Privacy Policy

Last updated: June 2026

1. Who we are

Duevra ("we", "us", "our") is a compliance and workflow management platform for UK accounting practices. This policy explains how we collect, use, and protect personal data.

2. What data we collect

Practice owner accounts

• Email address and password (for authentication)
• Practice name, phone number, and address

Client records

Practice owners store client information within Duevra, including:

• Client names, email addresses, phone numbers, postal addresses
• Company numbers, UTRs, VAT numbers, NI numbers, PAYE references
• Director and shareholder details
• Filing deadlines, job statuses, and checklist progress
• Internal notes and activity history

Client portal users

• Email address (used for magic link authentication)
• IP address (recorded when approving filings, for audit purposes)

Uploaded documents

Documents uploaded by practice owners or portal clients are stored in Supabase Storage (temporary staging) and synced to the practice owner's connected Google Drive account for permanent storage. Duevra stores file metadata (name, type, size, upload date) in its database.

3. How we use Google Drive

When a practice owner connects their Google Drive account, Duevra uses the drive.file scope, which grants access only to files and folders created by the application. Duevra uses this to:

• Create organised folder structures for each client
• Upload and store client documents permanently
• Generate download links for portal users to access their own files

Duevra cannot access any files in your Google Drive that were not created by the application. You can disconnect Google Drive access at any time from Settings → Integrations.

4. How we use your data

• To provide the compliance management service
• To send automated reminder emails to clients on behalf of the practice owner
• To send approval request emails
• To send portal login magic links
• To calculate and display filing deadlines
• To generate activity logs and notifications

5. Data sharing

We do not sell, rent, or share personal data with third parties for marketing purposes. Data is shared only with:

• Supabase — database hosting and authentication
• Google — file storage via Google Drive API (practice owner's own account)
• Resend — transactional email delivery
• Vercel — application hosting
• Companies House — read-only company data lookups (public register)

6. Who can access client data

• The practice owner can access all data within their practice
• Portal clients can only access their own documents, approval requests, and job summaries
• Duevra staff may access data only for technical support or incident resolution, with practice owner consent

7. Data retention and deletion

Data is retained for as long as the practice owner maintains an active account. Practice owners can:

• Export data: Download a complete JSON export of any client's data from the client detail page
• Delete data: Permanently delete all data for a specific client using the "Delete data (GDPR)" function on the client detail page
• Archive clients: Soft-delete a client (data retained but hidden from active views)

When client data is deleted, all associated records (jobs, documents, reminders, approvals, notes, contacts, activity logs) are permanently removed from the database and Supabase Storage. Files previously synced to Google Drive are retained in the practice owner's Drive account.

To request deletion of your practice account and all associated data, contact us at support@duevra.com.

8. Security

• All connections use HTTPS/TLS encryption
• Database access is protected by Row Level Security policies
• Google Drive refresh tokens are encrypted at rest (AES-256-GCM)
• Service role keys are server-side only, never exposed to the browser
• File uploads are validated for type and size on both frontend and backend
• Rate limiting protects authentication and upload endpoints

9. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data
• Restrict processing
• Data portability
• Object to processing

To exercise these rights, contact support@duevra.com.

10. Contact

For privacy-related enquiries, contact us at: support@duevra.com