Privacy notice

Who we are

Cleva Ltd ("Cleva", "we", "us") runs cleva.co.uk, Barbara and the Cleva team of AI assistants, and the Meeting Cost Meter. We are a company registered in England and Wales, company number 13999699, registered office 86-90 Paul Street, London, England, EC2A 4NE.

Questions about this notice or your information: [email protected], or write to us at our registered office.

The short version

• We only collect what we need to run the service, bill for it and keep it secure.
• When a business uses Barbara, the documents and messages it sends belong to that business. We process them on its behalf, under our data processing agreement.
• We never sell personal information, and we never use our customers' data to train AI models.
• Our website sets no advertising or analytics cookies.
• You can ask to see, correct or delete your information at any time.

When we decide, and when we act for our clients

We are the controller (we decide how the information is used) for: people who visit our website or contact us; people who sign up, buy or manage a Cleva account; and people who message a Cleva WhatsApp number without being registered by a client.

We are a processor (we act on a client's instructions) for everything a client's team sends to Barbara and her team: invoices, statements, messages, voice notes, and the client's Xero data. That includes details of the client's staff, suppliers and customers. The client is the controller of that information and its own privacy notice applies. If you are a client's employee, supplier or customer and want to exercise your rights over that information, contact the client; we will help them respond.

We also use limited information about client users as a controller where we need to for our own purposes: running and securing the service, preventing misuse, measuring usage for billing, and meeting legal obligations.

What we collect

• Website visitors: technical information our hosting and security provider receives when you load a page, such as your IP address, browser type and the pages requested.
• Enquiries: your name, email address, business name and anything you write to us.
• Customers: account holder name, business details, email address and phone number; billing details (card and Direct Debit details are held by Stripe, not by us); plan, usage and support history.
• Client users (people a client adds to Barbara): name, mobile number, WhatsApp user ID, role (Submitter, Approver or Director), which companies they work with, and a record of messages and approvals.
• Unregistered senders: if you message a Cleva WhatsApp number without an account, your number or WhatsApp user ID and your first message, so we can reply and follow up.
• Meeting Cost Meter users (as processor for the organisation): the organisation's Microsoft tenant ID, a one-way coded version of each user's Microsoft ID (we never see or store names or email addresses), the Teams meeting ID, an optional meeting name and department, the number of attendees in each pay band, and meeting times and costs. Individuals' salaries are never entered or stored: costs use published pay scales or the organisation's own bands.
• Content clients send us (as processor): documents and the information in them, such as supplier names, invoice details and sometimes bank details; messages and voice note transcripts; and the accounting data Barbara reads from the client's Xero.

Please do not send us health information or other special category data. The service is not designed for it.

How we use it and why we are allowed to

• To provide the service you or your employer signed up for: setting up accounts, verifying people with join codes, reading documents, drafting bills, sending approvals, answering questions. Lawful basis: contract (for account holders) and our legitimate interest in providing the service a client has bought (for their users).
• To bill and keep financial records. Lawful basis: contract and legal obligation (tax and company records).
• To keep the service secure and prevent misuse, including fraud, spam and attacks. Lawful basis: legitimate interests.
• To reply to enquiries and to people who message us without an account, including one follow-up about the service. Lawful basis: legitimate interests.
• To tell customers about service changes, and, where you have agreed or you are an existing customer, about similar Cleva services. You can opt out of marketing at any time using the link in each email.
• To comply with the law and respond to lawful requests from authorities. Lawful basis: legal obligation.

AI and automated processing

Barbara and her team are AI assistants. They read documents and messages and prepare drafts, such as bills in Xero. They do not make decisions that have legal or similarly significant effects on you: every bill stays a draft until a person at the client approves it, and the assistants never pay money, move money or change bank details.

The AI model we use is provided by Anthropic under commercial terms that do not allow customer data to be used to train its models. We do not use clients' data to train AI models either. The assistants always say they are AI if asked.

Who we share it with

We share personal information only with:

• Service providers that help us run Cleva, under contracts that require them to protect it and use it only for us. The providers who handle clients' data are listed on our sub-processors page. Stripe handles our billing; Cloudflare hosts our website and email.
• Systems you connect, such as Xero and WhatsApp, which receive information when you use them through Cleva.
• Professional advisers, such as accountants and lawyers, under confidentiality.
• Authorities, where the law requires it.
• A buyer or successor, if Cleva's business is sold or reorganised, under the same protections.

We never sell personal information.

International transfers

Some of our providers process information outside the UK, mainly in the United States and the European Economic Area, and Kapso is based in Chile. Where that happens we rely on UK adequacy regulations (including the UK-US data bridge for certified US companies) or on the ICO's International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with any further safeguards needed. You can ask us for details.

How long we keep it

• Client service data (users, documents data, approvals, Xero connection): for as long as the client's account is open, then deleted within 90 days of cancellation. Xero access is removed on the first daily run after cancellation.
• Audit log of messages and actions: 24 months.
• Unregistered senders: 12 months after the first message.
• Workflow processing logs: 30 days.
• Enquiries that do not become customers: 2 years.
• Billing and account records: 6 years after the end of the financial year they relate to, as tax law requires.

Invoices and bills created in Xero stay in the client's own Xero account, under the client's control. Copies held by WhatsApp and our messaging provider are kept in line with their terms.

How we protect it

We use encryption in transit, strict access controls (our database can only be reached with service credentials, and each person sees only what their role allows), verification of every person's phone number before they can use Barbara, separate credentials for each provider, and logging of actions. Our data processing agreement lists our security measures in full. No system is perfectly secure; if a breach affects you, we will tell you and the ICO where the law requires.

Your rights

You have the right to:

• ask for a copy of your personal information;
• ask us to correct it, or to delete it;
• object to, or ask us to restrict, how we use it;
• ask for it in a portable format;
• withdraw consent where we rely on it, and opt out of marketing at any time.

Email [email protected]. We will reply within one month. Some rights have legal limits, which we will explain if they apply. If your information came to us from a client, we will pass your request to them or help them answer it.

Cookies

Our website does not use advertising, tracking or analytics cookies, and it loads no content from third parties: our fonts are hosted on our own site.

Our hosting and security provider, Cloudflare, may set strictly necessary cookies to protect the site from bots and attacks. These do not track you across other sites and do not need your consent. The Cleva portal uses strictly necessary cookies to keep you logged in.

If we ever add other cookies, we will ask for your consent first and update this section.

Complaints

Please tell us first so we can put things right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Changes to this notice

We will update this notice when our services or the law change, and tell customers about significant changes by email. The date at the top shows the latest version.