Legal
Data Processing
This page explains the roles, categories of data, processors and safeguards involved when ApproveTrail software is used.
Roles
For account, billing and enquiry data, Tilak Giri, trading as ApproveTrail, is the data controller.
Where you use the software to manage documents and reviews created and controlled by your own business, you act as the controller of that document data, and ApproveTrail acts as a processor providing the platform on which it is stored and managed, in accordance with your instructions given through your use of the software.
Categories of data processed
- Account and contact data: name, business name, email address, telephone number.
- Billing data: processed by Stripe, limited confirmation data received by us.
- Document and review data: documents uploaded for review, reviewer names and comments, approval status, revision notes and version records created within your account.
- Support data: correspondence relating to your use of the software.
Sub-processors
We use a limited number of sub-processors to operate the service: Stripe Payments Europe, Ltd. for payment processing, our website hosting provider for storing and serving the software, and our email provider for delivering access and support messages. We do not share document or review data with any party beyond what is necessary to operate these services.
Security measures in place
- The website and software are served over HTTPS.
- Configuration files and credentials are stored outside the public web directory and are never exposed to the browser.
- Access to underlying account, order and support records is restricted to the business owner.
- Card payment details are never handled or stored by ApproveTrail; they are collected directly by Stripe.
Retention
Document and review data created within your account is retained for as long as your package remains in use, plus a short period afterward to allow you to request an export. Billing records are kept for six years to meet UK tax requirements.
International transfers
Where a sub-processor operates outside the United Kingdom, transfers rely on UK-recognised safeguards, such as adequacy regulations or the UK International Data Transfer Agreement.
Breach handling
In the event of a personal data breach affecting your information, we will assess the risk without undue delay, take steps to contain and remedy it, and notify the Information Commissioner's Office and affected individuals where required by UK data protection law.
Contact
Questions about this document can be sent to hello@approvetrail.co.uk or posted to 72 Highcross Street, Leicester, LE1 4NN, United Kingdom.
ApproveTrail is independently owned and operated by Tilak Giri as a sole trader in the United Kingdom. This document is provided for transparency and does not constitute legal advice. It has not been reviewed or approved by a solicitor. Nothing in this document removes or limits your statutory rights as a consumer in the United Kingdom.
Ready for a clearer approval process?
Compare the seven ApproveTrail packages and choose the level that matches your reviewers, document volume and approval requirements.