1. Who we are
CoreBalance is provided by Alnova Group Limited ("Alnova", "we", "us"), company number 16496222, No.1 Spinningfields, Quay Street, Manchester M3 3JE, United Kingdom. Contact us about privacy at corebalance@alnovagroup.com.
2. Our two roles
As processor. When you connect your HubSpot account (and Xero, if you choose), CoreBalance reads records about your customers to produce statements. You, the business using CoreBalance, decide what that data is used for. You are the controller, and we process it on your behalf as your processor.
As controller. We are the controller of the limited information we hold to run your CoreBalance account and subscription, such as your HubSpot account ID, subscription status and billing contact.
3. What CoreBalance reads, stores and does not store
| Data | What happens to it |
|---|---|
| From HubSpot: companies, contacts (name, job title, email), invoices, payments, line items and subscriptions | Read only, at the moment you produce a statement or open the CoreBalance card. Used to build the statement on screen. Not stored by CoreBalance. |
| From Xero, if you connect it: contacts, invoice payments and money received | Read only, when you produce a statement. Held in memory for up to 5 minutes to avoid repeated requests, then discarded. Not stored. |
| Your HubSpot and Xero connection tokens | Stored, encrypted (AES-256-GCM), so CoreBalance can stay connected. Deleted when you disconnect or when your account is deleted. |
| Company details you enter: company name, address, company and VAT numbers, email, phone, website, logo, bank or remittance details, pay online link, notes and display preferences | Stored so they can appear on your statements. You can change or remove them at any time under Company details. |
| Subscription records: HubSpot account ID, subscription status, renewal date, Stripe customer and subscription IDs | Stored to manage your subscription. |
| Payment card details | Handled entirely by Stripe. We never see or store card numbers. |
| Statements | Built on request and shown in your browser. Not stored by CoreBalance. Any PDF you save stays on your own device. |
| Server logs | Technical logs (such as error messages and request times) kept by our hosting provider for operating and securing the service. |
4. Processing on your behalf
When we act as your processor we will:
- process personal data only on your documented instructions, which are these terms and your use of CoreBalance;
- ensure anyone authorised to access it is bound by confidentiality;
- apply appropriate technical and organisational security measures (section 7);
- use only the sub-processors listed in section 5, tell you about changes in advance, and impose equivalent data protection obligations on them;
- help you respond to requests from individuals exercising their rights, and with your own data protection obligations, where reasonable;
- tell you without undue delay after becoming aware of a personal data breach affecting your data;
- delete your data when the service ends, as set out in section 8; and
- give you the information reasonably needed to show we meet these obligations.
5. Sub-processors and other services
| Provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Hosting of the CoreBalance application and its encrypted data store | United States (Oregon) |
| Stripe Payments Europe, Ltd. and its affiliates | Subscription billing and card payments | Ireland / United States |
| HubSpot, Inc. | Source of your CRM data (your own HubSpot account) | Per your HubSpot data hosting |
| Xero Limited (optional) | Source of payment data, only if you connect Xero | Per your Xero account |
6. International transfers
Our hosting provider stores data in the United States. Where personal data is transferred outside the UK or European Economic Area, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses incorporated in our providers' data processing terms.
7. Security
- All connections use HTTPS encryption.
- Connection tokens are encrypted at rest. Sessions use signed, HTTP-only cookies.
- CoreBalance asks HubSpot and Xero for read-only permissions only.
- Requests from HubSpot and Stripe are verified by signature.
- Each HubSpot account's data is kept separate and can only be accessed by a signed-in user of that account.
8. How long we keep data
We keep your stored data while CoreBalance is installed or your subscription is active. If you uninstall CoreBalance or your subscription ends, we delete your connection tokens and company details within 90 days, or sooner if you ask us. We keep subscription and billing records for as long as needed for tax and accounting, normally six years. Disconnecting Xero in CoreBalance deletes the Xero connection immediately.
9. Our lawful bases (where we are controller)
We process account and billing information to perform our contract with you, to meet legal obligations such as tax record-keeping, and for our legitimate interests in running, securing and improving CoreBalance.
10. Cookies
CoreBalance uses one strictly necessary cookie, cb_session, to keep you signed in. It lasts up to 7 days. We do not use advertising or analytics cookies. Our public pages load fonts from Google Fonts, which receives your IP address to deliver them.
11. Your rights
Under UK and EU data protection law, individuals have rights to access, correct, erase, restrict or object to the processing of their personal data, and to data portability. If you are a customer of a business that uses CoreBalance, please contact that business first, because they control your data. We will help them respond. For data we control, contact us at corebalance@alnovagroup.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
12. Changes
We may update this policy. We will post the new version here with a new "last updated" date, and tell customers about material changes in advance.
13. Contact
corebalance@alnovagroup.com, or Alnova Group Limited, No.1 Spinningfields, Quay Street, Manchester M3 3JE, United Kingdom.