Privacy notice

Who to contact

Acren is a business name registered in Ireland (CRO no. 792957) by Diarmuid Peter Smithwick O Brien, trading as a sole trader at The Old Rectory, Inistioge, Co. Kilkenny.

Contact diarmuid@acren.ie.

Our role and your firm’s role

Acren controls the account administration, support and service-security information it needs to operate the MVP. For client and practice records entered by a consultancy, the consultancy normally determines why that information is used and acts as controller. Acren processes it on the firm’s documented instructions under an agreed data processing arrangement.

If you are a consultancy client, contact your advisor or firm first about its records and purposes. We will assist the firm with appropriate requests. The demonstration environment must use fictional client data; real client records require a separately approved environment and processing agreement.

Information processed

Account information can include advisor names, work emails, firm membership, account status and authentication records. Account emails include the recipient address, necessary verification links or codes, message content and delivery information. Support correspondence and technical security information, such as IP addresses and request timestamps held by our providers, may also be processed.

Firm records can include client names, legal names, herd numbers, holding numbers, addresses, counties, contact details, advisor assignments, schemes, enterprise types, notes, jobs, interactions and audit history. Imports can also contain source files, proposed records, additional information and processing results. Please include only information needed for the firm’s work.

Purposes and lawful bases

We use account information to provide agreed MVP access, administer invitations and respond to service requests. Depending on the relationship, this is necessary to perform our agreement with the account holder or to pursue our legitimate interests in administering the firm’s requested service. Security and abuse prevention serve our legitimate interests in protecting users and the service. We may also process information to meet legal obligations.

The consultancy must identify its own lawful basis for client records and provide its clients with the required information. Uploading a file does not, by itself, establish consent or another lawful basis. We do not sell client records or use them for advertising.

Service providers and AI import

Vercel provides hosting and application infrastructure. Supabase provides authentication, the database and private file storage. Resend delivers account invitations, password resets and verification emails, processing the recipient address, email content and delivery information. These providers process information needed to deliver the service under the applicable provider agreements. Support information is handled through the contact email above.

Account emails support access and security; we do not use them for marketing. Do not include client records in account or support emails.

AI-assisted import is disabled by default. If separately enabled for an approved environment, Vercel and OpenAI process selected source content to suggest client records. Documents and images may need their content sent for interpretation; ordinary spreadsheets are read directly wherever practical.

The AI integration requests European processing, zero retention of model requests and no model training, and refuses a route that cannot meet its configured controls. Provider contracts and transfer safeguards must still be verified before real-data activation. Those controls do not delete records stored by Acren or all provider account, billing or security information.

An advisor reviews AI suggestions before saving. This feature does not make decisions about clients’ scheme eligibility, credit, employment or other legal entitlements.

Location and access

Access to application records is restricted by active membership of the relevant firm. Source drafts are restricted to their importing advisor; firm owners can review import receipts. Authorised operator or provider access may be necessary for support, security or legal obligations.

Resend stores email content and delivery logs in the United States. Selecting a European sending region does not change that storage location. Its data processing agreement includes Standard Contractual Clauses for international transfers; you can contact us for information about the applicable safeguards.

Other provider support, operational information or subprocessors may also involve locations outside the EEA. Before real client data is used, the approved provider list, processing locations and applicable transfer safeguards must be documented in the firm’s processing agreement.

Retention and deletion

Account and firm records are kept while needed to provide the agreed service and meet documented legal or security requirements. The firm determines the retention of its client records. Records can be archived or soft-removed with audit history retained; those actions are not permanent erasure.

Resend states that email content and delivery logs on its standard plans are retained for 30 days, with a seven-day backup cycle. These provider periods are separate from Acren’s application records. Expiry of a verification link does not itself erase the email or its delivery log.

Import source and preview access expires after 14 days. Expiry restricts access; it does not itself delete the stored source, preview, analysis cache or backups. A verified cleanup schedule and provider backup periods must be agreed before real-data imports are enabled.

Contact us to arrange return, correction or erasure of information. We will assess the request, verify appropriate authority and explain any information that must be retained. Production retention periods and operational deletion procedures remain launch requirements.

Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where consent is the basis. These rights are subject to applicable conditions. A request should not include passwords or an unnecessary copy of identity documents.

We will respond within the applicable GDPR period, normally one month, and explain any permitted extension. You may complain to the Irish Data Protection Commission or another competent supervisory authority.

Cookies and updates

Read the Cookie Notice for login and security cookie details. We will update this notice when the service or its processing changes and draw material changes to the firm’s attention.