1. Who we are

Broadstone Technology Ltd (“Broadstone”, “we”, “us”) develops D.A.R.C.E.Y, also referred to as DARCEY or Darcey, an AI-assisted business management service. Broadstone Technology Ltd is registered in England and Wales, company number 17454742. Registered office: 21 Surrey Close, Totton, SO40 2QQ. We are registered with the Information Commissioner's Office as a data controller, registration number ZC265428.

This policy explains how personal information is handled through our website, enquiries and DARCEY, including connected business services where those features are available and enabled. A feature being described here does not mean it is active on every account.

For privacy enquiries, contact info@broadstonetechnology.co.uk or call 023 8155 0387.

2. Who is responsible for your information?

Broadstone is the data controller for information we use to manage our own website, enquiries, customer accounts, billing, support and service security. This means we decide why and how that information is used.

When a business uses DARCEY to manage its customers, employees, suppliers or other contacts, that business will normally be the controller of its business records. Broadstone acts as its data processor when handling those records on its instructions. The business is responsible for its own lawful basis, privacy notices and authorised use of the service.

If your information was added by a business using DARCEY, its privacy notice also applies. You can ask that business about its use of your information, or contact us so we can help route your request.

3. Information we handle

The information involved depends on how you use the website, the records a business supplies and the connections it authorises:

• Enquiries and accounts: names, business names, email addresses, telephone numbers, user roles, account identifiers and correspondence.
• Business records: customer and supplier details, job or project addresses, requirements, measurements, notes, tasks, appointments, quotes, documents, photographs and attachments.
• Communications: email and messaging content, sender and recipient details, timestamps, message identifiers and delivery information made available by the connected provider.
• Voice and AI interactions: spoken audio processed during voice use, transcripts, typed instructions, relevant business context, generated responses and records saved from those interactions.
• Accounting and bank information: authorised customer, invoice, payment, balance and transaction information needed for enabled accounting or reconciliation functions.
• Connection and technical information: provider account identifiers, authorisation tokens, permissions, IP addresses, browser or device information, sign-in events, error reports and action logs.

Information comes from you, authorised users of a business account, people who communicate with that business, connected providers and use of the service. We do not obtain access to every account or file simply because you use DARCEY.

Please provide only information needed for the task. Do not upload health information, criminal-offence information or other particularly sensitive records unless the business has established the necessary legal conditions and agreed a suitable service arrangement with us.

4. How and why information is used

DARCEY uses authorised information to organise business records, find relevant information, capture instructions, prepare communications and documents, assist with scheduling and follow-up, and perform enabled actions within the applicable permissions and confirmation controls.

Broadstone also uses information to answer enquiries, administer accounts, provide support, investigate faults, protect the service and meet legal obligations. Optional product communications are separate from essential account and service messages.

When we process a customer business’s records on its behalf, that business determines the appropriate lawful basis. Granting an integration permission is not, by itself, consent from every person mentioned in the connected records.

Some information is necessary to provide an account or requested feature. Without it, we may be unable to provide that service. Optional features and connections can be left unused.

5. Meta, Facebook and WhatsApp

If an authorised business connects a Meta or WhatsApp Business account, DARCEY may receive the business and account identifiers, connected telephone numbers, contact details, messages, media and delivery or read-status events made available under the granted permissions.

This information is used to support that business’s communications: displaying and organising conversations, linking messages to relevant records, preparing responses and sending authorised messages through the connected account. Access is limited by the permissions and functionality enabled for that connection.

Connecting WhatsApp Business does not grant access to unrelated private WhatsApp conversations. Meta and WhatsApp also process information under their own terms and privacy notices. The page in the DARCEY app where a business connects WhatsApp loads Meta's own sign-up script from Facebook, so Meta receives information from the browser during that step. This is the only outside script in the DARCEY app. Messages processed inside a business system are subject to that system’s handling and access controls; WhatsApp’s consumer privacy wording should not be taken as a description of DARCEY’s storage.

You can revoke an integration through the relevant provider’s account or business settings, or contact us for help disconnecting it. Disconnecting stops future authorised access; it does not automatically delete records already imported. To request deletion, follow the instructions below.

6. Email, accounting and other connections

Where enabled, connections such as IONOS email, Google (Gmail and Google Calendar), Microsoft 365 (Outlook email and calendar), QuickBooks, Xero, TrueLayer (read-only bank data) or SumUp (read-only card payment records) allow DARCEY to work with the information and actions authorised by the account owner. The exact permissions depend on the provider and the selected feature.

Our bank-reconciliation functionality is designed around read-only bank information. Matching an incoming transaction to an invoice is different from initiating a bank payment. Accounting actions, such as recording a received payment, are governed by their separate permissions and confirmation controls.

Access can be revoked through the provider. The provider’s own handling of its account data is covered by its privacy notice. New connections may require additional permission notices before they are used.

7. AI and voice processing

DARCEY uses AI services, including OpenAI, to interpret requests and produce responses. Depending on the feature, typed text, spoken audio, transcripts and relevant retrieved information may be sent to an AI provider for processing. This can include personal information contained in an instruction or an authorised business record.

DARCEY does not keep voice recordings; only the resulting text is saved. AI processing is not the same as keeping all information on your device. Provider handling, retention and any model-improvement use depend on the applicable service agreement and account configuration. You can contact us for information about the arrangements relevant to your service.

AI may help classify messages, summarise information and suggest next actions. Outputs can be inaccurate and should be checked before being relied on. DARCEY is intended to assist business work, not to determine a person’s employment, credit eligibility or other similarly significant outcome solely through automated processing. A business proposing such a use must arrange an appropriate assessment, lawful basis and safeguards first.

8. Who information may be shared with

Information may be available to authorised users of the relevant business account and to providers needed to deliver the selected service. These may include hosting and infrastructure providers, AI processors, email and messaging providers, accounting and banking-data providers, and technical support suppliers.

The current DARCEY service uses Render for application hosting in Frankfurt, Germany (EU), Cloudflare for secure sign-in and network protection, OpenAI for AI and speech-to-text, and Google Firebase and Apple for phone notifications. DARCEY does not use analytics, advertising trackers or error-logging services. Meta/WhatsApp and other connected platforms receive information where a business enables and uses those connections. Your account configuration determines which providers are involved.

We may also disclose information to professional advisers, authorities where disclosure is required by law, or parties involved in a genuine business restructuring or transfer, subject to applicable confidentiality and data-protection requirements.

Service providers may act on our instructions or have their own responsibilities for particular processing. Contact us for the supplier and processing information relevant to your account.

9. Where information is processed

DARCEY is hosted in the EU (Frankfurt, Germany). AI, network and connected services can involve processing outside the United Kingdom, including in the United States. The applicable locations depend on the providers and deployment used for your service.

Where a transfer is restricted under UK data-protection law, an appropriate legal transfer arrangement is required. Depending on the recipient, this may be a UK adequacy decision or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, with any necessary assessment and supplementary measures.

Contact us to ask which transfer arrangements apply to your information and how to obtain details of the relevant safeguards.

10. How long information is kept

Retention depends on the purpose and the type of record. The criteria used are:

• Enquiries and support: the time needed to handle the enquiry or issue, maintain relevant correspondence and resolve any resulting dispute.
• Account and commercial records: the service relationship and any additional period required for legal, accounting or claims-related purposes.
• Customer-controlled business records: the business’s instructions, agreed service arrangements and applicable record-keeping requirements.
• Security and action logs: the period needed to investigate incidents, maintain accountability and protect the service.
• Provider copies and backups: the applicable provider retention and backup lifecycle, subject to the relevant contract and legal requirements.

Removing a record from the normal view, placing it in Deleted Items, or disconnecting an integration is not necessarily permanent erasure. Where erasure applies, the request must also address retained copies and relevant processors. We can explain the retention and deletion arrangements for your particular account or request.

11. Request deletion of your data

You can request deletion of personal information held by Broadstone or processed through DARCEY, including information obtained through Meta or WhatsApp connections.

1. Email info@broadstonetechnology.co.uk. The subject “DARCEY data deletion request” helps us route it, but is not compulsory.
2. Tell us your name, the relevant business or account, and what information you want deleted. Include the connected email address or WhatsApp number only where needed to locate the records. Do not send passwords or access tokens.
3. We may request proportionate information to verify your identity or authority. If another business controls the records, we will explain this and help route the request to that business.

Requests are normally answered within one calendar month, subject to the rules on identity verification and any lawful extension. We will explain if more time is permitted and needed. If deletion cannot be completed because a legal exception applies, we will explain the reason and the applicable complaint route.

Deletion from DARCEY does not delete messages already received by someone else or automatically close an account held with Meta, an email provider or an accounting provider. Those organisations may need to receive a separate request.

12. Your choices and rights

Depending on the circumstances, you may ask to access your personal information, correct it, erase it, restrict its use or receive a portable copy. You may object to processing based on legitimate interests, and you can object to direct marketing at any time.

Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing. You can also revoke provider permissions and use available device controls for microphone or camera access. Rights are subject to the conditions and exemptions in applicable law.

Contact us using the details above. We may need to verify your identity. For records controlled by a business using DARCEY, contact that business first; we can assist with identifying the appropriate route.

13. Website cookies and marketing

The website and connected services may use cookies or similar storage for operation, security and preferences. Optional analytics, advertising tools or embedded media can involve additional identifiers and third-party processing when those tools are enabled.

Where consent is required for non-essential technologies, it must be obtained before those technologies are used. You can use any cookie controls provided on the website and your browser settings to manage storage. Blocking essential technologies may affect functionality.

You can ask us to stop marketing messages using the unsubscribe option in a message or by contacting us. Essential account, security and service communications are separate from marketing.

14. Security and appropriate use

Protecting information requires both technical controls and responsible account use. Access permissions, secure connections and protection of stored information form part of DARCEY’s security arrangements. No online service can guarantee absolute security.

Business account owners should keep access limited to authorised people, protect their connected accounts and review the information they upload. Contact us promptly if you believe information has been exposed or an account has been misused.

DARCEY is intended for business users and is not directed at children. Contact us if you believe a child has supplied information directly to us inappropriately.

15. Questions, complaints and policy updates

Please contact Broadstone if you have a concern about your information. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. If you are elsewhere, you may have the right to contact your local data-protection authority.

We may update this policy as the service or its processing changes. The date at the top identifies the latest version. Material changes that require direct notice will be communicated through an appropriate channel.

Privacy contact: info@broadstonetechnology.co.uk