Hyfo

Draft, pending solicitor review

This document is a draft. It has not yet been reviewed by a solicitor, it is not legal advice, and it may change before anyone is asked to rely on it.

Privacy Policy

Last updated: 10 October 2026

This policy explains how Hyfo (“we”, “us”) handles personal data in Hyfo — a business-management application used by ecological consultancies (each a “Customer”), by their staff, and in limited ways by their clients. Each Customer is the data controller of the data its users put into Hyfo; we process that data on the Customer's instructions as its processor. We are the controller only for account and billing data about the Customer's users. Contact: hello@hyfo.uk.

1. What the Platform holds

On behalf of each Customer, Hyfo holds:

  • Staff data — name, work email, profile photo, role, and activity within the Platform (tasks, bookings, timesheets, leave records).
  • Client and contact data — company names, contact names, job titles, email addresses and phone numbers the Customer needs to deliver its work.
  • Project and site data — site addresses, coordinates, access and safety information, supplied by the Customer's staff or by its clients via a project setup form.
  • Financial records — quotes, invoices and payment status relating to the Customer's client engagements.
  • Files — receipts, project documents, reports and other files the Customer's users upload, or its clients send with a project setup form.

As controller, we hold account and billing data — the names, work email addresses and sign-in details of the Customer's users, and the Customer's subscription and billing records.

We do not sell personal data, run advertising, or use tracking for marketing.

2. Why the data is processed (lawful bases)

Each Customer decides why and how its data is processed and is responsible for having a lawful basis for it. We process Customer data only to provide Hyfo to that Customer and on its instructions. For the account and billing data we control, our lawful bases are performance of our contract with the Customer, our legitimate interests in running and securing the service, and legal obligations (e.g. accounting records).

3. QuickBooks and other connected services

The Platform uses third-party services that act as sub-processors or independent controllers of relevant data:

  • Intuit QuickBooks Online — when connected by a Customer's administrator, the Platform exchanges invoice and customer billing data (names, invoice numbers, amounts, payment status) with that Customer's own QuickBooks company to keep its accounting records in sync. QuickBooks data is accessed only for this purpose, only what is needed for the Customer's financial records is retained, and it is not shared with anyone else. Disconnecting the integration stops all access; stored OAuth tokens are deleted on disconnect.
  • Xero — when connected by a Customer's administrator, the Platform exchanges customer contacts and sales invoices (names, contact details, invoice numbers, amounts, payment status) with that Customer's own Xero organisation to keep its accounting records in step. Xero data is accessed only for this purpose, only what is needed for the Customer's financial records is retained, and it is not shared with anyone else. Disconnecting the integration ends the Platform's access, at Xero as well; stored OAuth tokens are deleted on disconnect.
  • Microsoft 365 — when a Customer connects it: sign-in, profile photos, calendars and, for a Customer that keeps its files there, document storage in SharePoint.
  • Clerk, Vercel and Neon — authentication, application hosting and database hosting.
  • Vercel Blob — file storage. The files each Customer keeps in Hyfo are held in a private store in London (UK), and are only opened through Hyfo, which checks the user's permissions first. One-off attachments added to an invoice, quote or purchase-order email are held briefly in a separate Vercel Blob store, at an address that can't be guessed, until the email is sent, and are then deleted (one that is never sent is deleted within two days).
  • HubSpot — CRM data where a Customer enables that integration.
  • Anthropic — AI model provider for the in-app assistant and drafting features; receives only the content needed for the request a user makes.
  • postcodes.io and Google Maps — to work out mileage, journey postcodes are converted to coordinates, which are then used to calculate driving distances.
  • Open-Meteo — receives site coordinates only (no personal data) to provide weather forecasts.
  • Resend / email providers — to send operational notifications.

4. Retention

Customer data is kept for as long as the Customer uses the Platform, and the Customer decides how long its records need to be kept (for example, UK financial records are usually kept for at least 6 years). A file a user deletes can be restored for 30 days and is then deleted permanently, and file exports are kept for 7 days. When a Customer's subscription ends, we delete or return its data as agreed with that Customer. Account and billing data is kept for as long as the account is active and as the law requires afterwards.

5. Security

Access requires authenticated sign-in and is role-restricted. Data is encrypted in transit (TLS) and at rest by our hosting providers. Integration credentials and tokens are stored server-side and never exposed to browsers.

6. Your rights

Under UK GDPR you may request access to, correction of, or deletion of your personal data, object to processing, or complain to the Information Commissioner's Office (ico.org.uk). If your data is held in Hyfo by an organisation you work with or for, contact that organisation first — it is the controller, and we will help it respond. For account and billing data, contact us at hello@hyfo.uk.

7. Changes

We will update this page when our practices change; the date above reflects the latest revision.

See also: the Terms of Service, the Data Processing Addendum, the list of sub-processors, the security summary and the cookie notice.