Privacy notice

1. Who we are

EdgPro Limited (“we”) provides Vision Direct, a service that reads a business’s accounting records from Xero and presents them as a board report. Contact: support@edgpro.com.

For your business’s financial records we are a processor: your organisation is the controller and we act on its instructions (by connecting Xero, it instructs us to read and report on those records). For the accounts of the people who sign in, and for our security records, we are the controller.

2. What we process

Your account. Your name, email address, the organisations you belong to and your role in each. We do not store passwords: you sign in with Xero or with a one-time link sent to your email.

Your business’s Xero records. With your consent on Xero’s own screen, and only for the organisation you choose, we read: the chart of accounts, invoices and credit notes, payments, bank transactions, and monthly profit-and-loss, balance sheet and trial balance reports. Our access is read-only — we cannot create, change or delete anything in Xero. Invoice records include your customers’ and suppliers’ names, which we use for the customer analysis in your report.

Security records. A log of sign-ins and account actions (time, user, action, outcome, IP address and browser), kept to protect your data.

Cookies. Only the cookies needed to sign you in and keep you signed in. No analytics, advertising or tracking cookies.

3. How we use it

Only to provide the service: importing your records, producing and checking your board report, and operating, securing and supporting the service. We do not sell data, use it for advertising, or use data obtained from Xero to train any artificial-intelligence or machine-learning model. The service sends no data to any artificial-intelligence service.

4. Legal basis

Your business’s records: your organisation’s instructions under our terms. Your account and security records: performing our contract with your organisation, and our legitimate interest in keeping the service secure.

5. Who else handles data

• Vercel Inc. — hosts the web application (London region).
• Supabase — database hosting and sign-in (UK/EU region).
• Railway Corp. — runs the background service that imports from Xero (EU region).
• Resend (sending from its EU region, Ireland) — delivers sign-in and invitation emails (your name, email address and the link only).
• Xero Limited — the source of your records, under your consent and Xero’s own policies.

Each processes data only to provide its service to us, under its data-processing terms.

6. Security

• All traffic is encrypted (TLS, with HTTP Strict Transport Security).
• Your Xero connection is stored encrypted (AES-256-GCM) with the key held apart from the database.
• Separation between organisations is enforced inside the database itself (row-level security), not only by the application.
• Account and security actions are recorded in an append-only log.

7. Keeping and deleting data

Your business’s records are kept while your organisation uses the service. An owner can disconnect Xero (we stop reading, and ask Xero to remove our connection) or delete a company or the whole organisation at any time in Settings — deletion removes the records immediately. Security records are kept for at least one year and are not deleted with the organisation.

8. Your rights

You have the rights UK data-protection law gives you — access, rectification, erasure, restriction, objection and portability — by emailing support@edgpro.com. For your business’s records we will act on your organisation’s instructions. You can complain to the Information Commissioner’s Office (ico.org.uk).

9. If something goes wrong

If we suspect your data or your Xero connection has been compromised, we will revoke the affected connection, rotate credentials, and tell your organisation, Xero and — where the law requires — the ICO within 72 hours.

10. Changes

We will post changes here with a new effective date and tell account owners about material ones.