Privacy notice

Who is responsible for your data

This portal is run by ac-co.ai for the firm that invited you to this portal. For the personal data in this portal, the firm that invited you to this portal is the data controller: it decides why and how your data is used. ac-co.ai is the data processor: it hosts the portal and handles your data only on the firm's instructions, under UK GDPR Article 28.

Contact the firm that invited you to this portal. Its contact details are in the invitation email you received and on its own website.

What the portal stores about you

• Identity: your name and email address, and which of the firm's services you can see in the portal.
• Sign-in records: a session record with your IP address and browser details (user agent) so we can keep you signed in and spot misuse; the one-time email codes sent to you (stored as one-way hashes) and the number of attempts made; short-lived counters keyed to a hashed form of your email and IP address to limit repeated requests.
• Audit events: a record of what is done in your portal, such as signing in, opening a signing link, downloading a document or paying an invoice, so the firm can show who did what and when.
• Documents and forms: the files you upload, the documents the firm shares with you, answers you give to questionnaires, and signed copies of documents you sign.
• Invoices, quotes and payments: the invoices and quotes the firm sends you and whether they are paid. Card details are entered on Stripe's own page and never reach the portal.
• Assistant messages: if you use the portal assistant, what you type and the answers it gives. It can only see your own documents, invoices, quotes and signatures.

Why it is used

To let you view and send documents, sign, and pay for the services the firm that invited you to this portal provides to you, and to keep the portal secure. The firm's legal basis is normally that this is necessary to perform its contract with you, to meet its legal and regulatory obligations (including record-keeping), and its legitimate interest in running a secure service. We do not sell your data and we do not use it for advertising.

Who else handles it

ac-co.ai uses these providers to run the portal. Each acts only on instructions and under a data processing agreement:

• Google Cloud — hosting the portal, in London (UK).
• Supabase — the database and the files you upload, in London (UK).
• Resend — sending sign-in codes and notification emails, from the EU (Ireland).
• Google — only if you choose "Continue with Google"; it tells us your verified email address.
• Stripe — only when you pay an invoice online; Stripe is also responsible for the card data it collects.

Your data is stored in the UK. Where a provider handles it elsewhere, the transfer relies on UK adequacy regulations (for the EU/EEA, and for US companies certified under the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum in that provider's terms.

How long it is kept

• Sign-in codes expire after 10 minutes; request counters are cleared within a day.
• A sign-in session lasts up to 30 days, and ends sooner if it is not used for 7 days (a staff preview lasts 1 hour). It is deleted when you sign out, and expired sessions are removed automatically every day.
• Documents, signed documents, invoices and audit events are kept for as long as the firm that invited you to this portal needs them for your engagement and for the periods the law requires it to keep records (for tax records, commonly up to six years), then deleted or anonymised. Ask the firm for its retention schedule.

Your rights

Under UK GDPR you can ask for a copy of your data (access), have it corrected (rectification), have it erased, restrict how it is used, receive it in a portable format, and object to uses that rely on legitimate interests. Some of these are limited where the firm must keep records by law.

To use any of these rights, contact the firm that invited you to this portal — it is the controller and decides your request. The firm can export or delete your portal data, and ac-co.ai will carry out the firm's instructions without delay. The firm should reply within one month. If you are not happy with the answer you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Contact the firm that invited you to this portal. Its contact details are in the invitation email you received and on its own website.

Cookies

The portal sets only the cookies it needs to keep you signed in. See the cookie notice.