Data processing agreement
This agreement is part of the terms of service between Mintdesignsuk Ltd, which runs Chivvy ("we", the processor), and the practice using Chivvy ("you", the controller). It sets out how we process personal data on your behalf, as Article 28 of the UK GDPR requires. It applies for as long as we process personal data for you.
1. What we process
- Purpose: finding missing receipts, bills and bank statements in your clients' Xero organisations, emailing your clients for them, checking and storing what they upload, and attaching it in Xero.
- Whose data: your clients' contacts, people named in their transactions and documents (such as suppliers), and your own team.
- What data: names and email addresses; transaction, bill and bank account details from Xero (supplier names, amounts, dates, references, account names and the last four digits of account numbers); uploaded receipts, invoices and statements, and anything printed on them; comments and notes.
- How long: while you use Chivvy, then as set out in section 7.
2. Your instructions
We process personal data only on your documented instructions, which are these terms, this agreement and the settings you choose in Chivvy, unless the law requires otherwise. If we think an instruction breaks data protection law, we'll tell you. You're responsible for having a lawful basis for the processing and for telling your clients how their data is used.
3. Our people
Everyone who can access your data is bound by confidentiality, and only accesses it when needed to run or support Chivvy.
4. Security
- Data is encrypted in transit, and Xero access tokens are encrypted at rest.
- The app, database and uploaded files are hosted in the EU.
- Upload links for your clients are private, expire, and only show that client's items.
- Access to production systems is limited to the people who need it.
- Uploaded documents are never used to train AI models.
5. Sub-processors
You agree we can use the sub-processors below. We have agreements with each that protect your data to the same standard as this one. We'll email you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't resolve it, you can end the agreement and we'll refund any fees for time after it ends.
| Provider | What for | Where |
|---|---|---|
| Railway | Hosting the app and its database | EU |
| Cloudflare (R2) | Storing files your clients upload | EU |
| Resend | Sending emails to your clients and your team | EU region |
| Anthropic | Reading uploaded documents to check them against Xero | United States |
Xero isn't a sub-processor: it holds your data under your own agreement with Xero, and Chivvy reads and writes it with your permission.
6. Transfers outside the UK
Where a sub-processor handles personal data outside the UK, we make sure there's a lawful basis for the transfer, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
7. When you leave
When your account closes, you can ask for an export within 30 days. After that we delete your data, including uploaded files, within 30 days, unless the law requires us to keep something. Backups are overwritten in their normal cycle.
8. Helping you
- We help you respond to requests from people exercising their data protection rights, and pass on any we receive directly.
- We help with data protection impact assessments and with the regulator, where it relates to Chivvy.
- We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
9. Audits
We give you the information you reasonably need to show we meet this agreement. If that isn't enough, you can audit our compliance once a year, with 30 days' notice, at your own cost, in a way that protects other customers' data and our providers' security.
10. Liability
Each party's liability under this agreement is subject to the limits in the terms of service.
Questions about this agreement, or to request a signed copy: hello@chivvy.io.
Last updated 14 October 2026.