Privacy Policy

This Privacy Policy explains how Tiercel Insights™ collects, uses, stores and shares personal data through our website, dashboard, invoice-processing tools, reports, alerts, support channels and related services (the Service).

We may collect information you provide directly, including:

• your name, email address, telephone number, business name, business sector and account details;
• login, profile and subscription information;
• billing status, transaction references and subscription history;
• messages, support requests, feedback, survey responses and review submissions;
• products, recipes, menu items, supplier details, invoices, sales files, costs, prices, margins and other Customer Data uploaded to the Service; and
• any other information you choose to provide.

Please avoid uploading personal data that is not needed for your use of the Service, particularly special-category data or confidential information about other people.

When you use the Service, we and our service providers may automatically collect technical and usage information such as IP address, browser and device type, operating system, session identifiers, login activity, pages or features used, timestamps, diagnostic information, error reports and suspected misuse.

We use essential cookies and similar browser storage for secure sign-in, session continuity, preferences and core functionality. More information is available in our Cookie Policy.

The Service allows business customers to upload or enter invoices, supplier records, product information, recipes, menu data, sales information and related business records. These materials may incidentally include names, contact details or other personal data relating to suppliers, staff or customers.

The customer is responsible for having a lawful basis to provide this data, giving any required notices, limiting uploads to what is necessary and checking that the information is accurate.

Some Service features use automated or artificial-intelligence technology to extract, match, classify, estimate or summarise information from invoices and other business records. Uploaded invoice images and PDFs are sent in full to OpenAI through its API for extraction, so personal details visible in the document may be processed too. Our extraction request disables response storage, but this is not a zero-retention guarantee: provider security monitoring and other applicable retention exceptions may still apply. The resulting information is provided for the customer to review and correct.

Tiercel Insights™ does not use this processing to make solely automated decisions about individuals that produce legal or similarly significant effects. We do not use Customer Data to train our own general-purpose artificial-intelligence model.

We may use personal data to:

• create, manage, authenticate and secure accounts;
• provide invoice extraction, product matching, cost analysis, margin, forecasting, alert and reporting features;
• process subscriptions, confirm payments and manage plan access;
• send essential service, security, billing and administrative communications;
• respond to enquiries, provide support and resolve complaints;
• review and publish customer reviews where permission has been given;
• monitor, maintain, troubleshoot, secure and improve the Service;
• prevent fraud, misuse and unlawful activity;
• establish, exercise or defend legal claims; and
• comply with legal, regulatory, tax and accounting obligations.

We may create aggregated or anonymised information that no longer identifies an individual and use it to understand and improve the Service.

Under UK data-protection law, we rely on one or more of the following lawful bases:

• Contract: processing necessary to provide the Service or take steps requested before entering a contract;
• Legitimate interests: operating, supporting, securing and improving Tiercel Insights™, communicating with business customers, preventing fraud and protecting legal rights, where those interests are not overridden by individual rights;
• Legal obligation: meeting duties under law, regulation, taxation, accounting or valid legal process; and
• Consent: where consent is required, including certain optional communications or publication of a review. Consent may be withdrawn at any time.

Subscription payments are processed by Stripe. Stripe collects payment-card information directly. Tiercel Insights™ receives limited information such as customer and subscription identifiers, payment status, billing dates and transaction references, but does not store complete payment-card numbers or card security codes.

We may share personal data only where reasonably necessary with trusted providers supporting the Service, including:

• Supabase for authentication, database and file storage;
• OpenAI for AI-assisted invoice and data processing;
• Stripe for subscriptions and payments;
• Resend for transactional email;
• OpenAI ChatGPT Sites for managed hosting, including Cloudflare infrastructure used for application delivery and backup storage, and other security, monitoring and technical-support providers as applicable; and
• professional advisers, auditors, insurers and public authorities where legally required or reasonably necessary.

Providers may process data only for the relevant service and under appropriate contractual and security obligations. We may also disclose data in connection with a genuine business sale, merger, financing or reorganisation, subject to appropriate safeguards. We do not sell personal data.

If you submit a review and agree to publication, the chosen name, business or role, rating, title and review text may appear publicly. The email address used to submit or administer a review is not displayed publicly.

Public information may be copied, cached or indexed by others. You may ask us to remove a review from the Tiercel Insights™ website, although copies outside our control may remain.

Some providers may process personal data outside the United Kingdom. Where UK data-protection law requires it, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another valid transfer safeguard. You may contact us for more information about the safeguards relevant to your data.

We keep personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, meeting legal obligations, resolving disputes and enforcing agreements.

Working account and Customer Data is normally retained while an account is active. When a subscription ends, working data is normally retained for 15 days to allow renewal and is then scheduled for deletion if the subscription is not restored. You may request earlier account deletion, subject to legal exceptions.

Payment, tax, accounting, consent, security, fraud-prevention, support and dispute records may be kept for longer where required or justified. Offsite backup rotation normally removes successful sets older than 30 days while protecting the latest three successful sets. Protected sets and incomplete captures may remain longer for recovery or investigation; these copies are not used as ordinary working account data.

Failed renewal payments

For new failed subscription renewals, the recovery period starts at the first failed renewal payment, not at a later retry or Stripe cancellation. We send an initial failure notice, reminders on days 3, 6 and 9, and a final notice on day 12. If payment is not recovered, working account data is scheduled for deletion on day 15. Successful renewal before deletion starts stops the reminders and deletion schedule. Updating a payment method alone does not confirm payment.

The final notice provides at least three days to recover payment. If sending that notice is delayed, deletion is postponed to preserve that window. No further renewal reminders are sent after the final notice. We check the payment status again before ending an unpaid subscription and scheduling deletion. Financial records required by law and protected backup copies are subject to their separate retention periods.

We use appropriate technical and organisational safeguards designed to protect personal data, including encrypted connections, managed authentication, access controls, protected infrastructure and separation of customer workspaces. Access is limited to people and providers who need it for their role.

No internet service can guarantee absolute security. You are responsible for protecting your login details, using a strong unique password and notifying us promptly if you suspect unauthorised access.

Depending on the circumstances, UK data-protection law may give you the right to:

• request access to your personal data;
• ask us to correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict or object to certain processing;
• receive certain data in a portable format;
• withdraw consent without affecting earlier lawful processing; and
• complain to the Information Commissioner's Office.

We may need to verify your identity and may refuse or limit a request where the law permits. To exercise a right, email support@tiercel-insights.co.uk. You may also complain to the Information Commissioner's Office at ico.org.uk, although we encourage you to contact us first so we can try to resolve the concern.

You may unsubscribe from optional marketing emails using the link in the message or by contacting us. You may still receive necessary service, billing, security and account communications.

Most browsers allow you to block or delete cookies, but blocking essential cookies may prevent the Service from working correctly. Optional website measurement is off by default and operates only after you allow it through Manage cookies. It records public page paths, referrer hostnames, timestamps and a hashed random visitor identifier. These records are pseudonymous, not necessarily anonymous. Withdrawing consent stops future measurement and removes the visitor cookie; it does not automatically erase previously recorded page views. We do not use advertising cookies.

The Service may link to websites or services operated by others. Their own privacy notices govern their processing, and we are not responsible for their actions.

Tiercel Insights™ is a trading name of BTYNE PRODUCTS LTD, a company registered in England and Wales under company number 13725490, whose registered office is at Unit 4 The Parade, Dorchester Road, Wool, Wareham, England, BH20 6EJ.

For the personal data described in this Policy, BTYNE PRODUCTS LTD is normally the data controller. Where we process personal data contained in Customer Data solely on a business customer's instructions, that customer may be the controller and we act as its processor.

Tiercel Insights™ is owned, operated, and legally represented by BTYNE PRODUCTS LTD.