Payhawk Free Tools Privacy Notice
1. About this notice
This notice explains how Payhawk collects and uses personal data when you use Payhawk's free tools (the "Free Tools"), whether on our website without an account or with a free Payhawk account (a "Free Account"). It also explains how we handle personal data about other people that appears in data you enter or in systems you connect, such as your colleagues.
It supplements our Global Privacy Policy at payhawk.com/privacy. Where the two differ, this notice applies to the Free Tools. Terms defined in the Payhawk Free Tools Terms have the same meaning here.
2. Who we are
Payhawk Limited, company number 11747263, Chancery House, 53-64 Chancery Lane, London WC2A 1QS, United Kingdom ("Payhawk", "we", "us") is the controller of personal data processed through the Free Tools. For users in the United States, Payhawk Inc. is the controller.
Our data protection officer can be contacted at dpo@payhawk.com.
Some Free Tools, such as AI token spend, show your company's administrators usage and spend per person by default. We produce that view on behalf of your company, which is the controller for it (section 7).
3. The personal data we collect
| Category | Examples | Source |
|---|---|---|
| Sign-up and account data | Full name, work email, mobile number (which we may use to call or text you, including for marketing; see section 4), password (stored hashed), company name, company size, country (which we may prefill from your approximate location, based on your IP address), how you heard about us, acceptance of the Terms, marketing preferences | You |
| Attribution data | Campaign tags in the link you followed (such as UTM tags and ad click identifiers), our marketing automation visitor ID, analytics client ID, pages you visited before signing up | Our websites and cookies, with your consent where required |
| Input Data | What you type into a Free Tool, such as company size, industry, region, software subscriptions and costs, foreign currency volumes and spending totals. This includes what you type on a public tool page before you sign up, which we keep so that it carries into your Free Account | You |
| Connected Service data | Bank accounts and transactions (through a regulated account information service provider); chart of accounts and ledger entries from accounting or ERP systems; cost, usage, seat and API key data from software and AI providers, which may include names, email addresses and usage of people in your company, shown per person to your company's administrators by default | Systems you connect |
| Credentials | API keys and access tokens, stored encrypted | You |
| Outputs | Your figures, benchmarks, estimates and recommendations, including per-person usage and spend views for your company's administrators | Generated by us |
| Usage and device data | IP address, browser and device type, sign-in times, features used, error logs, bot-detection signals (such as mouse movements and typing patterns, collected by Google reCAPTCHA) | Your device and cookies |
| Communications | Support requests, emails and feedback | You |
Please do not enter special categories of personal data, payment card numbers or identification numbers. When you use the public page of a tool, our analytics tools record that you used it and the figures you enter, with your consent where required. If you book a demo from a public tool, we add the figures you entered and your result to your contact record.
4. How we use personal data, and our legal bases
| Purpose | Legal basis |
|---|---|
| Create and run your Free Account, provide the Free Tools and Outputs, and connect and read systems you ask us to connect | Performance of our contract with you; our legitimate interest in providing the Free Tools to your company |
| Keep the Free Tools secure, detect bots, prevent fraud and abuse, and enforce our Terms | Legitimate interests |
| Record your sign-up in our customer relationship management system, note which tools you use, the figures you enter and the results you generate (never data from bank accounts or other systems you connect), and follow up with you about Payhawk by email or phone, using the email address and mobile number you gave us | Legitimate interests in developing our business. You can object at any time. |
| Send you marketing emails and other electronic marketing | Your consent where the law requires it; otherwise legitimate interests. We ask for your consent on the sign-up form. You can unsubscribe at any time. |
| Use analytics and advertising cookies, and link visits made before you signed up to your Free Account. | Consent, given through our cookie banner |
| Improve and develop our products, and create aggregated, anonymised statistics and benchmarks | Legitimate interests |
| Comply with the law, including sanctions screening, tax and record-keeping, and respond to authorities | Legal obligation; legitimate interests |
| Establish, exercise or defend legal claims | Legitimate interests |
| Handle an application if your company decides to become a Payhawk customer | Steps before entering a contract; legal obligation. Our Global Privacy Policy then applies. |
Our benchmarks. Our benchmarks use anonymised, aggregated data derived from the activity of Payhawk customers. We show a figure only when enough companies are in the group, we never show how many companies are in it, and never in a form that identifies a company or a person. Data from your use of the Free Tools may also be included in aggregated statistics, in the same anonymised form.
Per-person views. By default, some Free Tools show your company's administrators usage and spend per person. We produce these views on behalf of your company, which is responsible for having a legal basis for them (section 7).
Legitimate interests. Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details, and you can object at any time (section 13).
5. Bank account data (open banking)
If you connect a bank account:
- Who provides access. A regulated account information service provider named on the connection screen gives us access. You give your explicit consent to that provider under its own terms and privacy notice.
- What we receive. Account details (such as account name, currency and balance) and up to 12 months of transactions (dates, amounts, currencies, counterparties and descriptions).
- What we use it for. Only to provide the Free Tool you asked for, such as your spend benchmark. We do not use bank data for marketing, lead follow-up or profiling, and we do not sell it.
- How long we keep it. We delete raw transactions within 24 hours of retrieving them. We keep the summary figures calculated from them until you remove them or close your Free Account.
- Your control. Your consent lasts up to 90 days and must then be renewed. You can withdraw it at any time in the Free Tool, with the provider or with your bank.
6. Accounting, ERP, software and AI provider data
If you connect an accounting or ERP system, we read your chart of accounts and up to 12 months of ledger entries for the accounts you choose. You can exclude accounts, such as payroll, before anything is read.
If you connect a software or AI provider, we read cost and usage reports, seat and API key lists and related details, which may include the names and email addresses of colleagues who hold seats or created keys. By default, the Free Tool shows your company's administrators cost and usage per person, matched to the colleagues named in those reports. We do not read prompts or responses sent to AI providers.
We store Credentials encrypted, use them only for the Free Tool you gave them for, and delete them when you disconnect. We delete data retrieved through a connection when you disconnect it or close your Free Account, except for aggregated statistics that do not identify anyone.
7. Information about your colleagues and other people
Systems you connect may contain personal data about other people, such as the names and email addresses of colleagues who created API keys or hold software seats, their usage, and the names of suppliers or employees in ledger entries or bank transactions.
- We use this data only to provide the Free Tool to your company. We do not contact these people, use their data for marketing or use per-person information for our own purposes.
- Per-person views are on by default. Free Tools that read usage data, such as AI token spend, show your company's administrators usage and spend per person, matched to the colleagues named in the connected system. Only your company's administrators see this view; other users at your company and other free users do not.
- We produce the per-person view on behalf of your company, under clause 8 of the Free Tools Terms. Your company is the controller for it: it decides whether to connect the system, who its administrators are and how it uses the view. It is responsible for telling its staff and for any consultation with employee representatives.
- In all other cases we are the controller. We rely on our legitimate interest in providing the Free Tools your company asked for, we obtain the data from your company's systems, and the rights in section 13 apply.
8. AI features and AI assistants
Some Free Tools use AI to generate insights from your data. Those providers act for us under terms that do not allow them to use your data to train their models.
If you use the Free Tools through a third-party AI assistant, such as Claude or ChatGPT, through our MCP server, the assistant's provider processes the data you exchange with it under its own terms and privacy policy. Our MCP Connector Privacy Notice at payhawk.com/mcp-connector-privacy-notice explains how the connector works.
9. Who we share personal data with
We share personal data only as needed for the purposes in section 4, with:
- Payhawk group companies, for operations and support;
- service providers acting for us, including cloud hosting (Google Cloud, EU region), customer relationship management and marketing automation (Salesforce, including Account Engagement), email delivery, analytics, security and bot protection (Google reCAPTCHA) and support tools;
- account information service providers and other Connected Service providers, only as needed to retrieve data you asked us to retrieve;
- professional advisers, auditors and insurers;
- authorities, regulators, courts and law enforcement, where the law requires it; and
- a buyer or successor in a merger, acquisition or sale of assets.
We do not sell personal data.
10. International transfers
We are based in the UK and host Free Tools data in the EU. Some of our service providers are in the United States or other countries. When personal data leaves the UK or the EEA, we rely on adequacy decisions (including the EU-US Data Privacy Framework and its UK extension), standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another lawful mechanism. You can ask us for a copy of the relevant safeguards.
11. How long we keep personal data
| Data | Retention |
|---|---|
| Free Account and sign-up data | While your Free Account is active; deleted 24 months after your last sign-in, or when you close your account |
| Sign-up requests that are never confirmed | Deleted 48 hours after the request |
| Input Data and Outputs | Until you delete them or your Free Account is closed |
| Raw bank transactions | No more than 24 hours after retrieval |
| Summary figures from bank data; data from ERP, software and AI providers | Until you remove them, disconnect the system or close your Free Account |
| Credentials | Until you disconnect the system or close your Free Account |
| Lead and marketing data in our CRM | 3 years after your last interaction with us, unless your company becomes a customer |
| Marketing opt-out records | As long as needed to respect your choice |
| Security logs | 12 months |
| What you type into public tools | Not stored |
We may keep data longer where needed to comply with the law or to establish, exercise or defend legal claims.
12. How we protect personal data
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, encrypted Credentials, access controls, separation of each user's data and security monitoring. No system is completely secure, and we cannot guarantee that data will never be accessed without authorisation.
13. Your rights
Depending on where you are, you may have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use it;
- receive it in a portable format;
- object to processing based on legitimate interests, and object at any time to direct marketing by any channel, including calls and texts, and related profiling;
- withdraw consent at any time, without affecting earlier processing; and
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions through the Free Tools.
To exercise your rights, email dpo@payhawk.com or use your Free Account settings. We may need to verify your identity, and we will reply within one month, or longer where the law allows.
If your data appears in a per-person view. Your company controls that view, so please send requests about it to your employer. If you contact us instead, we will pass your request to your company and help it respond.
You can complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority where you live or work. We would appreciate the chance to address your concern first.
14. Additional information for US residents
In the last 12 months we have collected the categories of personal information described in section 3: identifiers, commercial information, internet and network activity, professional information and inferences, for the purposes in section 4, and disclosed them to the recipients in section 9. We do not sell personal information.We do not use sensitive personal information to infer characteristics about you.
Depending on your state, you may have the right to know, access, correct and delete your personal information, to opt out of its sale or sharing, and not to be discriminated against for exercising these rights. You can exercise them, or use an authorised agent, by emailing dpo@payhawk.com. We keep personal information for the periods in section 11.
15. Cookies
We use cookies and similar technologies on payhawk.com and apps.payhawk.com. Non-essential cookies, such as analytics and advertising cookies, are used only with your consent, which you can change at any time in the cookie settings. Our Cookie Policy at https://payhawk.com/cookies gives details.
16. Changes to this notice
We may update this notice from time to time. We will publish the updated version with its date and, for significant changes, tell you by email or in the Free Tools.
17. Contact us
Privacy questions and requests, and our data protection officer: dpo@payhawk.com. Post: Payhawk Limited, Chancery House, 53-64 Chancery Lane, London WC2A 1QS, United Kingdom.