Loading…
Evident is operated by Evident Automation Ltd (company number 17209262), a company registered in England and Wales (“Evident”, “we”, “us”, “our”). Registered office: Unit 82a, James Carter Road, Bury St. Edmunds, United Kingdom, IP28 7DE. We are the data controller for the personal data described in this policy. We provide bookkeeping automation software that connects to your email, bank, and accounting systems to reconcile invoices and bank transactions (the “Service”).
Our ICO registration number is ZC143509. For any privacy questions contact us at support@evidentbooks.com.
This policy covers how we process personal data about you as a user of the Service (account holder, trial user, or invited team member).
It does not cover personal data about third parties (your suppliers’ contacts, employees, customers) that you or your accounting system import into Evident as part of your business records. For that data, you are the data controller and Evident acts only as a data processor on your behalf, processing it solely to provide you the Service. If your customers or suppliers have questions about their data, they should contact you, not us.
This policy also does not cover third-party websites or services that we link to. Those are governed by their own privacy policies.
We process your personal data under the following legal bases (UK GDPR Article 6):
We collect and process the following categories of data:
We do not collect special-category data (health, racial origin, religion, political opinions, etc.) and ask you not to upload it.
Evident’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy ↗, including the Limited Use requirements.
When authorising Gmail access, Google will show you the following permissions:
gmail.readonly“View your email messages and settings”We use this to find the paperwork behind your bank transactions. Reading is limited to the sender addresses you have saved on each supplier or customer: invoice attachments, the text of order emails, and replies to invoice requests Evident has sent. The one exception is a capped search for the name of a bank payee that has no supplier yet, used to suggest where their invoices come from. Message content is needed because the PDFs and amounts are inside the messages.
gmail.send“Send email on your behalf.”We use this only when you click “Chase suppliers” (or “Chase invoice” on a bank line) to ask a supplier for a missing VAT invoice. Evident shows you the email first, and nothing is sent until you click Send. We do not send any email without that action.
When you use the Export to Google Sheets feature, we request the drive.file scope. When authorising, Google will show you the following permission:
“See, edit, create, and delete only the specific Google Drive files you use with this app”
This grants Evident access only to the individual spreadsheet files that Evident itself creates in your Google Drive, plus any spreadsheet you explicitly choose in Google’s file picker — not to any other files in your Drive. We use this access solely to:
We deliberately use drive.file rather than the broaderspreadsheets scope, so Evident can only touch files it created or files you explicitly picked — never your other spreadsheets or Drive contents.
We will:
When you disconnect Gmail or Google Sheets: we immediately revoke the relevant stored OAuth tokens. Data already exported to a spreadsheet in your Drive remains there under your control — Evident loses access to it. Extracted invoice metadata retained in your Evident account is subject to the standard retention terms in section 9.
We do not sell your data and we do not use it for advertising.
Evident sets a small number of first-party cookies. They exist only to run the service you have asked for.
evident_session keeps you signed in. It lasts 12 hours, renews itself while you use the app, and cannot be read by web pages, only by our server.evident_home remembers your own account while you are working in a client's books, for as long as your session.evident_signed_in tells the app whether there is a session worth checking, for as long as your session.evident_gate remembers that you entered the site password during the private beta. It lasts 30 days.Your browser's local storage holds preferences you set yourself, such as colour theme, table density, date range and download format, and a copy of recently viewed page data so pages open quickly. That copy is tied to the account that saved it and cannot be read by another account on the same device.
None of this is shared with anyone or used to follow you across other sites. These cookies are strictly necessary to provide the service, so we do not ask for consent to set them. Clearing your cookies signs you out; clearing local storage only resets your preferences.
We do not use advertising cookies, cross-site tracking pixels or third-party analytics.
Data is stored on servers in the United Kingdom. Encrypted backups are held in the United Kingdom. All data is encrypted in transit (TLS). OAuth tokens for connected services are encrypted at rest, and every backup copy is encrypted before it leaves the server.
Some of the service providers listed in section 12 process data in the United States. Where personal data is transferred outside the UK, we put a lawful transfer safeguard in place as required by UK GDPR — the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or the ICO-approved International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses otherwise.
We retain your data for as long as your account is active. When you close your account, we delete your personal data and connected-account tokens within 30 days, except where we are required to keep it (e.g. for tax, anti-fraud, or legal hold — typically six years). Backups containing your data are purged on their normal rotation cycle (within 90 days). Emails forwarded to your Evident address are processed and deleted from the mail store within 24 hours; the documents extracted are retained under this section.
The Service is not directed at children under 18 and we do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
Under UK GDPR you have the following rights:
To exercise any of these rights, email support@evidentbooks.com. We will respond within one month. We may need to verify your identity before processing your request. We will not charge a fee unless a request is clearly unfounded, repetitive, or excessive, in which case we may charge a reasonable fee or decline.
Complaints. If you are unhappy with how we have handled your personal data, you can complain to us directly at support@evidentbooks.com. We will acknowledge your complaint within 3 business days, and in any event within 30 days, look into it without undue delay, and tell you the outcome. If someone complains on your behalf, we will first check that they are authorised to act for you.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk/concerns ↗) or call their helpline: 0303 123 1113.
You may revoke Evident’s access to your Google account at any time via Google Account Permissions ↗.
If you connected a Microsoft account, you can revoke Evident’s access at any time via Microsoft account permissions ↗ or by disconnecting the integration in Evident’s settings.
We share your data only as necessary to provide the Service. Categories of recipient:
We require all sub-processors to protect your data to at least equivalent standards and not to use it for their own purposes.
To extract structured data (supplier, dates, totals, VAT) from your invoices and receipts, we send the invoice or receipt content to the AI processing chain listed in section 12. We do not use your data to train AI or machine-learning models, and our AI processing chain does not use data submitted through our service to train its own models. Our AI routing is configured to use only endpoints that do not store request data: nothing we send is retained by the model provider once the response has been produced.
We also use the same AI processing to suggest matches between bank transactions and your documents. Suggestions are only ever suggestions: nothing is recorded without your confirmation.
Extraction accuracy improves as documents are processed. What is shared across accounts is general technique — how common suppliers lay out their invoices and receipts — never the content of anyone’s documents. Your amounts, references, and totals stay within your account, and nothing is used to train general AI models.
We use industry-standard practices including TLS, encryption at rest, scoped API tokens, per-user data isolation, and least-privilege access controls. No system is perfectly secure; if you believe you have found a vulnerability please email support@evidentbooks.com.
We will update this page when our practices change and revise the “Last updated” date. Material changes affecting your rights will be notified by email at least 30 days before taking effect.