Privacy Policy

The Nuvem9 Receivables Dashboard is operated by Nuvem9 Limited. We act as the data controller for account information and as a data processor for the financial data we display on behalf of client companies. For any privacy question, contact hello@nuvem9.co.uk.

The dashboard turns each client company's monthly receivables position into a visual executive snapshot — aged debt, cash collection, top debtors, action plan and commentary. Nuvem9 staff (admins) prepare and publish snapshots; each client user can only see the company they are assigned to.

• Account data: email address, display name, authentication identifiers and role assignment (admin, Nuvem9 staff or client).
• Financial snapshot data: aged-debt balances, DSO, top debtor lists, action plan items, monthly commentary and cash forecasts — supplied directly by Nuvem9 admins or synced from Xero.
• Xero integration data: when an admin connects a client's Xero organisation, we read invoices, contacts and aged-receivables reports using the OAuth scopes the admin approves. We never receive or store your Xero username or password.
• Operational data: standard server and access logs (timestamp, IP, request path) used to operate and secure the service.

We use the data above to:

• Render the dashboard and compute health scores and forecasts.
• Generate the branded PDF export.
• Authenticate users and enforce role-based access.
• Operate, secure and improve the service.

We do not sell your data, and we do not use it for advertising or third-party profiling.

• Lovable Cloud — hosting, managed database and authentication.
• Xero — only for the client organisations an admin explicitly connects, and only for the read-only accounting scopes approved at connection time.

We do not share client data with any other third parties.

Access is invite-only. Each user is assigned a role of admin, Nuvem9 staff or client. Nuvem9 staff can access all client dashboards and maintain invoice work without admin settings. Database row-level security restricts client users to the single company they are assigned to; clients cannot see other clients' data.

Snapshots and Xero connection records are retained for the duration of the client engagement. When a client is removed from the Admin area, the associated snapshots and Xero connection are deleted from the database. You can also request deletion at any time by emailing hello@nuvem9.co.uk.

Subject to applicable law (including UK GDPR), you have the right to access, correct, delete or export your personal data, to object to or restrict processing, to withdraw consent, and to lodge a complaint with a supervisory authority. To exercise any of these rights, contact hello@nuvem9.co.uk.

Admins can disconnect a client's Xero organisation at any time from the Admin page. Disconnecting revokes our stored access token and stops any further data being read from Xero.

The dashboard uses only essential cookies and equivalent storage required to keep you signed in and to complete the Xero connection flow. We do not use advertising or analytics cookies.

Data is transmitted over TLS and stored in a managed Postgres database. Access is gated by authentication, role checks and row-level security policies. Sensitive server credentials are kept server-side and are never exposed to the browser.

We may update this policy from time to time. When we do, we will update the "Last updated" date above. Material changes will also be communicated to admins directly.

Nuvem9 Limited · hello@nuvem9.co.uk