Privacy Policy

1. Who we are

ValuCap (the trading style of ValuCap Limited, a company registered in England and Wales) provides agentic business valuation services. The Principal Consultant and named signatory is Abi Shitta (ACCA, FMVA, MBA).

For data-protection enquiries, contact privacy@valucap.example.

2. What we collect

• Account information. Your name, email address, and any authentication identifiers provided by our sign-in provider (Clerk).
• Engagement inputs. Documents you upload (statutory accounts, management accounts, forecasts) and information you provide in the intake form (sector, stage, purpose, financial drivers).
• Generated outputs. Extracted financials, scenario assumptions, valuation results, draft reports, and the full audit trail.
• Operational data. Server logs, error reports, and privacy-friendly analytics (Plausible) — no cookies, no cross-site tracking.

3. How we use it

We process your data to deliver the valuation engagement you commissioned: extracting financials from your documents, computing the valuation, generating the report, and emailing the signed draft. We also retain a reproducible audit trail to support the defensibility of every figure in the report — a regulatory expectation under IVSC and HMRC guidance.

We do not sell your data. We do not use your documents to train any language model. We instruct our LLM provider (Anthropic) to operate with zero data retention where their API supports it.

4. Where it lives

Documents are stored encrypted at rest (AES-256) in object storage with EU jurisdiction. The application database is hosted in the EU. Email delivery is via Resend. Source documents are retained for seven years to align with UK accounting record-keeping norms; you may request earlier deletion (see §6).

5. Lawful basis (UK GDPR)

• Contract (Art. 6(1)(b)). Processing necessary to perform the engagement.
• Legal obligation (Art. 6(1)(c)). Retention of records to satisfy HMRC, ICAEW, and Companies House requirements.
• Legitimate interest (Art. 6(1)(f)). Security logging, fraud prevention, and product-quality measurement.

6. Your rights

Under UK GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection. To exercise any of these, email privacy@valucap.example. We respond within 30 days. If you are unhappy with our response, you may complain to the UK Information Commissioner's Office at ico.org.uk.

7. Cookies

We use no marketing cookies. Authentication uses a single session cookie scoped to /admin. Our analytics provider (Plausible) is cookie-free.

8. Updates

We may update this policy. Material changes are notified by email to all account holders at least 14 days before they take effect.