Who we are
This policy explains how Alvio Group Limited ("Alvio", "we", "us") collects and uses personal data when you visit our websites, create an account, or use the Alvio platform. We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.
For the personal data described in this policy that relates to our own customers and website visitors, Alvio is the data controller.
Controller and processor roles
Alvio is used by accounting firms to do work for their own clients. It is important to distinguish two relationships:
- Where you are an Alvio customer (e.g. a firm or an individual user), Alvio is the controller of your account, billing and usage data, as described in this policy.
- Where you are an accounting firm using Alvio to process your clients' financial records, you are the controller of that client data and Alvio acts as your processor under our Data Processing terms. We process that client data only on your documented instructions.
Personal data we collect
- Account data — name, work email, firm name, role, and authentication details.
- Billing data — plan, transaction records and the limited details needed to take payment (card details are handled by our payment processor, not stored by us).
- Usage data — features used, actions taken, log and device data, IP address and approximate location, and diagnostic information.
- Content you provide — files, financial records, messages and prompts you submit to the platform.
- Support and communications — correspondence with our team and your contact preferences.
- Cookies and similar technologies — as described in our Cookie Policy.
How we use personal data and our legal bases
- To provide the platform and your account — legal basis: performance of a contract.
- To take payment and manage billing — performance of a contract and compliance with legal obligations.
- To secure the service, prevent fraud and abuse, and keep audit logs — our legitimate interests and legal obligations.
- To provide support and respond to you — performance of a contract and our legitimate interests.
- To keep the platform reliable and improve it using de-identified, aggregated usage statistics only (never your files or your clients’ financial data, and never to train AI models) — our legitimate interests.
- To send service messages — performance of a contract; to send marketing where permitted — consent or legitimate interests, subject to your right to opt out at any time.
- To comply with legal, tax and regulatory obligations — compliance with a legal obligation.
Google user data
If you choose to connect a Google account, Alvio requests access to specific Google Workspace services on your behalf. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
- Data accessed — Gmail message metadata (subject, sender, recipients, date, labels, short preview snippet). Google Sheets; Google Calendar events; Google Docs and Slides (files created by Alvio); Google Contacts; Google Tasks. Alvio does not access full email body content or read existing files in your Google Drive.
- Data usage — Gmail metadata and snippets are indexed so the AI assistant can find relevant email threads on your behalf (e.g. “find emails from client X”). Google Workspace services are used to perform actions you direct: sending client emails, creating spreadsheets and documents, scheduling calendar events, and managing contacts and tasks. We do not scan your Google data for advertising or unrelated purposes.
- Data sharing — Google user data is not sold, rented, or shared with third parties except: (a) sub-processors strictly necessary to host and operate the platform (database infrastructure, AI inference, search index), each operating under data-protection agreements and zero- or limited-retention terms for inference calls; and (b) as required by law. We do not share Google user data with advertisers or data brokers.
- Data storage and protection — Indexed Gmail metadata (subject, snippet, sender, date, labels — not body content) is stored encrypted at rest in your isolated Alvio workspace and is not accessible to other tenants. Google access tokens are stored encrypted and never exposed externally. All data in transit is encrypted over TLS.
- Data retention and deletion — Indexed Gmail metadata is retained until you disconnect your Gmail integration or close your Alvio account, at which point it is permanently deleted. You can revoke access at any time from your Google Account security settings or from the Alvio integrations page.
AI processing
Some features use AI models to analyse content you submit and produce drafts, summaries and answers. We do not use your content or your clients’ data to train or fine-tune any AI models — neither our own nor any third party’s. Our AI providers process that data only to return your result, under zero-retention or strictly limited-retention terms, and never to train their models. We do not sell or share your data for training, profiling or advertising. See our AI & Data Usage Policy for detail.
Who we share data with
We do not sell personal data. We share it only with:
- Sub-processors and service providers who host and operate the platform on our behalf (hosting, database, AI inference, email, payments, analytics, error monitoring), under contracts that require appropriate safeguards.
- Integrations you choose to connect (for example accounting, tax, payroll or CRM systems), so we can exchange the data you direct us to.
- Professional advisers, and authorities or courts where required by law.
- A successor entity in connection with a merger, acquisition or reorganisation, subject to this policy.
International transfers
Where we transfer personal data outside the United Kingdom, we rely on UK adequacy regulations or the ICO’s International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with additional safeguards where needed.
How long we keep data
We keep personal data only for as long as necessary for the purposes set out above, including to provide the service, meet legal, tax and accounting obligations, resolve disputes and enforce our agreements.
When you close your account we delete or anonymise your personal data within a defined period, except where we are required to retain it by law. Client data we process on a firm’s behalf is deleted or returned in accordance with our Data Processing terms.
Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to access your personal data; to have it corrected; to have it erased; to restrict or object to processing; to data portability; and, where we rely on consent, to withdraw it at any time.
To exercise these rights, email info@alvio.io. We will respond within the statutory time limit. If you are a client of a firm that uses Alvio, please contact that firm, as it is the controller of your data.
Complaints to a supervisory authority
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) (ico.org.uk). We would, however, appreciate the chance to address your concerns first.
Children
The platform is a business tool and is not directed at children. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. The current version, with its effective date, is always available here. Material changes will be notified through the platform or by email. This version is effective 23 June 2026.