How SHVL handles your account and credit-control data.

New passwords are checked for known breaches.

When you create an account with a password on SHVL's website, your browser checks it using Have I Been Pwned. Only the first five characters of a password hash are sent to that service, without your email address, password or full hash. The service receives your IP address as part of the connection. See its privacy policy.

You choose which providers SHVL can access.

Xero and FreeAgent access is limited to accounting data needed to synchronise contacts, invoices and payments. Microsoft 365, Outlook.com or Hotmail access is used to send reminders and identify replies or delivery failures. The Gmail sending connection uses send-only access and cannot read your Inbox, replies or delivery failures. The separate selected-message Gmail add-on is described below.

• SHVL does not use mailbox content to train a general model or learn your writing style.
• Provider access can be disconnected from workspace Data controls.
• You can also revoke SHVL in the provider's account settings.

Gmail sending and selected-message imports use separate permissions.

When an account connects Gmail, SHVL accesses the Google account email address and OAuth credentials. SHVL requests gmail.send and uses it only to send reviewed reminders or explicitly approved invoice-blocker requests. A request may include one clean, reviewed document selected and confirmed by the permitted workspace member. The recipient, message, invoice links, document reference, approval and follow-up date are retained in the case history. This sending connection cannot read, modify or delete existing Gmail messages.

Selected-message Gmail add-on (private testing)

The separate SHVL Gmail add-on reads the message you have open only after you choose Preview. It uses gmail.addons.execute, gmail.addons.current.message.action and script.external_request to run in Gmail, preview that message and transfer it to SHVL after your explicit action. It cannot search your Inbox, read other messages automatically, send email or change Gmail messages.

You create a temporary import code for one customer case in your SHVL workspace. After previewing and confirming the transfer in Gmail, the add-on sends the sender email address, subject, date and up to 4,000 characters of plain text to SHVL over HTTPS. Attachments, the Gmail access token and Gmail message identifier are not transferred. Longer text is marked as an excerpt. You review the imported reply in SHVL and explicitly save it as evidence for a payment blocker or promise. Importing does not send or resume reminders.

The temporary payload is encrypted at rest. Import codes expire after 15 minutes; expired temporary records are removed by scheduled cleanup every five minutes. A saved reply and your decision remain in the workspace case history until workspace deletion. Uninstalling the add-on or revoking its Google permissions stops future access but does not delete evidence you already saved in SHVL. To request deletion of saved evidence, contact hello@shvl.app.

• Sharing and disclosure. SHVL does not sell Google user data or share it with advertisers, data brokers, other customers or AI model providers. Saved evidence is available to authorised members of your workspace. It is disclosed only to service providers needed to host and secure SHVL, to the intended email recipient when the workspace owner sends a reminder, or where disclosure is required by law.
• Protection. OAuth credentials are encrypted at rest and transmitted over HTTPS. Access is restricted to the systems and authorised staff needed to operate, secure and support the service.
• Retention and control. Disconnecting Gmail deletes the stored Google connection and OAuth credentials. The account owner can also revoke SHVL from Google Account settings.

SHVL's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for advertising or to train general-purpose AI or machine-learning models.

ChatGPT receives only the data needed for the tool you choose.

The optional SHVL ChatGPT plugin accepts the aged-debtors CSV text, sender name and Bank Rate that you provide in ChatGPT. SHVL processes those inputs in memory to return review-only UK B2B chase drafts and indicative statutory-interest calculations.

In the original read-only SHVL plugin, signing in to ChatGPT means its protected read-only tools can also return a daily credit-control brief, a receivables-health summary, case search results and one selected case from your latest SHVL CSV import or completed accounting sync. Results can include customer names, invoice references, dates and balances, aggregate invoice and receivables-payment totals, payment-readiness state and limited reminder evidence. The receivables view is not a bank balance, cash-flow, profit or whole-business health report. Results exclude expenses, email addresses, message content, provider IDs and individual payment records. Every request is restricted to the signed-in SHVL workspace. The tools do not call an accounting provider live, change records, queue a reminder or send a message.

• The tool result repeats the debtor name, invoice number, due date and outstanding amount from the supplied CSV. It adds days overdue, statutory interest, fixed compensation, total claim, a subject line and a draft body. It does not return debtor email addresses or persist the submitted CSV in SHVL's database.
• The anonymous CSV tool does not send email, create an account, connect a mailbox or start a payment. The original signed-in workspace tools are read-only and use the existing SHVL workspace connection.
• ChatGPT is a separate service. Its handling of conversation and uploaded-file data is governed by the terms and privacy settings that apply to your ChatGPT account.

Expanded agent tools, available through the npm CLI and proposed for a new ChatGPT version, additionally return recorded customer message text, manually supplied evidence, Accounts Prep responses and the mailbox and recipient addresses needed to review a blocker request. Separate Xero access can return live financial reports and provider identifiers needed for reviewed drafts. Requested results are shared with your connected agent service and subject to its data policies. The published ChatGPT plugin remains read-only until the new version is approved and published.

Explicitly approved expanded tools can save customer activity, readiness checks, draft checklists and handover decisions, send a reviewed blocker request, or create a Xero draft. SHVL stores those records under the same workspace retention and deletion rules as website actions. The tools do not authorise or pay Xero drafts, reconcile bank transactions or activate reminder schedules. Access stays within authorised workspaces. You can revoke the connection; revocation does not remove records already shared with the agent service.

Uploaded financial evidence stays within your chosen workspace.

Monthly packs store the financial files you upload, their original checksums, editable accounting annotations and revision-specific review history. Original email files can contain personal data and attachments; only upload the business records you intend to share with workspace members. The Gmail sending connection does not collect these emails for you.

Retained monthly-pack originals have no automatic expiry, including earlier versions. Unfinished and rejected uploads remain subject to cleanup. Files are private, checked for malware and downloaded rather than rendering email HTML. Storage limits apply. The owner can still retrieve retained records when their paid entitlement ends. Workspace deletion removes the pack and its files. See monthly-pack data handling.

Product analytics do not include debtor or message content.

Usage analytics help us see which tools people use and where errors occur. They do not include message bodies.

• Workflow events: workflow started, workflow succeeded or failed, duration, steps completed, connector used.
• Site analytics: Plausible, Cloudflare Web Analytics, Google Analytics 4 measurement ID G-KQ4M2NMLQD, Ahrefs Web Analytics page views, plus SHVL funnel events like checkout clicks, demo requests, workflow views, and install intent. GA4 is loaded on public marketing pages with anonymised IP settings, Google signals disabled, ad personalisation signals disabled. It loads only after you allow analytics. If you withdraw that choice, SHVL stops GA4 events and removes GA cookies this browser allows us to access. Advertising storage remains denied.
• Signed-in product events may include page path and account id. Free tools do not require an account.
• If you allow analytics and create a recurring workspace, SHVL stores the first landing path, coarse acquisition channel and a sanitised campaign label captured in this browser. Without that choice, the source is recorded as unknown. It does not store the referrer URL, debtor data, invoice values or your email in that attribution row.
• Stripe handles chase-pack and subscription payments. SHVL receives checkout status, customer and subscription references, not full card details.
• Analytics events do not contain CSV rows, debtor details, invoice details or message bodies.

Anyone with a reply link sees one customer's open invoices.

When reply links are on, each reminder includes a private link for that customer. The page shows your business name, their open invoices and the payment details you entered. The link stops working at the end of the third month after it was sent, and you can reset it at any time, which stops the old link at once.

• SHVL handles your customers' replies on your behalf, as your processor. Your customers should contact you about their data; SHVL will help you answer them.
• Each customer can send a limited number of replies a day. Replies stay in your workspace until you delete it.
• If sending fails, SHVL emails its own support inbox the workspace name, the error and the dates involved, so it can fix the fault. The email does not include reminder text or customer replies.

You can disconnect providers or delete the workspace.

Disconnecting a provider removes its stored connection and token, pauses reminders and keeps previously synced records and communication history for review. Workspace deletion permanently removes local recurring credit-control data after an active SHVL subscription is cancelled. Before deleting, the owner can download every customer, invoice, payment, reminder, reply and note as one JSON file from Data controls. Connection tokens are not included in that file.

• Stripe may retain payment records to meet its own legal obligations.
• To request access, correction or deletion, email hello@shvl.app. You may also complain to the UK Information Commissioner's Office.