Declarewise: Privacy Policy
Last updated 9 October 2026.
1. Who we are
Declarewise is run by Sperrin Consulting Ltd, company number NI741657, registered office 24 Dromdallagan, Magherafelt, BT45 7EY. For the personal data described here we are the "controller", which means we decide how it's used and we're responsible for it.
Questions about your data: declan@sperrinconsulting.com.
2. Who this policy is about
- People who use Declarewise: the staff a business adds to its account. Your name, email address and role usually come to us from the person at your company who invited you, not from you.
- People who visit the website, signed in or not.
If your name or details appear in paperwork a business has sent us, for example as a supplier's contact, a driver or a sole trader with an EORI number, that business is the controller of that information, not us. We only process it on its behalf, under a Data Processing Agreement. Ask that business first. If you contact us instead, we'll pass your request to them.
3. What we collect, and why
| What | Why we use it | Legal basis |
|---|---|---|
| Your name, work email address, the company you belong to and your role in its account | To give you a login and show you your company's work | Legitimate interests: running the account your employer set up |
| Sign-in records: when you signed in, your IP address and browser, and the result of the bot check | To keep accounts secure and spot misuse | Legitimate interests: security |
| The emails we send you: invitations and password resets | So you can join an account and get back into it | Legitimate interests: running your account |
| Error reports when something breaks | To find and fix faults | Legitimate interests: keeping the service working |
| Which pages are visited and how often buttons are pressed | To see which parts of the product get used | Legitimate interests: improving the product |
| Billing contact details for the business | To take payment and keep accounting records | Legitimate interests: billing the business you work for; legal obligation for accounting records. Where the customer is a sole trader, contract |
| Anything you write to us | To answer you | Legitimate interests |
Where we rely on legitimate interests, we've weighed them against your privacy. Section 9 explains how to object.
We don't sell personal data. We don't use it for advertising, and we don't use it to train AI models.
4. What the error reports and analytics don't collect
Error reports go to Sentry with its personal-data collection turned off. They can still contain the address of the page where the fault happened and the type of browser.
Analytics go to PostHog. Every piece of text on the screen is masked before anything is sent, so PostHog can see that a button was pressed but not what it said. Nothing records your screen. Visitors who aren't signed in aren't turned into a personal record.
5. Who we share it with
Only the services that run Declarewise for us, and only what each one needs:
| Service | What it does for us | Where the data is held |
|---|---|---|
| Supabase | Database, file storage and sign-in | Ireland (EU) |
| Vercel | Runs the app | London, UK |
| Anthropic | Reads uploaded paperwork, suggests commodity codes | United States |
| Resend | Sends invitation and password-reset emails | EU |
| Sentry | Error reports | Germany (EU) |
| PostHog | Usage counts | Germany (EU) |
| Cloudflare | The "are you a person" check on sign-in and password reset | Worldwide network |
| Stripe | Takes card payments | United States, under Stripe's own safeguards |
Stripe handles card details itself, under its own privacy policy. We never see full card numbers.
We'll also share information if the law requires it, for example a valid request from the police or HMRC.
6. Cookies
We use cookies that the site can't work without:
- Sign-in cookies, which keep you signed in.
- An email-link cookie, which holds the link from an invitation or reset email for up to one hour, until you press Continue. It's only sent to the sign-in pages.
- Cloudflare's bot check may set its own cookie while it decides whether you're a person.
Analytics don't use a cookie. PostHog keeps a random ID in the page's memory and forgets it when the page closes.
7. Data that leaves the UK
Supabase, Sentry, PostHog and Resend hold data in the EU, which UK law treats as giving adequate protection.
Some of our providers are companies based in the United States, even where they hold data in the UK or EU, and their staff may be able to reach it from outside the UK. Cloudflare's bot check runs on servers around the world. Wherever personal data can leave the UK, it is protected by a safeguard UK law approves: the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge where the provider is certified under it.
Anthropic is in the United States. When Declarewise reads paperwork, the files go to Anthropic to be read and the result comes back. Under Anthropic's business terms it doesn't use this content to train its models, and it deletes it within 30 days, unless the content is flagged for breaking its usage policy. The transfer is protected by the UK Addendum to the EU standard contractual clauses, which forms part of Anthropic's data processing terms.
8. How long we keep it
| What | How long |
|---|---|
| Your login and account details | While your company's account is open, then deleted within 90 days after it closes |
| Sign-in and security records | 7 days |
| Error reports | 30 days |
| Analytics events | 1 year |
| Billing records | Six years, because tax law requires it |
| Database backups | Expire on their own after 7 days |
When we delete a company's account, we'll confirm it in writing if asked.
9. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct it if it's wrong;
- delete it, or stop using it for a while;
- send it to you, or to someone else, in a common file format.
You can object at any time to anything we do on the basis of legitimate interests. Write to declan@sperrinconsulting.com. We'll answer within one month.
10. Complaints
If you're unhappy with how we've handled your personal data, you can complain to us at declan@sperrinconsulting.com. We'll acknowledge your complaint within 30 days, look into it, and tell you what we find and what we've done about it.
You can also complain to the Information Commissioner's Office at any time: ico.org.uk, or 0303 123 1113.
11. Changes
If we change this policy in a way that matters, we'll email account owners before it applies. The date at the top shows when it last changed.