Privacy

The AR Agent is a trading name of Futureproof Tech Ltd, a company registered in England and Wales with company number 12482223, whose registered office is at Rhj Accountants, 99 Parkway Avenue, Sheffield, England, S9 4WG. In this notice, “The AR Agent”, “we”, “us” and “our” mean Futureproof Tech Ltd.

This notice covers this website, including the record it keeps of visits and the trial request form, and The AR Agent product at app.thearagent.com, including the AI assistants a customer can connect to it.

For the website and for the people who sign in to The AR Agent, we decide how personal information is used, so we are the controller. For the information about a business's own customers and contacts that the product works with, that business is the controller and we process it on its behalf, as its processor.

From the trial request form, only what you type into it:

• Your name
• Your work email address
• Your company name
• Which accounting software you use
• An optional message

We also record the date and time the form was submitted.

If you use the ROI calculator, we keep your answers when your report is shown, to understand how the calculator is used. They are estimates about your business, kept with the visit they came from, and without your name or email address. If you give us your email address with your report, we also keep it, along with your company name if you give it, and whether you asked for occasional emails about The AR Agent. We don't add you to any mailing list unless you tick that box.

When you visit, the site also records each page you open: which page, the website or link that sent you (including any campaign tag in that link, and any reference on a link we emailed you, which tells us which of our emails it came from), your IP address, the approximate location our host works out from it (city, region and country), and your browser type. If your browser sends a Global Privacy Control signal, the reference on an emailed link is not recorded.

On some pages the site also records whether you play the product demo, whether you watch it to the end, and which buttons you press, such as Book a quick call. If you send us a request from one of those pages, we can see which page, and which campaign link, you came from. That link is not made if your browser sends a Global Privacy Control signal.

The website does not use cookies, advertising or third-party analytics, and it does not load fonts, images or scripts from other companies, so your visit is not reported to anyone else.

Like any website, our host receives the requests your browser makes, including your IP address, and keeps short-term server logs so the site can run and be protected from abuse.

Trial requests: to reply to you about the free trial and to help you get set up. We do not use them for anything else, and we do not add you to a marketing list.

Calculator report requests: to send you the report you asked for, and to follow up about it. We only send you other emails about The AR Agent if you ticked the box asking for them.

Visit records: to see which pages are read, and whether businesses we have contacted about The AR Agent have visited the site, which may inform whether and when we follow up with them.

When someone signs in to The AR Agent, we keep their name, email address and, where the account they sign in with provides one, profile picture, when they last signed in, and which workspace they belong to.

When a business connects its accounting system (Xero or QuickBooks Online), we read its invoices, customer contacts, payments and organisation settings. The only changes we make there are to a customer's contact or billing email and to the reference or purchase order field on an invoice, and only after a person in that business has approved them.

If a business connects its bank account, it does so through TrueLayer, and the connection is read-only: we cannot move money or make payments. We read the list of accounts it covers and the payments coming into them (amount, date, the payer's name and their reference), and use them only to match payments to the business's open invoices, so it is not asked for money that has already arrived. We keep incoming payments for about 90 days, and we do not keep payments going out. The bank asks the business to renew this access every 90 days.

When a business connects its Gmail mailbox, The AR Agent asks Google for permission to read, label and send email (Google's gmail.modify and gmail.send permissions) and to see the connected account's email address. It uses that access only to:

• search for and read conversations with the business's customers about invoices, including attachments such as remittance advice
• check new incoming mail for replies from customers
• send the emails the business approves, or that its chosen settings allow
• mark messages read or unread when someone does so on the Emails screen
• show the mailbox on the Emails screen, read from Gmail when the screen is opened

We store the messages we link to a customer or invoice (sender, recipients, subject, text and date), the drafts we write, and a record of what was sent and when. For other messages we check, we store only Gmail's identifier for the message and what we concluded, so it is not checked twice.

If a business connects Slack, we post approval requests and updates to the channel it chooses.

We also keep what the product works out from all of this: each customer's situation, promises to pay, notes, and the history of each case.

We use this information only to provide The AR Agent to the business that connected it: to track what is owed, draft and send follow-ups, answer questions about the account, and show the business what has happened.

To draft messages and answer questions, we send the relevant invoices, emails and notes to Anthropic, which provides the Claude AI models The AR Agent runs on. Anthropic processes it to return a response and, under its commercial terms, does not use it to train its models. We do not use it to train AI models either.

We share information from Gmail only with Anthropic, to draft messages and answer questions, and with an AI assistant the business chooses to connect. We do not sell it, use it for advertising, or use it to train AI models, and people at The AR Agent do not read it except with the business's permission (for example to help with a support request), for security, or where the law requires.

The AR Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A person in a business can connect an AI assistant, such as ChatGPT or Claude, to The AR Agent. They sign in to The AR Agent and press Allow before anything is shared.

Once connected, the assistant receives the information its requests return, such as who owes what, a customer's invoices and recent emails, and promises to pay, and it can ask The AR Agent for a draft, which waits for approval. It cannot send emails, approve drafts or change the accounting system.

Information the assistant receives is handled by its provider, OpenAI for ChatGPT or Anthropic for Claude, under that provider's terms and privacy policy. The connection can be removed at any time from the assistant's settings, and it ends straight away if the person is removed from the business's team.

Where UK or EU data protection law applies, we rely on our legitimate interests: for trial requests, you asked us about a trial and we need your details to reply; for visit records, understanding how the site is used and following up with businesses we have contacted. You can object to this processing or ask us to delete your information by contacting us.

For people who sign in to The AR Agent, we process their details to provide the service their business signed up for. For a business's customers and contacts, the business decides the lawful basis, and we process that information only on its instructions.

We use these service providers, and only for the purposes below:

• Supabase hosts the PostgreSQL database where trial requests, calculator report requests, visit records and the product's data are stored, in its London region.
• Vercel hosts the website and the product, and works out the approximate location of each website visit from its IP address. The code that handles the form, records visits and runs the product runs in Vercel's London region.
• Anthropic provides the AI models that draft messages and answer questions in the product.
• OpenAI (ChatGPT) and Anthropic (Claude) receive website visit records when we use those assistants to review how the site and our emails are doing. They receive the pages, times, approximate location and how the visit arrived, with the IP address replaced by an identifier that cannot be turned back into it and shortened to the network it belongs to.
• Resend sends us an email notification when a trial request comes in, and sends you your calculator report when you ask for it by email.
• Google (Gmail), Xero, Intuit (QuickBooks Online) and Slack provide the services a business chooses to connect, under its own accounts with them.
• TrueLayer, which is authorised by the Financial Conduct Authority to provide account information services, connects to a business's bank, read-only, when the business chooses to connect it.

Connection tokens for those services are encrypted in our database.

Anthropic and Resend are based in the United States, so information sent to them is processed outside the UK and the EU. Those transfers are covered by each provider's data processing terms, which include the European Commission's standard contractual clauses and, for UK data, the UK International Data Transfer Addendum issued by the Information Commissioner. Resend is also certified under the EU-U.S. Data Privacy Framework and its UK Extension.

The people who run The AR Agent. Trial requests and visit records are shown on an admin page that requires a password to open, and our service providers can access the data only as needed to provide their service to us.

Inside the product, a business's data is visible only to the people that business has added to its workspace, and to the AI assistants they choose to connect.

We do not sell your information, and we do not share it with anyone else for their own marketing.

We keep inactive or unsuccessful trial requests, and calculator report requests, for up to 12 months, after which we delete them unless we need to retain them for a legitimate legal or operational reason.

Visit records are deleted automatically after 90 days.

Product data is kept while the business uses The AR Agent. When a business asks us to close its account, we delete its workspace data within 30 days, except anything we must keep by law.

Where UK or EU data protection law applies, you have the right to ask us for a copy of the personal information we hold about you, to have it corrected or deleted, and to object to or restrict how we use it.

To do any of that, email tom@thearagent.com and tell us the email address you used on the form, or for visit records the IP address you visited from, so we can find them. We will respond within one month.

If you are unhappy with how we have handled your information, please contact us first at tom@thearagent.com so we can try to put it right.

You can also complain to a data protection regulator. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the supervisory authority for the country you live in.

If this notice changes, we will update the date at the top of this page.