Data processing terms

1. Who is who

1.1 If you use Ratelift for your own business, you are the controller of the personal data in your Xero organisation and we are your processor.

1.2 If you are a bookkeeper, accountant or other agent connecting a client's Xero organisation, you confirm that you have your client's authority to appoint us and to give us the instructions in these terms. If you are your client's processor, we are your sub-processor, and “you” in these terms means you acting on your client's behalf. You will pass on to your client any notice we give you under clauses 6, 7 and 9.

1.3 These terms do not cover the details we hold about you as our customer: your name and email address, your organisation's name, your answers when you connect and to our feedback questions, your acceptance of our terms with your Xero user ID, and payment and usage records. For those we are the controller, and our privacy policy applies. Anything you choose to email us is outside these terms: we handle it as controller of our own correspondence, as our privacy policy describes. Please do not email us your customers' personal data.

2. The processing

2.1 Subject matter: the repeating invoice templates, branding themes and list of sales invoices in the Xero organisation you connect; the files you upload for import; and the names of customers you choose to leave out of price changes.

2.2 Duration: from when you connect until we have deleted the data under clause 10.

2.3 Nature and purpose: reading your templates to prepare previews, forecasts and exports, and keeping a snapshot of each template in a preview whether or not you confirm it; reading the files you upload for import, keeping their rows with the run, and keeping the file itself until you answer the preview's question about it or discard the preview; creating replacement or new templates when you confirm a run; reading them back to check them, and removing a new template that fails its check; removing the originals after that check (price changes only); putting back the prices a price change wrote when you undo or reverse it, which is itself a run you confirm; reading your list of sales invoices after a run, and keeping the number, date, amount and customer name of any invoice raised by a template we touched, to show you in the run report; reading your branding themes so that an import can use the one you choose and an export can name each template's theme; keeping the names of customers you leave out of price changes; and keeping a record of each run.

2.4 Types of personal data: the contact on each template as Xero returns it (at least the name and Xero's contact ID), where the contact is an individual, a sole trader or a named person; any other personal data written on the templates or in an import file, such as in line descriptions or references; and the customer name, number, date and amount of invoices raised by templates we touched.

2.5 Categories of data subjects: your customers and their contact people.

2.6 Your obligations and rights: you decide what is on your templates and in your files, which templates to preview, and whether to confirm each run, an undo included; you make sure you are entitled to have us process the data; you may export your reports, undo a run, disconnect, and ask us to delete your data at any time.

3. Your instructions

3.1 We process the personal data only on your documented instructions. They are: these terms and the terms of use; each run you confirm after seeing its preview (we keep the run's record: the connection it was made from, the templates it covers and when each was written); each undo, import, export or deletion you ask for; the transfers described in clause 7; and our use of the sub-processors in Annex B. Once you confirm a run, our servers finish it, including after you close the page, and pause and resume it by themselves if Xero's daily limit is reached; they are built to write nothing to your Xero organisation that is not part of a run you asked for.

3.2 If UK law requires us to process the data in another way, we will tell you before we do, unless that law forbids us to tell you on important grounds of public interest.

3.3 We will tell you straight away if we think an instruction breaks the UK GDPR or other data protection law, and we may hold that instruction until it is resolved.

4. Confidentiality

4.1 Only people we have authorised may process the personal data, and each of them has committed in writing to keep it confidential. Today that is the company's director, who has signed that commitment; anyone else will sign it before they have access. Other companies that process the data for us are sub-processors under clause 6.

5. Security

5.1 We take the measures required by Article 32 of the UK GDPR, including those in Annex A. We keep them under review and will not reduce the overall level of protection they give.

6. Other processors (sub-processors)

6.1 You give us general written authorisation to use the sub-processors in Annex B.

6.2 We will tell you by email at least 14 days before we add or replace a sub-processor, so that you can object. If a change is needed urgently to keep Ratelift secure or running, we may give shorter notice, but we will always tell you before the new sub-processor processes your data, and you may still object. If you object on reasonable data protection grounds and we cannot resolve it, you may stop using Ratelift; we will then delete your data under clause 10 and refund any fee you have paid for a job that has not run.

6.3 Each sub-processor is bound by its own written data processing terms, which require appropriate technical and organisational measures and cover the matters in Article 28(3) of the UK GDPR. Where they differ from these terms (for example, a sub-processor may answer audits with independent audit reports, or notify an incident without a fixed number of hours), Annex B says so. We remain fully liable to you for their performance of those obligations.

6.4 Our sub-processors use their own sub-processors, which each publishes; those are governed by the sub-processor's own data processing terms.

7. Transfers outside the UK

7.1 Ratelift's functions run in Vercel's London region and its database is hosted by Neon in London. Some processing happens outside the UK: Vercel's main processing facilities are in the United States, and Vercel and its own sub-processors may process data elsewhere; and Neon and its own sub-processors may handle data in the United States for support and monitoring.

7.2 Each of those transfers is covered by the sub-processor's data processing terms, using the safeguards named in Annex B: the UK Extension to the EU–US Data Privacy Framework where the recipient states it is certified to it, or the Information Commissioner's International Data Transfer Agreement or its Addendum to the EU standard contractual clauses. We will make no other transfer outside the UK, apart from those made by our sub-processors' own sub-processors under clause 6.4, unless you instruct us to, or after notice under clause 6.

8. Helping you with people's requests

8.1 Taking into account the nature of the processing, we will help you answer requests from people exercising their rights (access, correction, erasure, restriction, portability and objection): within 10 working days of your request we will give you the personal data we hold about that person and make any correction or deletion you tell us to.

8.2 If someone contacts us directly about data we hold for you, we will pass the request to you within 5 working days and will not answer it ourselves unless you ask us to.

9. Personal data breaches and other help

9.1 If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know then (its nature, its likely consequences and what we are doing about it), and keep you updated as we learn more.

9.2 Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 of the UK GDPR: security, telling the Information Commissioner and the people affected about a breach, data protection impact assessments, and prior consultation with the Information Commissioner.

10. When the processing ends

10.1 If you disconnect, we keep your snapshots and run history so that a reconnect finds them, until you ask us to delete them. When you ask, or at the end of any wind-down period under the terms of use, we will, at your choice, delete all the personal data or return it to you and then delete it, within 30 days, and delete any existing copies unless the law requires us to keep them. Before disconnecting you can download every run report and export your templates from the app; if you ask us to return data, we will send you the snapshots we hold as a file.

10.2 Copies in our sub-processors' backups expire on their normal cycle.

11. Information and audits

11.1 We will make available to you the information needed to show that we meet Article 28 of the UK GDPR: these terms, the measures in Annex A, our sub-processors' terms and certifications, and written answers to your reasonable questions within 30 days.

11.2 We will allow for and contribute to audits, including inspections, by you or by an auditor you appoint who is bound to confidentiality. Please give us 30 days' notice; audits are at your cost, during working hours, and no more than once a year unless they follow a breach or a regulator requires one. Ratelift has no premises beyond the director's home office, so an inspection is of our systems and records, carried out remotely or at a place we agree. For our sub-processors, audits are met by the reports and certifications they publish (clause 11.1).

11.3 We keep the record of processing activities that Article 30(2) of the UK GDPR requires of a processor.

12. Liability

12.1 The limit of liability in the terms of use applies to all claims under these terms. Nothing in these terms limits liability that cannot lawfully be limited.

12.2 If either of us pays compensation to a person under Article 82 of the UK GDPR for damage that the other caused in whole or in part, it may recover the other's share.

12.3 Each party bears its own regulatory fines.

13. General

These terms last as long as we hold personal data for you, and are governed by the law of England and Wales, as are the terms of use. We send notices under these terms to the email address you gave us or, if you have given none, in the app. We will tell you of any change to these terms that reduces your protection at least 14 days before it takes effect, and you will be asked to accept it as you accept the terms of use.

Annex A: Security measures

• Every connection to Ratelift uses HTTPS.
• Xero access tokens are encrypted at rest with AES-256-GCM; sessions are signed and expire.
• We ask Xero for permission to read and write invoices, which covers repeating invoice templates; to read your organisation's settings, for branding themes; to read contacts, which we ask for a planned feature and do not use today; and to stay connected between visits. We do not ask for bank, payroll or reports access.
• Every write to your Xero organisation is part of a run you confirm after its preview; an undo or a reverse of a run is a run too. A run creates the new template, reads it back and compares it field by field with what was intended, removes a copy that does not match, and only then removes the original (price changes only). Imports never remove an existing template and create drafts unless your file says otherwise. A replacement template is refused if its next invoice date is today, past or within two days; an imported template is refused if its first invoice date has passed.
• A write gate lets us pause writing for every organisation, or for one, and refuses to write if it cannot read its own settings.
• The application runs in Vercel's London region; the database is hosted by Neon in London.
• Access to production is limited to the company's director. Day-to-day diagnosis uses a read-only database role.
• The source code is private; since 8 October 2026 every proposed change runs the automated tests before it is merged; checks by a person use Xero's Demo Company, never a customer's organisation.
• Faults that changed a customer's books are described publicly on our Updates page.

Annex B: Sub-processors

• Vercel Inc. (US): runs the application and keeps its logs. Where: functions in London; main processing facilities in the US; its sub-processors elsewhere. Safeguard for transfers: Vercel's data processing addendum (UK transfer terms). Where its terms differ from ours: audits answered by its SOC 2 report; incident notice without fixed hours; deletion within a commercially reasonable time.
• Neon, LLC (part of Databricks, Inc., US): hosts the database. Where: London (AWS eu-west-2); support and monitoring from the US. Safeguard for transfers: Neon's platform terms and the Databricks data processing addendum they refer to. Where its terms differ from ours: audits answered by independent reports where the law requires; incident notice as its agreement provides.

Stripe is not listed: it receives none of the personal data in your Xero organisation, only your organisation's Xero ID, the job's reference, its kind, its size and its price.