~~~PLACEHOLDER~~~"who">1. Who We Are

Data Controller: Acreonix Ltd

Address: Acreonix Ltd, United Kingdom

Privacy contact: privacy@acreonix.co.uk

We aim to respond to all data requests within 30 days. We may ask you to verify your identity before processing your request.

2. Acreonix Tasks — Data We Collect

Acreonix Tasks is an AI-powered task and productivity manager available on web (tasks.acreonix.co.uk) and as a mobile app for Android and iOS. We act as Data Controller for all personal data collected through Acreonix Tasks.

• Email address — collected at sign-up, used for authentication and transactional emails (welcome email, password reset).
• Name — first and last name, collected at sign-up, displayed within the app.
• Authentication tokens — managed by Clerk (our authentication provider). We do not store passwords directly.
• OAuth tokens — if you sign in with Google or Microsoft, we receive a token from that provider confirming your identity. We do not receive or store your Google or Microsoft password.

• Tasks — titles, descriptions, deadlines, priorities, statuses, tags, and any notes you add.
• Projects — project names, colours, icons, and associated tasks.
• Calendar events — AI-generated and manually confirmed scheduling blocks.
• Comments — any comments you add to tasks, including author name and timestamp.
• Work preferences — working hours, working days, lunch break settings, and timezone. Used solely to generate your AI schedule.

• AI extract input — text or voice transcripts you submit for task extraction are sent to Anthropic's API for processing. This data is used only to generate your task list and is not used to train Anthropic's models under our enterprise agreement.
• Usage patterns — task completion rates, timing, and behaviour signals used to generate your weekly Insights score. This data is stored on our servers and not shared with third parties.

• Push notification token — collected when you enable notifications on mobile. Used only to send you overdue task reminders and your daily briefing.
• Device type and OS — collected for crash reporting and compatibility. Not linked to your identity.
• IP address — logged by our infrastructure provider (Vercel) for security and abuse prevention. Retained for 30 days.

We process your Acreonix Tasks data under the following lawful bases:

• Contract — processing your tasks, projects, and account data is necessary to provide the service you signed up for.
• Legitimate interests — usage analytics and crash reporting help us improve the product. We balance this against your privacy rights.
• Consent — push notifications are only sent if you explicitly grant permission on your device.

3. Acreonix AI — Data We Collect

When an agency uses Acreonix, the platform processes data about their property leads. For this data, the agency is the Data Controller and Acreonix is the Data Processor.

5. Acreonix RMS — Data We Collect

When a restaurant uses Acreonix RMS to manage their team, the platform processes employee data. For this data, the restaurant operator is the Data Controller and Acreonix is the Data Processor.

When a restaurant uses the bookings module, guest data is processed on their behalf. The restaurant operator is the Data Controller for this data.

~~~PLACEHOLDER~~~"how-use">4. How We Use Your Data

We use personal data to:

• Create and manage your Acreonix account (AI or RMS)
• Provide, maintain, and improve both platforms
• Process subscription payments via Stripe
• Send transactional emails (account setup, invoices, security alerts)
• Power AI features — rota generation, lead qualification, floor plan extraction, in-app guide — via Claude (Anthropic)
• Detect and prevent fraud, abuse, and security threats
• Comply with our legal obligations under UK law
• Provide customer support

We do not use your data for automated decision-making that produces significant legal effects on you.

We do not sell personal data to third parties. Ever.

~~~PLACEHOLDER~~~"article13">5. Article 13 — Lead & Guest Data

• Purpose: Real estate lead qualification, property matching, viewing scheduling, and follow-up
• Legal basis: Legitimate interests of the agency; consent or soft opt-in under PECR for email campaigns
• Controller: The agency client who deployed the AI agent
• Processor: Acreonix Ltd
• Sub-processors: Anthropic (AI inference), Twilio (WhatsApp messaging), Supabase (database), Vercel (hosting), Resend (email delivery). All operate under appropriate UK transfer mechanisms.
• Retention: Duration of the agency's subscription plus 30 days for closure processing.
• Rights: Contact the agency directly.

• Purpose: Staff scheduling, rota management, wage tracking, table booking management, and operational analytics
• Legal basis: Legitimate interests of the restaurant operator; legal obligation for wage and payroll records; explicit consent where dietary or health data is recorded
• Controller: The restaurant operator who uses Acreonix RMS
• Processor: Acreonix Ltd
• Sub-processors: Anthropic (AI rota generation, floor plan extraction, in-app guide), Supabase (database hosting), Vercel (frontend hosting), Railway (backend API hosting), Stripe (payments). All operate under appropriate UK transfer mechanisms.
• Retention: Duration of the restaurant's subscription plus 30 days. Wage and financial records retained 7 years as required by HMRC.
• Rights: Staff and guests should contact the restaurant operator directly.

~~~PLACEHOLDER~~~"sharing">6. Who We Share Data With

We may also disclose data where required by UK law (e.g. a court order) or to protect the safety of users or the public.

~~~PLACEHOLDER~~~"retention">7. Data Retention

• Active account data: Retained for the duration of your subscription
• Closed account data: Deleted within 30 days of account closure, except where required by law
• Lead / CRM data (Acreonix AI): Retained for the duration of the agency's subscription, then deleted within 30 days
• Staff & booking data (Acreonix RMS): Retained for the duration of the restaurant's subscription, then deleted within 30 days
• Wage & financial records (Acreonix RMS): 7 years as required by HMRC
• Financial records — both products: 7 years as required by HMRC
• Server / security logs: 90 days

~~~PLACEHOLDER~~~"cookies">8. Cookies & Local Storage

Both platforms use a small number of strictly necessary cookies and browser storage items. We do not use advertising, tracking, or analytics cookies.

Because we only use strictly necessary cookies, we do not require your consent to set them under PECR. You can delete cookies and clear localStorage at any time through your browser settings. Doing so will log you out of the relevant platform.

~~~PLACEHOLDER~~~"rights">9. Your Rights Under UK GDPR

To exercise any right, email privacy@acreonix.co.uk. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

~~~PLACEHOLDER~~~"security">10. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption at rest and in transit (TLS 1.2+)
• Tenant isolation on all database tables — organisations cannot access each other's data
• JWT-based authentication with short-lived tokens
• Rate limiting on all public-facing API endpoints
• Webhook signature verification where applicable
• Access to production systems restricted to authorised Acreonix personnel only
• Regular security reviews and dependency updates

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware.

~~~PLACEHOLDER~~~"changes">11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will notify account holders by email and update the "Last updated" date above. Continued use of either service after notification constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, data requests, or concerns: