Data protection

Current pilot status

This page explains processing and responsibilities. It is not a completed customer Data Processing Agreement (DPA), a certification, or a substitute for assessing the service. The operator is Nathaniel David Barrett trading as Evrani. Supplier coverage, retention and recovery arrangements and international-transfer safeguards must be verified before customer businesses enter real client personal data. Use test data in the meantime.

Processing schedule

Subject and purpose

Invoice tracking, instructed payment reminders, user-requested payment confirmations, email outcome tracking and service protection.

Nature

Collection, storage, retrieval, calculation of recorded balances, email transmission, delivery-event correlation, correction, account export and customer-initiated deletion.

People concerned

Business account holders, representatives, client contacts and invoice recipients.

Information

Names, business email addresses, invoice references, amounts, currency, due dates, recorded payments, reminder text, notes and email delivery identifiers. Special-category data and irrelevant sensitive information are not intended.

Duration

While needed for the instructed service, subject to closure, retention and deletion arrangements described in the Privacy policy.

Your responsibilities as a business

Use only information you are authorised to process, establish your lawful basis, provide client privacy information, check recipients and payment records, and keep notes limited to relevant business facts. Decide which invoices may be followed up. Stop or pause messages where there is a dispute or incorrect address. Turning on automatic sending documents your instructions for the selected invoices; it is not permission for unrelated marketing.

Current technical controls

• Verified email accounts and server-side checks for workspace access and private owner controls.
• Encrypted server storage for sending credentials; webhook signatures checked before delivery events are recorded.
• Account and invoice opt-ins, paid/paused checks, duplicate-send protections and sending limits.
• Workspace activity records, email history, failure reporting and scheduler monitoring.

These are implemented features, not a claim that all legal and organisational obligations are complete. Incident exercises, restoration procedures and independent security review remain launch work.

Suppliers and processing locations

Current dependencies are OpenAI Sites / Cloudflare (hosting and application data), Supabase (accounts) and Resend (emails). Supabase is configured in London; Resend routes sending through Ireland but stores email content and operational records in the United States. Support and onward processing can involve other countries. Published processing terms are available for Sites hosting, Supabase and Resend. They include supplier obligations and transfer provisions. Account-specific coverage, the complete onward-processing chain and operational recovery arrangements are still being checked. The Privacy policy describes the information handled.

Customer DPA still to be finalised

The production agreement must identify both parties and document the processing schedule above. It must cover processing only on documented instructions (including transfers), confidentiality, appropriate security measures, sub-processor authorisation and notification of changes, equivalent obligations on sub-processors, and responsibility for them.

It must also cover assistance with individual rights, security, breach notifications without undue delay, impact assessments and regulatory consultations; return or deletion at the customer’s choice when processing ends, subject to legal retention; and information, audits and inspections to demonstrate compliance. An instruction believed to breach applicable data-protection law must be raised with the customer. This checklist is disclosed as outstanding work, rather than represented as an executed DPA.

Requests and incidents

Report a suspected security incident or request assistance using the contact below. Include the affected invoice reference and a brief description, avoiding passwords, API keys or unnecessary client data. The owner handles requests manually in this pilot. If you are an invoice recipient, your relationship is with the business that sent the invoice; contact it for payment or privacy queries. A correction in Evrani cannot recall email already handed to an email provider.

Contact

For account support, privacy requests or complaints, email evrani.global@gmail.com. Do not send passwords, API keys or unnecessary client information. Business correspondence address: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom.