Privacy Notice

1. Who we are, and the roles we play

Saral is operated by Deshwal & Co. (“we”, “us”), the trading name of Vikas Deshwal, a chartered accountancy practice run as a sole trader in England. For the data your business puts into Saral — including everything synced from your Xero organisations — you are the controller and we are your processor: we process it only to provide the service, on your instructions, under our terms of service. For your account itself (who subscribed, billing records, support correspondence) we are the controller. We are registered with the Information Commissioner’s Office under number ZC112566, and the practice is a member firm of ACCA. Contact: accounts@getsaral.co.uk.

2. What we process

• Accounting data from Xero — invoices, credit notes, payments, bank transactions, manual journals, contacts, chart of accounts, tracking categories, fixed assets, attachments, budgets, and financial reports for each organisation you connect. What we read is limited by the OAuth scopes you approve (listed in Support & docs).
• OAuth tokens — the access and refresh tokens Xero issues are stored encrypted at rest (AES-256-GCM) with keys held outside the database, and are never written to logs.
• Your users — names, work emails, roles, sign-in records, and optional two-step verification enrolment.
• Workforce data — where you use the HR modules; the worker notice describes it in full.
• Documents you send us — supplier invoices, receipts, statements, certificates and similar documents emailed, uploaded or read from folders you link, for processing (BillScan and the other modules).
• Mailbox content — where you connect a Microsoft 365 mailbox to the Email Hub or to BillScan, the messages in the folders you choose (senders, recipients, subject, body, attachments); where you connect a Gmail or Google Workspace mailbox to BillScan, the messages in its Inbox, read-only.
• Documents you sign or store — Saral Sign envelopes and files, with signers’ names, emails, signatures, IP addresses and timestamps.
• Applicants — where you use the Worker Pool or careers site, the details people send when they apply for work.
• Billing — your subscription, invoices, and Direct Debit mandate references. Your bank details are entered on GoCardless’s pages and never seen or stored by Saral.

3. Why, and on what basis

To provide the service you subscribed to (contract); to bill you and keep required records (contract, legal obligation); to secure the platform — authentication, rate limiting, audit trails (legitimate interest); and to read documents and emails you submit or connect and to draft text in the app, which uses an AI subprocessor (Anthropic) under commercial terms that prohibit training on your data (performance of contract). Where you switch on face check-in, the comparison of a worker’s face with their profile photo is performed by Microsoft Azure AI Face on the worker’s explicit consent, with a card alternative. We never sell data, and we never use your business data to train AI models.

4. Where it lives, and who touches it

The database, authentication and file storage are in the EU (Supabase/AWS eu-west-1, Ireland); the application runs on Vercel with its servers in Dublin. Two services worth naming here because they touch the content of your mail: Google — if you connect a Gmail or Google Workspace mailbox to BillScan, Saral reads it with Google’s read-only Gmail permission (the Inbox label only; it can never send, delete or change a message), and the grant is revoked at Google when you disconnect the mailbox and when your company is purged; and Resend, which delivers the email Saral sends (invites, notifications, digests). The full, current list of subprocessors — what each does, what it can see and where it processes — is public at /subprocessors, and the controls that protect your data are described on /trust. Where a subprocessor processes outside the UK/EEA, transfers rest on adequacy regulations or the UK Addendum to the standard contractual clauses. Saral’s operators have no way to sign in as you or to browse your records inside the application — there is no impersonation feature — and platform administration actions require two-step verification and are audit-logged. Every table has row-level security switched on and every request is checked against your account, so no customer can read another’s data.

5. Retention and deletion

• While you subscribe, your data is retained as the working system of record you maintain.
• After your subscription ends: 30 days read-only export access, a further 60 days offline retention, then permanent deletion at 90 days, with reminders before it happens.
• Disconnecting a Xero organisation revokes Saral’s access at Xero and clears our stored tokens; if Xero-side revocation cannot complete we retry and reconcile until it does.
• Billing records are kept as long as tax law requires.
• Operational records have fixed windows enforced by scheduled jobs: sign-in history 13 months, check-in photos 90 days, items in a Trash lane 30 days, application errors 90–180 days, and the tamper-evident audit trail 7 years. Applicants in the Worker Pool are deleted after 12 months unless they confirm they are still looking (your account can set 1–36 months). Saral Sign kept files follow the number of days your owner sets; nothing is deleted until one is set.

6. Your rights, and your data subjects’ rights

For account data we control, you can ask us for access, correction, deletion, or portability, and complain to the ICO. For business data you control, we act on your instructions — the application itself is your tool for access and correction, and export is available throughout the retention window. Where a person whose data you process contacts us directly, we will refer them to you and assist you in responding.

7. Security

TLS everywhere; OAuth tokens and connector credentials encrypted at rest (AES-256-GCM) with rotatable keys; row-level security plus application-level tenant scoping; two-step verification required for every office user and Saral operator; a fresh second factor for destructive actions; documents, receipts, IDs and signatures in private storage opened only through links that expire within an hour; bank account numbers masked on screen, with every full reveal recorded; a tamper-evident audit trail of every change, sealed nightly and kept seven years; signed single-use links for account actions; webhooks authenticated by signature; platform-operator actions step-up authenticated and audit-logged. If a breach affects your data we will notify you at your registered contact email without undue delay and in any event within 48 hours of becoming aware of it, so that you can meet your own 72-hour duty to the Information Commissioner’s Office. Where we are the controller we report to the ICO, and where HMRC data is involved we report to HMRC, within 72 hours of becoming aware of it.

Report a security issue. If you find a security weakness in Saral, or think your account or data has been exposed, email accounts@getsaral.co.uk with “Security” in the subject. We acknowledge every report within 2 working days. Please do not test against other customers’ data.

8. Data processing agreement

Our data processing agreement (version 1.0) forms part of our terms of service and sets out our processor commitments: Article 28 terms, the subprocessor list at /subprocessors with 30 days’ notice of changes, international transfer terms, notification of a personal data breach without undue delay and in any event within 48 hours, and the deletion steps in section 5. It is available on request by email to accounts@getsaral.co.uk, and will be published with our data protection documents on /trust.

9. Changes and contact

Material changes to this notice are announced by email at least 30 days before they take effect. Questions, requests, or incident reports: accounts@getsaral.co.uk.