Privacy Policy

1. Who We Are

Cleo is a tax preparation platform built for UK tax accountants and advisory firms. We provide AI-powered document extraction, client management, and workflow automation tools. Cleo is operated by Plainbytes Ltd ("Cleo", "we", "us", "our").

2. Custom Solutions & Tailored Data Agreements

Every Cleo deployment is configured individually for each client. Before onboarding, we discuss data hosting preferences, processing requirements, and security needs with you directly. This includes:

• Where your data is hosted and stored
• Which processing services and sub-processors are used
• Retention periods and deletion policies
• Any client-specific compliance requirements

Custom data processing agreements (DPAs) are available and can be tailored to your firm's requirements. Nothing is assumed — everything is agreed in writing before we begin.

3. Data We Collect

We collect only the data necessary to provide our service:

• Account information: Name, email address, firm name, and role — used to manage your account and provide support.
• Client documents: Tax documents (P45, P60, P11D, payslips, share option documents, etc.) uploaded by you for AI-powered extraction and review.
• Extracted data: Structured data produced by our extraction tools from the documents you upload.
• Usage data: Basic analytics on how you interact with the platform, used to improve performance and reliability.

4. How We Use Your Data

Your data is used solely to provide and improve the Cleo service for you. Specifically:

• To extract, process, and display data from uploaded documents
• To power your client management dashboard and review workflows
• To provide customer support and respond to your enquiries
• To maintain platform security and prevent misuse

We do not use your data — including any uploaded documents or extracted information — to train, fine-tune, or improve machine learning models. Your data remains yours.

5. Third-Party Access

We do not share, sell, or provide access to your data to any third party unless:

• We have a written agreement with you confirming the specific third party and purpose
• It is required by law, regulation, or valid legal process

Where third-party sub-processors are involved in delivering the service (e.g. cloud infrastructure providers), these are disclosed and agreed upon during your onboarding and documented in your data processing agreement.

6. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, audit logging, and regular security reviews. Specific security measures are documented in your individual agreement.

7. Data Retention & Deletion

We retain your data only for as long as necessary to provide the service or as required by law. Retention periods are agreed with you during onboarding. You may request deletion of your data at any time, and we will process such requests in accordance with your agreement and applicable law.

8. Your Rights

Under applicable data protection legislation (including the UK GDPR and Data Protection Act 2018), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request data portability
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, contact us at the address below.

9. Cookies

Our website uses essential cookies required for the site to function. We do not use third-party advertising or tracking cookies. For more details, see our Cookie Policy.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to you directly. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact Us

If you have questions about this policy or your data, please contact us at:

Plainbytes Ltd
Email: privacy@atcleo.com