Legal
Privacy notice
Last updated 9 October 2026
Draft for review: this page has not yet been approved.
Who we are
This notice is from the people who run Aimee One (“we”, “us”). You can contact us about privacy through our contact page.
The two ways we handle personal information
As controller. We decide how to use the information about people who visit this website, contact us, sign up, or sign in to Aimee One, and about the businesses that subscribe. This notice explains that use.
As processor. The records a business keeps in Aimee One about its own customers, staff, subcontractors and suppliers belong to that business, which is the controller. We process them only to provide the service, on that business’s instructions, under our terms of service. If your details are held in Aimee One by a contractor you deal with, contact that contractor about them; we will help them answer you.
What we collect, and why
| Information | What we use it for | Lawful basis |
|---|---|---|
| Your name, email address and password (stored only as a one-way hash) | Creating your account, signing you in and contacting you about it | Contract |
| Your two-factor authentication secret and recovery codes (encrypted) | Confirming it is you when an owner or administrator signs in | Contract; legitimate interests (security) |
| Your company’s details, plan, and billing references | Running your subscription and charging for it | Contract; legal obligation (tax records) |
| Sign-in times, the IP address and device of a request, and a log of actions | Keeping accounts secure, limiting abuse, and the audit trail your company sees | Legitimate interests (security and accountability) |
| What you send through the contact form | Answering you, and arranging a demo if you ask for one | Legitimate interests (answering enquiries) |
We do not use the records your business keeps in Aimee One for our own purposes, we do not sell personal information, and we do not use it for advertising.
Payments
Card payments, for your subscription and for invoices your customers pay online, are taken by Stripe. Card numbers go to Stripe directly; we never see or store them. We keep only Stripe’s references and the amounts.
AI features
AI features are switched off until a business turns them on. When they are on, the text and documents a person chooses to use are sent to Anthropic, the company that makes Claude, to produce a suggestion. AI only receives what that person is allowed to see, nothing it suggests is used until a person approves it, and each AI action is logged. Anthropic does not use this information to train its models.
Who we share information with
We use these service providers to run Aimee One. Each receives only what it needs for the task named, under a contract that requires it to protect the information.
| Provider | What it does | Where |
|---|---|---|
| DigitalOcean | Hosts the application, the database, stored files and backups | London, UK |
| Resend | Delivers the emails Aimee One sends | United States |
| Microsoft Azure | Reads uploaded supplier invoices and documents into text | UK South |
| Anthropic | AI features, when a business has switched them on | United States |
| Stripe | Subscription billing and online card payments | United Kingdom, EU and United States |
| Twilio | Delivers the text messages a business sends | United States |
| Xero, Intuit QuickBooks or Sage | The accounts package a business chooses to connect | As each provider states |
| Google or Microsoft | Calendar sync, when a person connects their calendar | As each provider states |
Where a provider handles information outside the UK, we rely on the safeguards UK data protection law allows: the UK’s adequacy regulations (including the UK–US data bridge for certified US companies) or the UK’s International Data Transfer Agreement or Addendum. We may also share information where the law requires it, or with a buyer if the business is sold, under the same protections.
How long we keep it
- Account and company information: for as long as the subscription lasts. When a subscription ends, the company’s records stay available to it, read-only, until it asks us to delete them.
- Billing and tax records: six years, as UK tax law requires.
- Security and audit logs: as long as the company’s records, so its trail stays whole.
- Contact form messages: up to two years after our last exchange with you.
How we protect it
Information is encrypted in transit, stored in London, and every record belongs to one company and is never shown to another. Owners and administrators confirm each sign-in with a second code, and access within a company follows the roles it sets.
Your rights
You can ask to see the personal information we hold about you, to have it corrected or deleted, to have its use restricted, to object to its use, or to receive it in a form you can take elsewhere. Contact us through our contact page; we will reply within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies
Aimee One uses only the cookies it needs to work. See the cookies page.
Changes
We will update this notice when what we do changes, and change the date at the top. Where a change matters to you, we will tell you in Aimee One or by email.