Privacy Policy

ValueAmp Advisory Ltd is the data controller responsible for your personal data. We operate a financial intelligence platform providing management accounts, forecasting, and value creation tools to UK SMEs and PE portfolio companies.

Registered in England and Wales. For data protection enquiries, contact us at: privacy@valueamp.co.uk

2.1 Account & User Data

• Email address (required for account creation and login)
• Full name (provided during registration or invite acceptance)
• Profile avatar (optional)
• Role and access permissions (admin, analyst, viewer)
• Login timestamps and session activity
• IP address (collected by Supabase Auth at sign-in)

2.2 Employee Data (uploaded by your organisation)

Where your organisation uploads employee information for use in the People module, we process: full name, job title, department, start/leave dates, salary, employment type, and FTE fraction. This data is provided by you and processed under your instruction as data processor.

2.3 Financial Data

Your organisation uploads financial data (trial balances, budgets, forecasts, customer revenue, and commercial data). This data belongs to your organisation. We process it solely to provide the platform services.

2.4 Usage & Technical Data

• Browser type and version
• Device type (desktop, mobile)
• Pages visited and features used within the platform
• Error logs and diagnostic data

2.5 Data We Do Not Collect

• Payment card details (we do not currently process payments through the platform)
• Government ID numbers or National Insurance numbers
• Biometric or health data
• Data relating to individuals under 18

We rely on the following legal bases under UK GDPR Article 6:

• Contract performance (Article 6(1)(b)): processing necessary to provide you with the services you have contracted for
• Legitimate interests (Article 6(1)(f)): improving our services, ensuring platform security, and communicating relevant updates — where these interests are not overridden by your rights
• Legal obligation (Article 6(1)(c)): where we are required to process data to comply with applicable law
• Consent (Article 6(1)(a)): for optional communications beyond those required to deliver the service — where we obtain your explicit consent

We do not sell your personal data. We share data only with the following categories of sub-processors, each bound by appropriate data processing agreements:

We ensure all sub-processors outside the UK/EEA have appropriate safeguards in place, including Standard Contractual Clauses (SCCs) where required.

Legal Disclosures

We may disclose personal data to law enforcement or regulatory authorities where required by law, or where we believe disclosure is necessary to protect the rights, property, or safety of ValueAmp, our clients, or others.

You may request earlier deletion of your personal data under your rights described in Section 8. We will action deletion requests within 30 days unless we have a legal obligation to retain the data.

Vercel (our hosting provider) and Cloudflare (our DNS provider) are US-based. We rely on Standard Contractual Clauses (SCCs) and Vercel/Cloudflare's UK/EU data transfer mechanisms for any processing that occurs outside the EEA. In practice, all financial data at rest remains in Dublin.

Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:

We will respond to all valid requests within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We take the security of your data seriously and implement appropriate technical and organisational measures including:

• All data transmitted over HTTPS/TLS 1.2+ (enforced at Cloudflare edge)
• Database-level Row Level Security (RLS) — your data cannot be accessed by other tenants even if application code were compromised
• JWT-based session tokens with short expiry (1 hour)
• Passwords hashed using bcrypt via Supabase Auth
• Access controls: role-based permissions limit data visibility within your organisation
• Service role key (unrestricted DB access) used only in server-side API routes, never exposed to browsers
• Daily automated database backups by Supabase

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at privacy@valueamp.co.uk.

ValueAmp uses the following cookies and browser storage:

We do not use advertising cookies, third-party tracking cookies, or cookies that identify you across other websites. Strictly necessary cookies cannot be disabled as they are required for the platform to function.

ValueAmp is a professional B2B platform. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted personal data to us, please contact privacy@valueamp.co.uk and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify registered users by email and update the "Last updated" date at the top of this page.

Continued use of the platform after changes take effect constitutes acceptance of the updated policy.