Privacy Policy
Last updated: September 2026 · Version 2.0
1. Who we are, and when we are responsible for your data
This policy explains how Nella Finance AI Ltd ("Nella", "we", "us") collects and uses personal data. We are registered in England and Wales (company number 17336736), registered office 128 City Road, London, England, EC1V 2NX. We are registered with the UK Information Commissioner's Office under registration reference ZC224350. For any privacy question, contact privacy@nellafinance.co.uk.
Nella is a software service available to businesses internationally. Our role depends on whose data is involved:
- Account and relationship data — we are the controller. This includes your name, email address, company details, billing information, authentication data, support communications and technical information about how you use the service.
- Customer Personal Data — you are the controller and we are your processor. This includes personal data contained in your connected accounting records, uploaded documents and any prompts or instructions you submit for Nella to process on your behalf. We process this data only to provide the service, on your documented instructions, under our Terms of Service and Data Processing Addendum.
Our Data Processing Addendum applies automatically when you accept the Nella Terms of Service. If your organisation requires a signed counterpart, email privacy@nellafinance.co.uk.
2. What this policy covers
This policy covers the Nella website, the Nella trial, the Nella client portal, and every channel through which Nella is offered — including AI assistants such as ChatGPT and Claude, and messaging channels such as WhatsApp (see section 9).
Nella provides financial information and explanation. Nella does not provide accounting, tax, investment or legal advice, and does not file anything on your behalf.
If you are in the United Kingdom, you may separately choose to engage AccTek Ltd, an independent UK accountancy practice, for regulated accounting and advisory services. AccTek is a separate company under separate terms and its own privacy notice. We share your data with AccTek only if and when you choose to engage them, and this policy does not cover what AccTek does with it. Nella itself is not an accountancy practice and is not supervised for anti-money laundering purposes.
3. The information we collect
(a) Information you give us. Your name, email address, business name, country, and anything you write to us or to Nella.
(b) Financial information from the accounting software you connect. Read-only access to your Xero, QuickBooks Online, Sage or FreeAgent data, so Nella can answer your questions, calculate your figures and build your packs. The depth of access differs by platform and is limited to the permissions you approve at connection.
(c) Billing information. Handled by our payments provider. We receive confirmation of payment and limited card metadata; we never receive or store your full card number.
(d) Technical and usage data. How you interact with the service — pages and features used, timestamps, device and browser information, IP address — plus cookies and similar technologies (see section 12).
(e) Conversation content. What you ask Nella and what Nella answers.
Nella does not require customers to provide special category or sensitive personal data. However, such data may be included incidentally in accounting records or documents supplied by the Customer. Where this occurs, Nella processes it only on the Customer's documented instructions and solely to provide the service. Customers must not provide such data unless they have a lawful basis and it is necessary for their use of Nella.
4. How we use it, and our lawful bases
| What we do | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Provide and operate Nella | To deliver what you signed up for | Performance of a contract |
| Secure, maintain, debug and improve the service | To keep it working and safe | Legitimate interests |
| Send service messages (billing, security, changes) | You need to receive these | Contract / legitimate interests |
| Send marketing messages | To tell you about Nella | Consent — withdraw any time |
| Meet legal, tax and regulatory obligations | We have to | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and you may object at any time.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
5. Your connected accounting data
Nella connects to your accounting software in read-only mode. We read your figures to answer your questions and produce your reports. We never write to or change your books. You can disconnect at any time, which prevents Nella from making further requests to your accounting software once the revocation has taken effect.
Your figures are read from your accounting software when they are needed and are not retained as a permanent copy, other than cached results and generated reports as described in section 11.
6. Automated processing and how Nella uses AI
Nella calculates figures using deterministic software — not AI. AI models are used to interpret your question, decide which figures to look up, and write the plain-English explanation around them. No AI model sits in any calculation path.
The Nella Score and similar indicators are automatically generated summaries of your own accounting data. They are informational. They are not a decision about you, they produce no legal or similarly significant effect, and nothing in Nella determines your access to credit, employment, insurance or any service. Nella does not carry out automated decision-making of the kind described in Article 22 of the UK GDPR.
You can always reach a human: email privacy@nellafinance.co.uk to question or challenge anything Nella has produced.
AI outputs can be wrong or incomplete. Nella's answers are a starting point for your own judgement, not a substitute for professional advice.
7. Conversation memory
As you use Nella, it keeps a short set of notes about durable things you tell us — your business circumstances, your plans, how you prefer to be contacted — so it can give more relevant answers without you repeating yourself. We do not store your financial figures this way; those are drawn live from your accounting software each time.
You have a single set of notes across all channels, so something you mention on one channel may inform Nella's answers on another. We do not share the content of your conversations between channels.
When you first sign in to the portal we tell you Nella keeps these notes. You can see everything Nella has noted, remove any or all of it, and turn note-taking off at any time in your settings. Removing a note deletes it from active systems and Nella stops using it. Residual copies may remain temporarily in encrypted backups until they are overwritten under the backup cycle described in section 11. Turning note-taking off stops new notes; those already saved remain until you remove them or they are deleted under section 11.
We rely on our legitimate interests in providing a continuous, useful service, balanced by these controls and the short retention period. You may object at any time using the off switch and removal controls.
8. Who we share it with
We do not sell your personal data. The organisations below fall into two groups: subprocessors, who process personal data on our instructions under contract with us, and channel platforms, which you choose to connect and which act independently under their own agreement with you.
Subprocessors. These process personal data on our instructions, and only as far as needed:
| Provider | What it does | Where it processes data |
|---|---|---|
| Amazon Web Services | Hosting and storage of the Nella platform | United Kingdom (London, eu-west-2) |
| Cloudflare | Serves standard web assets to your browser; receives your IP address | Global edge network |
| Anthropic | AI subprocessor used by Nella. Generates Nella's written explanations from your figures | United States |
| Stripe | Payment processing and subscription billing | United States / EEA |
| HubSpot | Customer records, support and email communication | United States / EEA |
| Google (Workspace) | Relays transactional and service email sent by Nella | United States / EEA |
Channel platforms you choose to connect (not our subprocessors). These are involved only if you connect Nella to them. Nella sends the results you asked for so the platform can display them; from that point the platform independently determines how it handles your account, prompts, conversation history and the results shown to you, under its own agreement with you. We do not instruct it and are not responsible for it.
| Platform | What it does | Where it processes data |
|---|---|---|
| OpenAI | Runs the Nella app inside ChatGPT, where you use that channel | United States |
| Anthropic (Claude) | Runs the Nella connector inside Claude, where you use that channel | United States |
| Meta Platforms | Message delivery, where you use Nella over WhatsApp | United States / Ireland |
AI subprocessors engaged directly by Nella are contractually prohibited from using Customer Personal Data to train their general-purpose models. Where you use Nella through ChatGPT, Claude or another third-party channel, that platform's use of your conversation data is governed by its own terms, privacy policy and account settings.
We maintain the current list of providers at nellafinance.co.uk/subprocessors and will update it before a new provider begins processing personal data.
We also share data with AccTek Ltd where you have chosen to engage them for UK accounting or advisory services, and we may disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition (in which case we will tell you).
We use no third-party analytics provider. Product and website usage is measured on our own infrastructure and does not leave it.
9. Using Nella through an AI assistant or messaging app
Nella can be connected to third-party assistants and messaging platforms, including ChatGPT, Claude and WhatsApp.
- You initiate and authorise the connection using the authentication method supported by that platform, which may include OAuth. You can revoke the connection from the platform or your Nella settings.
- The assistant can then call Nella's tools on your behalf. The results Nella returns — your figures and explanations — are sent to that platform so it can show them to you, and become part of your conversation there.
- The third-party platform separately determines how it processes and retains your account information, prompts, conversation history and the results displayed within that platform. Its processing is governed by its own terms and privacy policy. Nella remains responsible for the processing performed within Nella's systems.
- Nella's tools available through these channels are read-only, except for raising a question with your accountant and deleting your own data.
10. Security
We protect your data with encryption in transit and at rest, encrypted storage of accounting credentials with separated key sets, access controls and audit logging, and regular patching and review. More detail: nellafinance.co.uk/security.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, notify affected users without undue delay where the risk is high, and comply with the Australian Notifiable Data Breaches scheme and equivalent obligations elsewhere.
To report a vulnerability, email security@nellafinance.co.uk.
11. How long we keep it
| Data | Retention |
|---|---|
| Conversation memory | Deleted automatically 6 months after it is created |
| Chat transcripts stored in Nella’s systems | 12 months. Transcripts held by a channel platform you connect — such as ChatGPT, Claude or WhatsApp — are retained under that platform’s own policy and settings, not ours. |
| Your figures from connected accounting software | Not stored as a permanent copy — read live when needed |
| Generated reports and packs | For the life of your account, then as below |
| Documents you upload, and documents retrieved from your ledger | For the life of your account, then as below |
| Account and profile data | Deleted or anonymised within 90 days of account closure |
| Billing and tax records | Six years after the relevant accounting period, or longer where required for legal, tax, fraud-prevention or dispute purposes |
| Backups | Purged on the normal backup cycle, within 90 days |
Deletion from active systems may occur sooner, but residual copies can remain in encrypted backups until overwritten within 90 days. Data retained solely in backups is not restored or used except for disaster recovery or security purposes.
You can erase your data at any time from your settings, or by asking Nella directly to delete your data. Erasure covers your conversations, memory, generated reports and any documents held for you.
12. Cookies
We use cookies and similar technologies to run the site, remember your session and understand usage. You can accept, reject or manage non-essential cookies through the consent banner and cookie settings on our website. Essential cookies are required for the service to function and cannot be disabled.
13. International transfers
Nella's transfers to subprocessors are governed by the transfer mechanisms contained in Nella's agreements with those subprocessors.
Nella does not currently market or specifically target the service to customers in the European Economic Area. If Nella agrees to provide the service to an EEA customer, the transfer mechanisms in our Data Processing Addendum will apply where required. Transfers covered by an applicable adequacy decision do not require the Standard Contractual Clauses.
You can request a copy of the safeguards at privacy@nellafinance.co.uk.
Users in the European Economic Area. Nella is established in the United Kingdom and does not currently market or specifically target its service to customers in the EEA. The fact that Nella's website and third-party listings are accessible from the EEA is not intended, by itself, as an offer directed to that market. If we decide to actively offer Nella in the EEA, we will review the application of the EU GDPR, appoint an EU representative where required and update this policy before commencing the relevant processing.
14. Your rights
Depending on where you live, you may have some or all of the following rights. As a matter of policy, Nella will generally honour these requests wherever reasonably possible.
To exercise a right, email privacy@nellafinance.co.uk. We will respond within one month (or 45 days for requests under US state law), and will tell you if we need longer. We may need to verify your identity first. You can use an authorised agent; we may ask for proof of their authority. Exercising your rights is free, and we will not discriminate against you for doing so.
If you are in the United Kingdom. These rights arise under the UK GDPR. You can complain to the Information Commissioner's Office (ico.org.uk), quoting our registration reference ZC224350.
If you are in the European Economic Area. Depending on the circumstances, you may have rights under the EU GDPR and may be entitled to complain to the relevant supervisory authority. Whether or not the EU GDPR applies to a particular request, Nella will generally honour equivalent privacy rights where reasonably possible.
If you are in the United States. Depending on your state, you may have the right to know what personal information we collect and why, to delete it, to correct it, to receive a portable copy, and to opt out of sale, sharing for targeted advertising and certain profiling. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for profiling that produces legal or similarly significant effects. If we decline a request you may appeal by replying to our decision; if we deny the appeal we will tell you how to contact your state Attorney General.
If you are in Australia. We handle personal information in accordance with the Australian Privacy Principles. You may access and correct your personal information as set out above, and complain to us first; if you are not satisfied you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
If you are in Canada, or elsewhere. Contact us and we will handle your request under the law that applies to you.
If your data is in a Nella customer's accounting records. If you are a customer or supplier of a Nella user and your details appear in their ledger, that business is the controller of your data. Please contact them directly. If you contact us, we will pass your request to them.
15. Children
Nella is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@nellafinance.co.uk and we will delete it.
16. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or in the product before they take effect. The date at the top shows when it was last updated, and previous versions are available on request.
17. Contact
Nella Finance AI Ltd, 128 City Road, London, England, EC1V 2NX, United Kingdom.
Privacy: privacy@nellafinance.co.uk · Security: security@nellafinance.co.uk · General: hello@nellafinance.co.uk