Your data. Your rules.

Who we are

SmarCEO is operated by Smar Group Ltd, a company registered in the United Kingdom. Smar Group Ltd is the data controller for the personal data you give us when you sign up for and use SmarCEO.

For any question about this policy or your data, email privacy@smarceo.com.

What personal data we collect

We only hold what we need to run SmarCEO for you.

• Account data. Your name, email address, organisation name and role.
• Authentication data. One-time magic-link tokens (expire in 15 minutes) and, if you turn it on, a TOTP two-factor secret.
• Integration tokens. OAuth refresh tokens for the systems you connect — Xero, QuickBooks, Guestline and so on. Stored encrypted at rest with AES-256-GCM.
• Business data. Financial summaries, operational metrics (occupancy, resident count, job completion) and anything else pulled from the integrations you authorise. This is your business data, not personal data about you, but we treat it with the same care.
• Asset data. Property or business records you choose to add in the Assets section (name, type, address, purchase price, valuation figures, optional revenue and EBITDA). Used only to compute your indicative valuations.
• Ask SmarCEO questions. Each question you send to the Ask SmarCEO assistant is logged (question text, your user ID, model used, token counts) so we can investigate problems and understand usage. Questions are also sent to OpenAI along with a snapshot of your live dashboard data so it can answer; see Section 05.
• Usage data. Server access logs, API request logs, and the audit log of administrative actions. Includes IP address, user agent, timestamps.
• Support data. Any messages, screenshots or files you send to support or security.

We do not use any analytics or tracking cookies, we do not fingerprint your browser, and we do not buy or enrich data about you from third parties.

How we use your data

We use your personal data only to:

• Create and manage your SmarCEO account and your organisation's workspace.
• Send you magic-link emails so you can sign in.
• Pull data from the systems you authorise, and show it back to you.
• Answer questions you send to the Ask SmarCEO assistant, by forwarding your question plus a snapshot of your live dashboard data to OpenAI and returning its answer.
• Compute indicative asset valuations from the property and trading figures you enter.
• Respond to support requests and investigate incidents.
• Keep an audit log of administrative actions, which you can read at any time.
• Send essential service emails (e.g. a security notification) — never marketing without your explicit consent.

Legal basis for processing

• Performance of contract (UK GDPR Article 6(1)(b)) for everything we do to actually run SmarCEO for you.
• Legitimate interests (Article 6(1)(f)) for security logging, abuse prevention and the superadmin audit log. We've weighed these against your rights and consider them proportionate.
• Consent (Article 6(1)(a)) for anything optional — e.g. joining the accountant-practice-portal waitlist, or future marketing emails if we ever send them.
• Legal obligation (Article 6(1)(c)) where we have to retain records to comply with UK law.

Who we share your data with

We never sell your data. We never share accounting or operational data with anyone outside the processors below, who we rely on to actually deliver SmarCEO.

Every processor is bound by a data-processing agreement that mirrors our obligations to you. We will add or remove processors from this list as our stack changes, and we will update this page when we do.

International transfers

Most of your data stays in the EU. Where a processor handles data on US infrastructure (Resend for email delivery, OpenAI for the Ask SmarCEO assistant, Sentry for error monitoring), transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which we have in place with each affected processor.

How long we keep your data

• Account and business data: kept while your account is active. On deletion, wiped within 30 days (except where UK law requires us to retain specific records longer).
• OAuth tokens: deleted immediately when you disconnect the integration.
• Magic-link tokens: expire after 15 minutes and are deleted on first use or expiry.
• Server access logs: 30 days.
• Audit log of administrative actions: retained indefinitely for the security of every customer, except where you ask us to delete your account, in which case the entries about you are removed with it.
• Backups: rolling 7-day retention. Deletions propagate into backups within 7 days.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have it corrected if it's wrong.
• Have it deleted (subject to legal retention).
• Object to or restrict our processing.
• Receive your data in a portable format (CSV or JSON).
• Withdraw any consent you've given — any time, no reason needed.
• Complain to the Information Commissioner's Office (ico.org.uk) if you think we've got it wrong.

Email privacy@smarceo.com to exercise any of these. We respond within 30 days — usually a lot faster.

Cookies

We use only the cookies we need to make SmarCEO work — a session cookie after you sign in, and a small UI-state cookie remembering whether you've dismissed the impersonation banner. No analytics, no advertising, no fingerprinting. Full details on the cookies page.

Security

Everything we do on the security front is on our Trust page — encryption at rest, tenant isolation, two-factor, audit logging and so on. If you spot a vulnerability, email security@smarceo.com with "[Vulnerability]" in the subject.

Changes to this policy

When we change this policy we update the "Last reviewed" date at the top. If the change is material (new processor, new retention period, new data category) we also email every active customer with a plain-English summary of what's changing and when.

Contact

Data questions: privacy@smarceo.com
Security disclosures: security@smarceo.com
Everything else: support@smarceo.com

Smar Group Ltd · United Kingdom