Privacy policy
The short version
We collect less than you would expect, keep it in London, do not sell it, do not share it with advertisers, and do not use it to train machine learning models. You can export it or delete it yourself at any time.
Who is responsible
Echo Thirteen Capital Ltd, 128 City Road, London EC1V 2NX, trading as Ceodore, is the controller for the personal data described here. Write to us at privacy@ceodore.com about anything in this policy.
Where you use Ceodore to hold information about your own customers and suppliers, you are the controller of that data and we act as your processor. Our data processing agreement covers that relationship.
What we collect
To give you an account: your email address, your name if you give us one, and the passkey or password credentials you use to sign in. We do not ask for identity documents. Verifying your company against Companies House is optional.
To run your business records: whatever you put into Ceodore. Invoices, customers, suppliers, products, bookings and the public wallet addresses you connect.
To take payment for the service: billing details, handled by our payment provider. We do not store your card number.
Automatically: sign-in times, device and browser information, IP address, and basic logs. We use these to keep the service secure and working, not to profile you.
We read public blockchain data for the addresses you connect. That data is already public and is not obtained from you.
Why we are allowed to
Mostly because we need to in order to provide the service you have asked for, which is performance of a contract. Security logging and fraud prevention rest on our legitimate interests in keeping the service safe. Where we have a legal obligation, such as keeping accounting records, that applies instead. We ask for consent where consent is the right basis, and you can withdraw it.
Where it is kept
Servers, database and backups are in the United Kingdom. Nothing in the core service is hosted outside the UK or the EEA.
Identifying information, including customer and supplier names and contact details, is encrypted before it is stored, with a key belonging to your organisation alone.
A small number of suppliers process data on our behalf: hosting, email delivery, payment processing, and error monitoring. We list them in the data processing agreement and keep the list current.
How long we keep it
While your account is open, and after it closes for as long as we are required to keep records, which for accounting purposes in the UK is six years. Logs are kept for a much shorter period. You can delete your account yourself, and we will delete what we are not obliged to retain.
What we do not do
We do not sell personal data. We do not share it with advertisers or data brokers. We do not use it to train machine learning models, ours or anyone else's. We do not run advertising trackers on this site or in the product.
We never show one business the customers, transactions or records of another.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask us to restrict it. Most of this you can do yourself in the product without asking, which we think is better than a form and a thirty-day wait.
If you think we have got something wrong, tell us first and we will try to fix it. You can also complain to the Information Commissioner's Office, which regulates this in the UK.
If there is a breach
We will tell the Information Commissioner within seventy-two hours where the law requires it, and we will tell you directly where there is a real risk to you. We will say what happened rather than issuing something vague about an incident.