The shortest useful data boundary.

Who is responsible

The controller for the online account service is Fetch Rover, a trading name of Straun Group Ltd (company number SC880183), registered at 270 Airbles Road, Motherwell, ML1 3AT. Privacy questions and rights requests can be sent to dogbowl@fetchrover.io.

What stays local

Vendor usernames and passwords, browser cookies, downloaded invoice PDFs, supplier names, invoice numbers, dates, amounts, extracted text, review decisions and Xero access tokens are processed and stored on your Windows computer. They are not uploaded to the Fetch Rover account service.

What the account service receives

• Your email address, account profile, business name and optional VAT number.
• Device identifiers, names, public keys, app versions and entitlement dates.
• One signed, content-free event for each unique successful portal fetch.
• Billing periods, price calculations, mandate status and payment references.
• Security and service logs needed to prevent abuse and diagnose failures.

A usage event does not include a filename, vendor, invoice value, document hash or document contents.

Why we process it

• Contract: to create the account, activate devices, calculate usage and provide support.
• Legal obligation: to issue and retain tax and accounting records.
• Legitimate interests: to secure the service, prevent fraud and understand failures.

Fetch Rover does not make solely automated decisions with legal or similarly significant effects.

Service providers

Supabase provides account authentication and the count-only account database. Mollie handles payment mandates and payments. Cloudflare provides transactional email and may provide network security. Xero receives invoice information only when you explicitly export a reviewed draft from the desktop app. Each provider processes data under its own terms and applicable data-processing commitments.

Retention and deletion

You can delete the online account from the account portal and delete or export the entire local workspace from the desktop app. Account profile and device records are deleted with the online account. Billing and VAT records are retained for six years where required by UK tax law. Security logs are kept only for the documented operational period and then deleted or de-identified.

Your rights

Depending on the processing and applicable law, you may ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interests. You may complain to the UK Information Commissioner’s Office. We may need to retain information where law requires it.

Cookies and transfers

The account portal uses essential authentication cookies. There are no advertising cookies in this release. Some providers may process data outside the UK; the production controller must verify and document the relevant adequacy decision or contractual safeguard before launch.