Privacy Policy

Last updated: 11th August 2026

This policy explains how PayCycle ("we", "us"), operated by Hallett Technology Ltd, registered in England and Wales (company no. 17308053), handles personal data when you use our web and mobile application and website (the "Service"). We are registered with the UK Information Commissioner's Office (ICO), registration reference ZC185362. For any privacy question, contact hello@paycycle.uk.

Our role

For your own account and contact details we are a data controller. For the project, contract and financial information you enter into PayCycle on behalf of your own business and clients, we act as a data processor on your instructions — we only process it to provide the Service to you.

People who submit via a shared link

If a PayCycle customer sends you a submission link and you use it to send an application, we process the name, email and document you provide solely to pass your submission to that customer and let them reply. That customer is the controller of your information; we act as their processor, and we don't use it for marketing. If the customer runs an AI review of your document, it is processed by our AI provider as described under "AI processing" below. To ask for your details to be removed, contact the customer you submitted to, or email hello@paycycle.uk.

The information we process

• Account data: your name and email address, managed by our authentication provider (Clerk).
• Content you provide: projects, uploaded contracts and documents, payment applications, invoices, notices, retention, CIS/VAT figures and company details you enter.
• Usage & technical data: basic logs needed to run and secure the Service (e.g. error reports, security events).
• Product updates list: if you sign up for product updates we process the email address (and any name, company or role) you give us to send you occasional updates about PayCycle.

Why we process it (lawful basis)

To provide the Service to you under our contract (UK GDPR Article 6(1)(b)); for our legitimate interests in securing the Service and sending operational messages such as deadline reminders (Article 6(1)(f)); and, for waiting-list updates, your consent (Article 6(1)(a)) — every email includes an unsubscribe link, and you can withdraw at any time.

Who we share it with (sub-processors)

We use a small set of reputable providers to run the Service. Each is bound by a data-processing agreement.

AI processing

When you use an AI feature, the relevant document or figures for that action are sent to our AI provider (Anthropic) to produce your result. Anthropic does not use commercial API data to train its models, and does notretain those inputs and outputs by default once your result has been returned — the exception being content flagged by its automated safety systems, which it may keep for longer. See Anthropic's published data-retention policy. AI output is assistance only and should be checked — see our Terms.

International transfers

Some providers are based outside the UK (e.g. the US). Where data is transferred internationally, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or — for US providers certified under it — the UK-US Data Bridge.

How long we keep it

We keep your data for as long as your account is active. If you delete your account, it is removed from the live application immediately — see how account deletion works. A copy can still exist in our encrypted backups for a short period afterwards, until that backup cycles out — our database backups run daily on a rolling 7-day window, and in no event do we hold a backup copy for more than 90 days — and we retain specific records for longer only where we must, to meet a legal obligation (for example billing records for tax purposes).

Your rights

You have the right to access, correct, delete, restrict, object to, and port your personal data. To exercise any of these, email hello@paycycle.uk. You can also complain to the UK Information Commissioner's Office (ico.org.uk) — though we'd appreciate the chance to help first.

Cookies

Essential cookies — strictly necessary to run the service, such as keeping you signed in — are always on and need no consent under UK law (PECR). We also use privacy-friendly product analytics to understand how PayCycle is used so we can improve it, provided by PostHog and hosted in the EU. If you accept analytics cookies, PostHog may also record a replay of your session — how you move through the pages — to help us find and fix problems. All text and form fields on the page are masked, so the figures and details on your screen are never captured — a replay shows only the anonymised page layout and where you click. Replays are only recorded after you opt in. Analytics cookies are set only if you opt in via the cookie banner — there is no advertising tracking, you can decline, and no analytics cookies are set and no visitor tracking runs unless you accept. Separately, our hosting provider (Vercel) gives us anonymous, cookie-less page and performance statistics — nothing is stored on or read from your device, and individual visitors cannot be identified from it. The cookies we set:

Security

We protect your data with encryption in transit (HTTPS/HSTS), database row-level isolation so accounts can't see each other's data, private file storage with short-lived access links, and access controls.

Changes & contact

We may update this policy and will change the date above when we do. Questions: hello@paycycle.uk.

We may update this page from time to time; material changes will be notified with reasonable notice.