Privacy

Who we are

Devion is operated by Devion Industries ("we", "us"), a trading name; company registration details will be added here on incorporation. We provide a margin-leak reporting tool for UK businesses. For the business data you upload, you are the data controller and we act as your data processor. For your account details, we are the controller. If you have any question about your data, email hello@devion.ai.

What we store

Your account details (email address), your organisation name, and a record of your acceptance of our Terms of Service (timestamp and version).

The CSV files you upload and the line items we extract from them, so we can produce and re-open your reports.

The reports, findings and letters we generate for you.

Basic product analytics (for example, that an upload happened and whether it parsed) so we can improve reliability. We do not use your financial figures for advertising, and we never sell your data.

What we do with it

We use your uploaded data solely to produce your analysis and letters. We analyse net (ex-VAT) amounts. We do not connect to your bank or accounting system; everything comes from the files you choose to upload.

Parts of the Service use artificial intelligence. To map your spreadsheet columns, match products and draft letters, limited excerpts of your uploaded data (such as column headers, sample rows, product descriptions and customer names) are processed by Anthropic's Claude models under our commercial agreement. Anthropic does not train its models on this data.

A small amount of anonymised, aggregated information (such as how well files parse) helps us keep the tool working. Individual financial rows are never included in logs or error reports.

Our legal bases

We process your account data to perform our contract with you (UK GDPR Article 6(1)(b)), service analytics under our legitimate interest in running and improving the Service (Article 6(1)(f)), and records of terms acceptance under our legitimate interest in evidencing our agreement. Business data you upload is processed on your instructions as your processor.

Where it lives and who can see it

Your data is stored on our behalf by Supabase (hosted in the EU) and served by Vercel (functions pinned to the EU). AI processing is performed by Anthropic, which may involve transfer outside the UK/EEA safeguarded by the UK Addendum to the EU Standard Contractual Clauses. Transactional email (such as confirmation emails) is sent via Resend. Payments are handled by Dodo Payments as Merchant of Record; we never see or store your card details.

Within the app, access is restricted to your own organisation through database-level row security.

Cookies

We use only essential cookies: the session cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies, so there is no cookie banner to click.

How long we keep it

We keep your uploads and reports for as long as your account is active so you can revisit them. You can delete all of your uploaded data at any time from Settings, and we will remove it. If you close your account, we delete your data within a reasonable period, except records we must keep for legal or accounting reasons.

Your rights

Under UK GDPR you can ask us to access, correct, export or delete your personal data. Most of this you can do yourself in the app; for anything else, email hello@devion.ai and we will respond within 30 days. You may also complain to the Information Commissioner's Office (ico.org.uk).