Privacy Policy
Data Security & Privacy Policy, version 3.0. Last reviewed: 27 August 2026.
1. What we do with your data
Own Your Numbers ("OYN") connects to your Xero account with read-only access to produce cash flow analysis reports. We never create, edit, or delete records in Xero.
Data we use
- Accounting reports and transaction data from Xero (read-only)
- Company name, reporting periods, and account classifications
- Your email address for authentication
Data we do not collect
- Payment card information or banking passwords
- Raw accounting data beyond what is needed to run the analysis
2. How it works
When you run a report, OYN reads your Xero data, runs the analysis, and produces a cash report. If AI narrative is enabled, a summary of the numbers (not the raw ledger) is sent to Google Vertex AI Enterprise (Gemini) to write the commentary. The PDF is created for download and then deleted.
3. Data retention
We keep data only as long as needed to provide the service.
| Data type | Retention period | Notes |
|---|---|---|
| Raw Xero data | Not retained | Used during analysis only |
| PDF reports | Deleted after download | Scheduled cleanup as safety net |
| Analysis results | 24 hours | Auto-deleted by retention system |
| Processing logs | 30 days | High-level metadata only, no accounting detail |
| Account records | Until account deletion | Email, connection state, invitations |
Our retention system runs hourly to delete expired data. You can request immediate deletion by emailing [email protected].
4. AI handling
OYN uses Google Vertex AI Enterprise (Gemini) to write the narrative in your report. We only send it the numbers - aggregated cash figures, aging summaries, and derived metrics - never the raw ledger. Your data is not used to train any models.
5. Infrastructure and security
OYN does not keep your raw Xero data. We pull it, run the analysis, and discard it. What we do keep are the short-lived results of that analysis, plus the basics needed to run the service - your account, connection state, and high-level logs. Retention periods for each are in section 3.
- Hosted on Google Cloud Platform, UK region
- Encrypted in transit (TLS) and at rest
- Read-only Xero access - we never request write permissions
- Only the connection owner can share, revoke, or disconnect a Xero organisation
- GCP infrastructure is independently certified to SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017 and ISO 27018 - covering physical security, access controls, encryption, and data protection
6. Third-party services
| Service | Purpose | Location |
|---|---|---|
| Xero | Identity sign-in and accounting data access | Per Xero terms |
| Google Cloud Platform | Hosting, compute, storage | UK |
| Cloudflare | DNS, email routing, and transactional emails | Global |
| Google Vertex AI Enterprise (Gemini) | Financial narrative generation | EU |
7. Your rights and contact
You have the right to access, correct, or delete your data. To make a request or ask a question: [email protected].
Incident response
If we identify a security incident affecting customer data, we will investigate, contain, and notify affected parties as required by law.
The short version
The plain-English summary of the policy above - the same facts published on our Xero App Store listing.
Read-only by design
Own Your Numbers connects to your Xero organisation through a read-only connection that you authorise. It cannot create, edit, approve, delete, reconcile or post anything in your Xero. There is no write-back of any kind, ever. It never sees or stores your Xero password: sign-in and authorisation are handled by Xero.
What it reads
To build your weekly briefing it reads only what it needs:
- Your bank balances
- The invoices owed to you
- The bills you owe
- Recent transactions
- Your standard Xero financial reports
From these it works out your cash, net cash and cushion in months, a risk rating, the debtors to chase, the bills coming up, and the five things to do this week.
Your data is read on demand, then discarded
Own Your Numbers does not keep a copy of your Xero data. It is read on demand to produce each briefing and then discarded. Only the short briefing result is retained, and that is removed automatically over time.
Never used to train AI
The plain-English analysis and risk rating are generated by Vertex AI Enterprise in Google Cloud, UK region. This is inference only. Your Xero data is never used to train, fine-tune, adapt or improve any AI model, in line with the Xero Developer Terms.
Sharing and access
You can give a teammate or adviser access to a briefing inside Own Your Numbers, through our own team-access model. They never receive write access to your Xero, and only you manage the connection.
Disconnecting
You can disconnect Xero, or cancel, in one click at any time. Disconnecting stops all access to your Xero immediately.
This website
ownyournumbers.com is a static site. It sets no cookies, runs no advertising or analytics trackers, and loads no third-party scripts, fonts or images. There is nothing here to consent to, which is why you were not asked.
Contact
Email [email protected] with any question about your data, or to ask us to delete it.