This notice explains how Ayiza collects and uses personal data when you visit ayiza.com, sign up for or use Ayiza, buy from us or contact us.
Who we are
Ayiza is provided by Ayiza Software Labs Limited (“Ayiza”, “we”, “us”), a company registered in England and Wales with company number 12718749 and its registered office at 1 World Business Centre Heathrow, Newall Road, London Heathrow Airport, Hounslow, England, TW6 2AS. We are registered with the Financial Conduct Authority as an account information service provider, firm reference number 981975. We are registered with the Information Commissioner’s Office under number [ICO registration number]. For any question about this notice or your personal data, email info@ayiza.com.
Data our customers keep in Ayiza
Our customers use Ayiza to keep their books, file their returns and work with the AI assistant. For the records they keep in Ayiza, such as invoices, bank transactions, documents and messages to the assistant, the customer is the controller and we are their processor. If your details appear in a customer’s records, for example because you are their customer or supplier, please contact that customer about your data. Our Data Processing Agreement and our Subprocessors page explain how we process that data for them.
The rest of this notice covers the personal data we decide about ourselves.
What we collect and why
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You visit our website | Your IP address, browser details and the pages you request, in our server logs | To run and secure the website | Legitimate interests in running a secure website |
| You make a cookie choice | A cookie that remembers your choice | To respect your choice | Strictly necessary, so no consent is needed |
| You accept analytics cookies on ayiza.com | Google Analytics cookies and usage data: the pages you visit, the links you click, how you reached us, and your device, browser and approximate location | To understand how the website is used | Consent |
| You sign up or sign in | Your name, email address and company name; your password, stored only as a secure hash; two-step sign-in settings; the devices and sessions you sign in from | To create and protect your account, including alerts when it is used from a new device | Contract |
| You use the sign-up or invitation pages | Page views, clicks and session recordings through PostHog (EU), with password fields masked | To find and fix problems in signing up | Consent |
| You sign up | Your IP address and browser signals, checked by Cloudflare Turnstile | To stop automated sign-ups | Legitimate interests in preventing abuse |
| You sign in with Google | Your name and email address, from Google | To sign you in | Contract |
| You use Ayiza | Your user profile, roles and settings, and a record of the changes you make, with your name and the time | To provide the service and keep an audit trail | Contract; legitimate interests in security and accountability |
| You file with HMRC | Details of your device and connection, such as your IP address, a device identifier, screen size and time zone. Your browser asks the ipify service for your public IP address. | HMRC requires this fraud-prevention data with every Making Tax Digital submission | Legal obligation |
| You pay us | Your company’s name, email address, postal address and VAT number, and your payment history. Stripe collects and stores your card details; we never see them. | To bill you and keep accounting records | Contract; legal obligation |
| You use the AI assistant | The models used, the credits charged and when | To charge for AI credits and show you your usage | Contract |
| You link Telegram or email to the assistant | Your Telegram account ID or email address, linked to your Ayiza user | To route your messages to your Ayiza account | Contract |
| We send you service emails | Your name and email address | To send invitations, password resets, sign-in codes and security alerts | Contract |
| You contact us | Your name, email address and messages, for example to info@ayiza.com or support@ayiza.com. Our AI assistant may help us read and answer support requests. | To answer you | Legitimate interests in answering enquiries; contract, if you are a customer |
| Something goes wrong | Technical details of the error, through Sentry, which is configured not to collect personal data by default | To find and fix faults | Legitimate interests in a working service |
Our websites load fonts from Google Fonts and scripts from jsDelivr. Your browser sends your IP address to these services when it loads those files.
The AI assistant
When you use the assistant on Ayiza’s own access to AI models, we send your question, the conversation so far and the records the assistant reads to answer it to the AI model provider. That is Anthropic by default, or OpenAI, Google or Mistral through OpenRouter if you choose one of their models. Files you attach are sent with the requests in that conversation.
We do not use your data to train AI models. Anthropic’s commercial terms do not allow it to train models on data sent through its API. For requests through OpenRouter, we instruct OpenRouter to use only model providers that do not store prompts or use them for training. If your organisation connects its own AI provider account, requests go to that provider under your organisation’s own contract with it.
Messages you exchange with the assistant on Telegram pass through Telegram’s servers and are subject to Telegram’s privacy policy. Messages between you and a Telegram bot are not end-to-end encrypted. Emails to and from the assistant pass through Mailgun in the EU.
The assistant does not make decisions about you that have legal or similarly significant effects. It asks for your approval before it posts, reverses or deletes a record.
Who we share it with
- Service providers who process data on our instructions: Microsoft Azure for hosting, [service email provider] for service emails, Mailgun for the assistant’s emails, Anthropic and OpenRouter for AI models, PostHog for sign-up analytics, Google Analytics for website analytics, Cloudflare for bot protection, Sentry for error monitoring, and Stripe for payments.
- HMRC and Companies House, when you file through Ayiza.
- Google, if you choose to sign in with Google.
- Our professional advisers, auditors and insurers; public authorities where the law requires it; and a buyer of our business, under a duty of confidentiality.
We do not sell personal data.
International transfers
We host Ayiza in Microsoft Azure data centres in the UK. Some of our service providers process data outside the UK: Mailgun and PostHog in the EU, and Anthropic, OpenRouter, Cloudflare, Google and Stripe in the United States. Transfers to the EU rely on the UK’s adequacy regulations for the EEA. For transfers to the United States, we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Agreement or the International Data Transfer Addendum issued by the Information Commissioner.
How long we keep it
| Server and application logs | 30 days |
| Sign-in session records | 365 days |
| Sign-ups that are never verified | Deleted after 7 days |
| Your account and user data | While your organisation’s subscription runs, then deleted within [90] days |
| Billing records | Six years after the end of the financial year they relate to, as UK tax law requires |
| AI usage records | [Retention period] |
| Support emails | [Retention period] |
| Sign-up analytics and error reports | [Retention period] |
| Website analytics in Google Analytics | 14 months |
| Database backups | 35 days |
How we protect it
Ayiza runs in Microsoft Azure data centres in the UK, inside a private network. Connections are encrypted, passwords are stored only as secure hashes, and every user can turn on two-step sign-in. Annex 2 of our Data Processing Agreement describes our security measures in detail.
Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, including use based on our legitimate interests, and to receive data you gave us in a portable format. Where we rely on your consent, you can withdraw it at any time, for example through the cookie settings. To use any of these rights, email info@ayiza.com. We reply within one month.
For data in a customer’s records, please contact that customer first. We help our customers answer such requests.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concern first.
Changes to this notice
We update this notice when the way we use personal data changes, and we change the date at the top. If a change affects our customers significantly, we also email the administrators of every Ayiza account.