Last updated: 3 October 2026
This policy explains what personal information we collect through getdarcey.co.uk and the DARCEY service, why we use it, who we share it with and what your rights are. We have written it in plain English. If anything is unclear, contact us using the details below.
1. Who we are
DARCEY is made by Broadstone Technology Ltd, a company registered in England and Wales (company number 17454742). Registered office: 21 Surrey Close, Totton, SO40 2QQ.
Email: hello@getdarcey.co.uk
Phone: 023 8155 0387
In this policy, “we”, “us” and “our” mean Broadstone Technology Ltd.
2. Our two roles
When we decide how information is used, we are the “controller”. This covers our website, early access sign-ups, enquiries, customer accounts, billing and support.
When we handle a business customer’s records for them, we are a “processor”. A business using DARCEY decides what information it connects, such as its emails, WhatsApp messages, customer details, quotes, invoices and bank transactions. That business is the controller of its records and we only use them to provide DARCEY on its instructions. If you are a customer of a business that uses DARCEY, please contact that business first about your information.
3. Information we collect
When you visit getdarcey.co.uk
Our website does not use analytics, advertising or tracking tools. Our hosting provider records basic technical details for every visit, such as your IP address, browser type and the pages requested. These logs are used to keep the website running and secure.
When you join early access or contact us
- your name and business name
- your email address and phone number (phone is optional)
- what your business does and which email and accounts software you use
- anything you write to us and our replies
When your business uses DARCEY
- account details for each user, such as name, email address, role and sign-in information
- the business records you choose to connect or create, such as emails, WhatsApp Business messages, customer details, addresses, job notes, photos, quotes, invoices and calendar entries
- accounting records from your connected accounting software
- bank transactions, read-only, if you connect your bank
- card payment records, read-only, if you connect SumUp
- voice input: what you say is turned into text so DARCEY can act on it. DARCEY does not keep the voice recordings
- device details needed to send notifications to your phone
You do not have to give us your details. If you don’t, we may not be able to reply to you or provide DARCEY.
4. Why we use it and our legal reasons
- To reply to early access sign-ups and enquiries. Legal reason: our legitimate interest in responding to people who ask about DARCEY, or taking steps at your request before a contract.
- To provide DARCEY to our customers. Legal reason: our contract with the business. For staff users who did not sign up themselves, our legitimate interest in providing the service their business has asked for.
- To bill customers and keep business records. Legal reason: our contract and our legal obligations, such as tax law.
- To keep DARCEY and our website secure and working. Legal reason: our legitimate interest in running a safe and reliable service.
We do not sell personal information. We do not use it for advertising. We do not make decisions about people that have legal or similarly significant effects based only on automated processing.
5. How DARCEY uses AI
DARCEY uses AI provided by OpenAI to sort messages, prepare drafts such as replies and quotes, and turn speech into text. Information is sent to OpenAI only to carry out the task you asked for. Under OpenAI’s API terms, this information is not used to train their models. OpenAI may keep it for a short time to check for misuse, then delete it.
AI can make mistakes. That is why nothing DARCEY prepares, such as an email, message, quote, invoice or accounts change, goes ahead until a person at the business checks it and approves it.
6. Who we share information with
We use trusted service providers to run DARCEY and our website. Our own service providers may only use information to provide their service to us. When a business connects its own accounts, such as email, WhatsApp, accounting, bank, card payments or calendar, information moves between DARCEY and that provider under the business’s own agreement with them.
- IONOS: website hosting and our email
- Elementor: sends the emails from our website forms
- Render: hosts DARCEY, in Frankfurt, Germany (EU)
- Cloudflare: secure sign-in and network protection
- OpenAI: AI features and speech-to-text
- Your email provider, such as Google (Gmail), Microsoft 365 or IONOS: if you connect your mailbox
- Meta (WhatsApp Business Cloud API): if you connect WhatsApp Business. The page in the DARCEY app where you connect WhatsApp loads Meta’s own sign-up script from Facebook, so Meta receives information from your browser during that step. Meta’s privacy policy applies to it. This is the only outside script in the DARCEY app.
- Intuit (QuickBooks) or Xero: if you connect your accounting software
- TrueLayer: read-only access to bank accounts and transactions, if you connect your bank. DARCEY cannot make payments
- SumUp: read-only card payment records, if you connect SumUp
- Google Calendar or Microsoft Outlook calendar: if you connect your calendar
- Google Firebase and Apple: phone notifications
We may also share information if the law requires it, or with professional advisers such as our accountant, under a duty of confidentiality.
7. Where your information is processed
DARCEY is hosted in the EU (Frankfurt, Germany). Some of our providers, including OpenAI, Cloudflare, Meta, Google, Microsoft, Intuit, Xero, Elementor, Firebase and Apple, may process information in other countries, including the United States.
When information leaves the UK, we rely on the protections set out in UK law. These include UK adequacy regulations (which cover the EU), the UK Extension to the EU-US Data Privacy Framework where a provider is certified, and the ICO’s International Data Transfer Agreement or Addendum. Contact us for details of these protections.
8. How long we keep information
- Early access sign-ups and enquiries: until we have dealt with them, and no longer than 12 months afterwards unless you become a customer.
- Customer account and billing records: for as long as the account is open, then for as long as the law requires, usually up to 6 years for financial records.
- Business records held in DARCEY: as the business instructs. When an account closes, we delete or return the business’s records, unless the law requires us to keep something.
- Voice recordings: not kept. Only the text is saved.
- Security logs: only as long as needed to keep the service secure and investigate problems.
9. Keeping information safe
Each business has its own private system. Information is encrypted and access is limited to people who need it. We connect to other services using their official, secure methods, and bank access is read-only.
10. Your rights
You have the right to:
- ask for a copy of your information
- ask us to correct it
- ask us to delete it
- ask us to limit how we use it
- object to how we use it
- ask for your information in a format you can take elsewhere
- withdraw your consent at any time, where we rely on consent
To use any of these rights, email hello@getdarcey.co.uk. We will reply within one month. If your information is held by a business that uses DARCEY, contact that business and we will help them respond.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
11. Cookies
See our cookie policy.
12. Children
DARCEY is a business service. It is not meant for anyone under 18, and we do not knowingly collect information about children through our website.
13. Changes to this policy
We will update this policy when how we use information changes. The date at the top shows when it was last updated.