Privacy notice

1. Who we are

Tolvi is software for UK accountancy practices (Tolvi Hub, Tolvi Working Papers, Tolvi Accounts, Tolvi Corporation Tax, Tolvi Self Assessment, Tolvi Meetings and the Admin console) and, through Tolvi Books, bookkeeping software for UK small businesses. It is provided by Ashleigh Hall, a sole trader trading as Tolvi Software, of 17 Robert Tressell Close, Hastings, TN34 1UP, United Kingdom ("Tolvi", "we", "us").

For anything about this notice or your personal data, email support@tolvi.co.uk with "Privacy" in the subject.

2. Our role: controller or processor

We handle personal data in two different capacities, and it matters which one applies.

• As a controller, we decide how and why we use the personal data in this notice: people who visit our website, sign up for a trial, use Tolvi as a member of a firm's team, buy a plan, or contact us.
• As a processor, we hold and process data that accountancy firms put into Tolvi about their own clients (for example trial balances, ledgers, documents, statutory accounts, tax returns, the names of directors, partners or employees that appear in them, and the client contacts and tax references a firm records). For that data the firm is the controller and we act only on its instructions under the data processing terms in our terms of service. If you are a client of a firm that uses Tolvi, please contact that firm about your data; we will pass on any request we receive.
• For Tolvi Books, a business's books (its transactions, customers, suppliers, invoices, receipts and VAT records) belong to the business. The business is the controller of the personal data in them and we are its processor. An accountancy practice the business links to its books uses that data for its own work for the business, as a separate controller. We are a controller only for the account, sign-in, billing and support data described in this notice. See section 9.

3. What we collect

• Account and team details: name, work email address, the firm you belong to, your role and permissions, invitations you send or accept, and your preferences (such as notification settings and progress through the welcome tour).
• Sign-in data: your sign-in identity and security events. Passwords are handled by our identity provider; Tolvi never sees or stores them.
• Billing details: the firm's billing contact, address, VAT number if given, plan, invoices and payment status. Card and bank details are collected and held by Stripe, not by us.
• Usage and audit data: what you do in Tolvi (for example imports, journals, review points and sign-offs), with dates and times, kept as an audit trail for your firm; and technical logs such as IP address, browser type and errors, used to keep the service secure and working.
• Sign-up and marketing preferences: when a firm signs up we record the founder's name, email, the date, and whether they chose to receive marketing emails, with the wording they saw.
• Correspondence: emails and support requests you send us.
• Meetings: if your firm uses Tolvi Meetings, for each meeting someone in the firm chooses to record: the meeting link and time, the note-taker's status, the transcript (who said what, and when), and the summary and actions drafted from it. If someone connects their Outlook calendar, we read the meetings in it so they can choose which to record; we do not store the calendar.
• Connected bookkeeping software: if your firm connects a client's Xero, QuickBooks, Sage or FreeAgent organisation, we store the connection and encrypted access tokens, and the balances and transactions pulled for the year-end file.

4. How we use it and our lawful bases

• To provide Tolvi to your firm, including your account, sign-in, notifications and support: performance of our contract with your firm, and our legitimate interest in providing the service to the people your firm authorises.
• To bill for Tolvi and keep financial records: performance of contract and our legal obligations (for example tax and accounting records).
• To send service emails, such as invitations, review notifications, deadline reminders, security notices and messages about your trial or plan: performance of contract and our legitimate interest in helping firms get value from their trial. Optional emails (such as trial tips) include an unsubscribe link.
• To keep Tolvi secure, prevent misuse, and investigate problems: our legitimate interests and, where relevant, legal obligations.
• To improve Tolvi using aggregated information about how features are used: our legitimate interest in developing the service.
• To handle early-access requests: if you register on our early-access form or email us, we keep your name, email and the firm details you give us (stored in AWS London), and use them to reply and to tell you when Tolvi opens to your firm: your request and our legitimate interest in launching Tolvi. We don't use them for anything else, and you can ask us to delete them at any time.
• To send marketing emails only where you have opted in: your consent (see below).

Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details.

5. Marketing emails

The marketing box at sign-up is unticked unless you tick it. If you opt in, we may email you about new features, events and offers. You can withdraw consent at any time using the link in any marketing email or by emailing us, and this does not affect emails we need to send to run your account.

6. Cookies and similar technologies

Our website does not set advertising or analytics cookies and does not load third-party tracking. The fonts are served from our own servers.

The Tolvi app uses only what is strictly necessary to sign you in and keep your session secure (cookies or browser storage set by us and our identity provider), and to remember interface choices such as which panels you have open. Because these are strictly necessary or set at your request, no consent banner is needed. If we ever add optional cookies, we will ask first.

7. Tolvi AI

Tolvi AI features (such as explaining movements, suggesting mappings and drafting client queries) send the relevant working paper content to Anthropic's Claude models, run through Amazon Bedrock in AWS's London region. The content is used only to produce the result you asked for; it is not used to train AI models. Every AI result is a suggestion: nothing changes in a file until a person accepts it. Firms can switch AI features off in Settings.

8. Tolvi Meetings

When someone at a firm sends Tolvi's note-taker to a meeting, it joins as a visible participant called "Tolvi Notetaker" and posts a message in the meeting chat saying it is recording, so everyone in the meeting knows. The firm decides which meetings to record and is responsible for telling its clients; a meeting in a connected calendar is never recorded unless someone at the firm has chosen it.

The note-taker and recording are provided by Recall.ai in its EU region (Frankfurt, Germany), and its transcription runs in Dublin, Ireland (EU). As soon as the transcript and summary are saved in Tolvi, we delete the recording (audio, video and Recall's copy of the transcript) from Recall. If that deletion fails for any reason, Recall deletes it automatically after 72 hours. We keep the transcript and summary as part of the firm's data. The summary and actions are drafted by Tolvi AI (see above).

9. Tolvi Books

Tolvi Books is bookkeeping software that a business uses directly, or that its accountancy practice sets up and runs for it. This section explains the personal data involved. For the books themselves, we act on the business's instructions as its processor (see section 2 and the data processing terms in our terms of service).

• Business owners and their staff: name, email address, role in the business, sign-in and security events, and what each person does in the books (kept as the business's audit log). Business owners sign in through our identity provider, as practice staff do.
• The books: bank statement lines and balances the business uploads, ledger entries, invoices and credit notes, and the names, addresses, email addresses, VAT numbers and payment details of the business's customers and suppliers. For a sole trader, the books are also a record of the owner's own finances, and payments in them can reveal sensitive information (for example a donation to a church or a trade union). We use the books only to provide Tolvi Books to the business and those it authorises.
• Receipts and bills: the photos, PDFs and emails the business sends to Tolvi Books, and what was read from them. Once a receipt or bill is in the books, the original file is kept, unchanged, as the business's record, because HMRC expects the business to keep the document itself and not only the figures taken from it. Uploaded documents are limited to accepted file types and scanned for malware.
• Bank data from an open-banking provider: bank feeds are not available yet. When they are, a business will be able to connect a bank account through a regulated open-banking provider, which will pass us the account details, balances and transactions the business agrees to share, for as long as its consent lasts. We will name the provider in this notice, with its role and where it processes data, before bank feeds start.
• HMRC: filing VAT returns with HMRC from Tolvi Books is not yet available. When it is available and a business connects Tolvi Books to HMRC, we will hold the connection's access tokens (encrypted), the business's VAT obligations, liabilities and payments as HMRC reports them, and each return filed with HMRC's receipt. HMRC's rules for software that files returns require us to send it information about the device and connection used (fraud prevention headers): for example the IP address, browser, screen size, time zone and a device identifier. We collect these only when they are needed for a call to HMRC. HMRC is a separate controller of the data it receives.
• AI processing: Tolvi AI in Tolvi Books reads receipts, drafts invoices from a sentence and checks VAT returns, using Anthropic's Claude models run through Amazon Bedrock in AWS's London region. Only the content needed for the task is sent. It is not used to train AI models, and every result is a suggestion that a person confirms. AI is included in the Tolvi Books price, so there is no token use to record against a person.
• Accountancy practices: a business can link one or more accountancy practices to its books and choose what each can do. A linked practice can see and, if the business allows, change the books, and every change is recorded with the person and the practice. A practice may also set up Tolvi Books for a client and run it until the owner takes it over. Each practice is responsible, as a controller, for how it uses the client's data in its own work, for example in its working papers. The business can end a practice's access at any time.
• How long: the books, receipts and VAT records are kept for as long as the business uses Tolvi Books. When its subscription or trial ends without a new plan, the business keeps read-only access (viewing, downloads, exports and receipts) for 6 years, so that it can meet its own record-keeping duties: 6 years for VAT and company records, and 5 years after the 31 January filing deadline for self assessment. After that we delete them, as set out in our terms. [Retention of Books Data for 6 years after a Tolvi Books subscription ends: for legal review.]

If your details are in a business's books (for example as one of its customers), the business is responsible for them: please contact the business. We will pass on any request we receive.

9a. Self assessment returns

When a practice prepares a client's self assessment return in Tolvi, we process what is on the return for the practice, as its processor. That includes the client's income and tax, National Insurance number and date of birth, and bank details for a repayment. Those identifiers and bank details are encrypted separately and only ever shown masked. If the practice uses AI Mode, what is typed, uploaded documents such as a P60 and the return's figures go to Claude through Amazon Bedrock in London to help complete the return. National Insurance numbers, UTRs and bank details are removed from what is typed, and the client's name isn't sent, though an uploaded document may show them. A person at the practice checks every figure.

A practice can save its own HMRC agent sign-ins in Tolvi: they are encrypted and used only when someone allowed to file a return does so. [Storing agents' HMRC sign-ins for a practice, and how that is described to clients: for legal review.]

Filing a self assessment return from Tolvi, and bringing in what HMRC holds about a client, are not available yet. When they are, data will pass between Tolvi and HMRC only when the practice asks, and HMRC will be a separate controller of the data it receives.

9b. Statutory accounts

When a practice prepares a company's accounts in Tolvi Accounts, we process them for the practice, as its processor. They can name the company's directors and any others the notes mention, and record who approved them. If the practice asks Tolvi AI to draft a note, the request goes to Claude through Amazon Bedrock in London, without names, registered details or amounts in pounds. Tolvi does not send accounts to Companies House.

9c. Company Tax Returns

When a practice prepares a Company Tax Return in Tolvi Corporation Tax, we process the return, its computation and any attached accounts for the practice, as its processor. A return can include personal data, for example loans to directors and other participators on the CT600A, and who the practice recorded as confirming the return for the client. A practice can save its own HMRC agent sign-ins for this: they are encrypted, kept apart from those for self assessment, and used only when someone allowed to file a return does so. Filing a Company Tax Return from Tolvi is not available yet. When it is, returns will pass from Tolvi to HMRC only when a person at the practice files one, and HMRC will be a separate controller of the data it receives. [Sections 9a to 9c, and whether HMRC needs naming differently for a practice filing as its client's agent: for legal review.]

10. Who we share it with

We do not sell personal data. We share it only with service providers (sub-processors) who help us run Tolvi. Before launch we're confirming the data processing agreement terms with each of them:

This table is our list of sub-processors for the data processing terms in our terms of service. We also send data to HMRC when someone files with it from Tolvi, once filing is available, and to a business's accountancy practice when the business links it to its books; each of them is a separate controller, not our sub-processor. We may also share data with professional advisers, with a buyer if our business is sold (under equivalent protections), or where the law requires it.

11. Where your data is held

Tolvi's application, database, documents, backups and logs are held in AWS's London region. Tolvi Meetings recordings and transcription are processed by Recall.ai in the EU (Frankfurt, Germany, and Dublin, Ireland), which the UK recognises as providing adequate protection; the transcript and summary are then held in London with the rest of the firm's data. Tolvi Books data, including receipts and AI processing, is held and processed in London. Where a provider processes data outside the UK (for example Stripe in the USA), we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, and you can ask us for a copy of the relevant safeguards.

12. How long we keep it

• Account and team data: while your firm uses Tolvi, then deleted with the firm's data as described in our terms (normally within 90 days of the account closing).
• Firm data, including client working papers: as set by your firm's retention settings (for example six years after a year-end file ends), and deleted or returned when the contract ends.
• Accounts and tax returns: these are firm data, as above. What was sent to HMRC for a filed return, and HMRC's answer, can't be changed or deleted by the firm while the return is kept. [Retention of filed returns after a firm leaves: for legal review.]
• Tolvi Books: the books, receipts and VAT records as described in section 9 and our terms: while the business uses Tolvi Books, and read-only for 6 years after its subscription ends. A receipt in the books can't be replaced or deleted while the books are kept, because it is the business's record. A receipt that isn't in the books can be deleted by the business: it goes straight away, and a backup copy of the file is removed within 90 days. For a receipt sent by email, the original message is removed within 30 days, and its sender and subject are kept so the same email isn't read twice.
• Meeting recordings: deleted from Recall.ai as soon as the transcript and summary are saved, and in any case within 72 hours. Transcripts and summaries are kept as firm data, as above.
• Backups: deleted data leaves our rolling backups within 35 days.
• Billing records: six years after the end of the financial year they relate to, to meet our legal obligations.
• Security and technical logs: up to 90 days, unless needed to investigate an incident.
• Marketing preferences: while you are opted in, and a record of any opt-out so we respect it.
• Early-access requests: until Tolvi opens to your firm and you have signed up or told us you're not interested, and in any case no longer than 12 months after your last contact.

13. Security

Data is encrypted in transit and at rest. Each firm's and each business's data is kept separate by row-level security in the database, and a practice reaches a business's books only while the business's link to it is live. Access by our staff is limited, logged and protected by multi-factor authentication. Uploaded documents are limited to accepted file types and scanned for malware. See our security page for more.

14. Your rights

Under UK data protection law you have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw consent where we rely on it. Some rights have exceptions. To use them, email support@tolvi.co.uk. We will reply within one month. If your request concerns data a firm holds about its clients, or a business holds in its Tolvi Books, we will refer it to that firm or business.

15. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

16. Changes to this notice

We will update this notice when our practices change and show the date at the top. If a change is significant, we will tell account holders by email before it takes effect.