Privacy policy

1. About this notice

This privacy notice explains how Avanti Mind Ltd ('we', 'us') collects, uses and protects personal data in connection with Avanti Account, our practice automation platform for UK accountants, and the website at avantiaccount.com.

We have written it in plain English. It is intended to be read and understood, not skimmed past. The clauses are numbered so that you, your insurer or your own compliance team can cite one precisely. If anything is unclear, please contact us using the details in clause 15.

This notice is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It took effect on 26 October 2026 and applies from that date.

2. Who we are: the data controller

Avanti Mind Ltd is the company behind Avanti Account. For personal data relating to website visitors, prospective customers, and the practitioners who hold an Account login, Avanti Mind Ltd is the data controller.

Important: data your practice puts into the platform. When an accountancy practice uses Avanti Account, that practice is the data controller for its own clients' personal data, and Avanti Mind Ltd acts as the practice's data processor. The relationship between the practice and Avanti Mind Ltd is governed by a separate Data Processing Agreement. This policy covers the data for which Avanti Mind Ltd is the controller; the DPA covers the data processed on a practice's behalf.

• Company: Avanti Mind Ltd, registered in England and Wales.
• Company number: 16049394
• Registered office: The Venture Centre Sir William Lyons Road, University Of Warwick Science Park, Coventry, England, CV4 7EZ
• ICO registration: ZC172544
• Data protection contact: the contact page
• Data Protection Officer: Available on request

3. Scope

This policy applies to:

• Visitors to the avantiaccount.com website.
• People who contact us.
• People who ask for early access to the platform.
• The accountancy practitioners who hold a login to the Avanti Account platform.

It does not cover, in detail, the personal data of a practice's own clients that the practice uploads into the platform, that data is processed under the Data Processing Agreement between the practice and Avanti Mind Ltd. It is summarised in clause 9.

4. What we collect, and when

We collect personal data in the situations set out below. Each clause describes what is actually recorded, including the technical data that is captured automatically rather than typed in by you.

4.1 When you browse the website

Browsing the website does not, by itself, create a record about you. We do not operate analytics, advertising or tracking cookies, and we do not build a profile of the pages you visit or of how you arrived. The site sets two strictly necessary cookies only; clause 8 and our cookie policy describe each one.

4.2 When you send us a message

When you submit the contact form, we store:

• your name and work email address;
• the topic you selected for your message, and the content of your message;
• the fact that you agreed to us replying to you about it;
• your IP address and the user-agent string your browser sends (which identifies your browser and operating system). These two are recorded automatically at the moment you submit the form, you do not enter them.

We record the IP address and user-agent string for two purposes: to identify and block automated and abusive form submissions, and to keep a reliable record of the circumstances in which someone asked us to reply. Our lawful basis is our legitimate interests in protecting the website from misuse and in maintaining an accurate record of contact. We do not use either for advertising, profiling or tracking you across other sites. You may ask us to erase them under clause 12.

The contact form does not ask for a telephone number, and we do not collect one through this website.

Messages you send through our contact and support forms are held in our support system, hosted by Scaleway SAS in Paris, France. To sort and route them we use Anthropic Ireland, Limited (data stored in the United States) under its Data Processing Addendum incorporating the EU Standard Contractual Clauses and the UK Addendum, and Voyage AI Innovations, Inc. (United States, a MongoDB company) under its Data Processing Agreement incorporating the EU Standard Contractual Clauses and the UK Addendum. Replies are sent from our own mail server in Paris.

4.3 When you ask for early access

The early access form ('Tell us about your practice') asks us to write to you when a place is offered. When you submit it, we store four things and no others:

• your email address;
• the fact that you ticked the consent box;
• the exact wording you agreed to, stored word for word rather than as a bare yes, so that we can always show you what you actually consented to;
• the date and time the record was created, and the date and time it was last changed.

We do not record your IP address or your user-agent string on this form. Clause 4.2 explains why we keep those for the contact form, so it is worth saying plainly why we do not keep them here. Automated and abusive submissions are stopped at the point of submission, by a rate limit on the form and by a hidden field that only an automated submitter fills in. Neither of those needs the value afterwards, so neither value is kept. Our lawful basis is your consent.

Your request is also held in our support system, so that we can write to you when a place is offered. Clause 4.2 names where that system is hosted and the providers that sort and route what it holds.

4.4 When you register for an Avanti Account login

Registration and sign-in take place on the platform at app.avantiaccount.com, not on this website. When you register we collect your name, work email address, telephone number, practice details, authentication data (including multi-factor authentication data), and a record of your activity within the platform.

4.5 When you become a paying customer

We collect billing contact details and payment information. Card payments are processed by our payment provider, Stripe, we do not store full card numbers ourselves.

We collect only the data we need for the purposes set out in clause 5.

5. Why we use your data, and our lawful basis

We use personal data only where we have a lawful basis to do so under UK GDPR. The list below sets out each purpose and its basis.

• Providing and operating the Avanti Account platform for account holders: Performance of a contract
• Processing payments and managing subscriptions: Performance of a contract
• Responding to enquiries: Legitimate interests / steps prior to a contract
• Writing to you about early access, where you have asked us to: Consent
• Sending service and account communications (security, billing, important changes): Performance of a contract / legitimate interests
• Improving the website and the platform: Legitimate interests
• Detecting and blocking automated or abusive form submissions, using the IP address and user-agent string described in clause 4.2: Legitimate interests
• Keeping the platform secure and preventing fraud: Legitimate interests / legal obligation
• Meeting our own legal, regulatory and tax obligations: Legal obligation

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded that they are not. You may object to processing based on legitimate interests, see clause 12.

6. Marketing: only with your consent

We send marketing communications only to people who have asked to receive them. Every marketing email includes a one-click unsubscribe link, and you can withdraw your consent at any time. Withdrawing marketing consent does not affect the service communications we must send to account holders.

7. Sharing your data

We do not sell your personal data. We share it only where it is necessary to run our service, and only with organisations bound to protect it.

We use a small number of trusted service providers, for example, our hosting infrastructure, our payment processor (Stripe), our email delivery provider, and our support tools. Each acts as our data processor under a written agreement and processes data only on our instructions. We do not currently use an analytics provider.

We may also disclose personal data where we are legally required to do so, for example, in response to a valid request from a law enforcement agency or regulator.

A current list of the categories of service provider we use, and the safeguards in place, is available on request through the contact page.

The named list is published: our sub-processor register gives every provider we engage, what each does, where it processes and the safeguard that covers it, including the providers that are contracted and configured but not yet processing anything.

8. Cookies and similar technologies

The avantiaccount.com website sets two cookies, and both are strictly necessary for the site to work: a session cookie and a cross-site request forgery token. We set no analytics, advertising or third-party cookies, and we embed no advertising or social-media tag.

There is therefore no cookie banner on this site. Consent is required before non-essential storage, and we set none, so there is no choice for us to ask you to make. A notice in the footer of every page states this and links to the cookie policy. If we ever introduce a non-essential cookie we will obtain your consent before setting it, and we will update both notices first.

You can control cookies through your browser settings at any time. The site previously showed a consent banner, which stored your answer in a cookie_consent cookie; we no longer set or read it, and the cookie policy explains how to clear it if it is still on your device.

Each cookie, its purpose and its lifetime are listed in our cookie policy.

9. Client data processed on a practice's behalf

When an accountancy practice uses Avanti Account, it uploads and processes personal data about its own clients, for example, individuals' names, contact details, tax references, financial documents and return data.

For that data:

• The practice is the data controller. It decides what data is processed and why.
• Avanti Mind Ltd is the data processor. We process that data only on the practice's documented instructions, to provide the platform.
• The relationship is governed by a Data Processing Agreement between the practice and Avanti Mind Ltd, which sets out our obligations, the security measures, the handling of data subject requests, and our data retention commitments.

We do not use a practice's client data for our own purposes. We do not use your content to train artificial intelligence models, and we select AI providers on contractual no-training terms, the providers we engage are listed in our sub-processor register (see clause 7). The corrections a practice makes to document extractions are stored per practice and used to improve accuracy for that practice's own work only.

If you are a client of a practice that uses Avanti Account and you have a question about your personal data, please contact your accountancy practice in the first instance, as they are the data controller.

10. Security

We take the security of personal data seriously. Our measures include:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256).
• Isolation of each practice's data at every layer of the platform.
• Multi-factor authentication is mandatory for every platform user and may not be disabled.
• Role-based access controls limiting who can see what.
• An audit trail of significant actions. The application does not edit or delete a submission record.
• Regular backups, and a disaster-recovery plan exercised ahead of general availability.
• External penetration testing scheduled before general launch, and annually thereafter.

No system can be guaranteed completely secure, but we work continuously to protect personal data and to detect and respond to any incident. Further detail is on our security page.

11. How long we keep data

We keep personal data only for as long as we need it for the purposes set out in this notice, or for as long as the law requires.

We should be straightforward about where we have got to. We have not yet implemented an automated process that deletes or anonymises records once a retention period expires. In practice this means the enquiry, early-access and contact records we hold are retained until we remove them as part of a manual review, or until you ask us to erase them under clause 12. We act on erasure requests when we receive them; we do not yet run a scheduled job that removes data without being asked. We would rather tell you that than describe a process we have not built.

The periods below are our intended retention schedule. They are stated as intentions, not as current practice, and they will be confirmed and published here before general availability:

• Enquiry data: retained while we are in contact and for a reasonable period afterwards.
• Early-access register data: retained until onboarding has opened for you and you have either taken up an account or told us you do not want one. The register has a natural end, and we intend to clear it once onboarding is open to everyone on it.
• Account holder data: retained for the life of the account and for a period afterwards to meet our legal and accounting obligations.
• Billing records: retained for the period required by UK tax and company law.

Retention of a practice's client data is governed by the Data Processing Agreement.

One boundary of erasure is deliberate: where a practice's client records are held under a statutory retention obligation, for example the records HMRC requires to be kept for six years, an erasure request does not delete them. The platform anonymises the identifying particulars instead, and the underlying statutory record survives by design until its retention period ends.

12. Your data protection rights

Under UK GDPR you have the following rights in relation to your personal data:

• The right to be informed: to know how your data is used (this policy).
• The right of access: to request a copy of the personal data we hold about you.
• The right to rectification: to have inaccurate data corrected.
• The right to erasure: to ask us to delete your data in certain circumstances.
• The right to restrict processing: to ask us to limit how we use your data.
• The right to data portability: to receive your data in a portable format.
• The right to object: to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• The right to withdraw consent: where we rely on your consent, including the early-access register in clause 4.3, you may withdraw it at any time, and withdrawing it is as easy as giving it was.
• Rights related to automated decision-making: Avanti Mind Ltd does not make decisions that produce a legal or similarly significant effect on you by automated means without human involvement.

To exercise any of these rights, contact us through the contact page. We will respond within one month. There is normally no charge.

If you are a client of a practice that uses Avanti Account, exercise these rights through that practice, as it is the data controller for your data.

13. Where your data is held

We aim to host and process personal data within the United Kingdom. Where any personal data is transferred outside the UK, for example, by a service provider, we ensure an appropriate safeguard is in place, such as an adequacy decision or the International Data Transfer Agreement, so that your data receives an equivalent level of protection. Current hosting arrangements are listed in our sub-processor register (see clause 7).

Hosting location and any international transfer safeguards will be confirmed here against the final infrastructure arrangements.

14. Changes to this notice

We may update this notice from time to time. When we make a significant change, we will update the effective date shown at the top of the page and, where appropriate, notify account holders directly.

15. Contact us, or complain

If you have a question about this notice or about how we handle your personal data, contact us through the contact page, or write to us at our registered office (see the data controller section above).

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the chance to address your concern before you approach the ICO.