to your attention before using information for a new purpose.