Privacy notice

Who we are

ifatools.ai is built and run by Cervello Financial Planning. In this notice, "we", "us" and "our" mean Cervello Financial Planning. We are the controller of the personal information collected through this website and for your firm's ifatools.ai account, subscription and billing, which means we decide how and why it is used and we are responsible for looking after it.

Some of the information in your firm's account, such as team members' details, your firm profile and device records, we hold for your firm. For that information, your firm is the controller and we are its processor, as set out in our Data Processing Addendum.

The law that applies

We handle personal information in line with UK data protection law:

• the UK General Data Protection Regulation (UK GDPR)
• the Data Protection Act 2018
• the Privacy and Electronic Communications Regulations 2003 (PECR), which cover cookies and marketing emails

References to these laws include later changes to them, such as those made by the Data (Use and Access) Act 2025. The UK's data protection regulator is the Information Commission (formerly the ICO). It took over from the Information Commissioner's Office on 30 September 2026.

What we collect

• When you join the waiting list: your name, work email address and firm. If you choose to tell us, we also collect your role, how many advisers your firm has, which apps you're interested in and any note you add. We record that you agreed to be contacted, when you agreed, and which page of the site you joined from.
• When you book or request a demo: your name, firm, email address, the apps you're interested in and any note you add. When you book a time, we also keep the time you chose and your timezone, so we can show the time correctly.
• When you send us a message on the contact page: your name, email address, your firm if you give it, what your message is about, and the message itself.
• When you use any of these forms: your IP address and the type of browser you used, which we use only to protect the forms from spam and abuse.
• When your firm opens an account: the name and work email address of each person with an account login, your firm's name and billing details, and each person's password.
• When your firm subscribes and pays: the apps and number of seats you choose, your billing period, your invoices and a record of each payment. Payments are taken by Stripe. Your card details go straight to Stripe and never touch our servers.
• When someone uses the apps: each person signs in to your firm's ifatools.ai account in the app. To apply your seat and computer limits, we record each computer's name, a random device id, its operating system, the app version and when it was last seen. The apps check in with us at least every 14 days.
• When your firm adds its details: your firm can store its firm details, regulatory wording, team members' names, email addresses and roles, and logo and signature images in its account, so the apps can fill in their setup. We hold this for your firm, as its processor.
• When you visit the site: the web server keeps short-lived technical logs, such as IP addresses and the pages requested, to keep the site running and secure. Google Analytics measures how the site is used: with cookies if you allow them, and otherwise only through basic signals without cookies (see Cookies and analytics).

You don't have to give us any information. But we need your name, email address and firm to add you to the waiting list, and your name, email address and message to reply to you.

We don't ask for your clients' information, or for special category information (such as health details), on this website or in your account. Please don't include your clients' personal details, or any special category information, in a form, a message or your account.

Your clients' information

We don't hold your firm's client files. The apps process documents on your firm's computer and send them to the AI provider your firm chooses (Anthropic Claude or OpenAI ChatGPT), under your firm's own account. The meeting apps connect to Fireflies under your firm's own account. Your firm is the controller of its client data, and its arrangements with those providers are between your firm and them. Their own privacy notices explain how they handle the information they receive.

How we use it, and our lawful basis

Under UK GDPR Article 6, we must have a lawful basis for each way we use personal information:

Where we rely on legitimate interests, we've weighed our interests against your rights and freedoms, and you can object at any time. We don't make decisions about you based solely on automated processing, we don't profile you, and we never sell your information.

Emails and unsubscribing

In line with PECR, we only send waiting-list emails to people who have asked for them. Every one of those emails has an unsubscribe button at the bottom, and many mail apps also show their own "Unsubscribe" button. Unsubscribing takes effect straight away. We keep a note that you unsubscribed, so that we don't email you again by mistake.

You can also unsubscribe by emailing hello@ifatools.ai. If you'd like us to delete your details completely, just ask.

Cookies and analytics

The site uses a few essential cookies to make its forms and your account work and to remember your cookie choice. On the checkout and payment-method pages, Stripe also sets strictly necessary cookies to prevent fraud. These don't need consent. With your permission, it also uses Google Analytics cookies to understand how the site is used. We don't use advertising cookies. The site uses Google Consent Mode: until you choose, or if you choose Essential only, Google sets no cookies and receives only basic signals without cookies. You can change your mind at any time with Cookie settings at the bottom of every page.

Our cookie policy lists every cookie, what it does and how long it lasts.

Who we share it with

We only share personal information where we need to, and our service providers may only use it on our instructions (UK GDPR Article 28):

• A2 Hosting, our website host, which stores the website, its database (including your firm's account) and our email on our behalf.
• Stripe (Stripe Payments Europe Ltd), which takes subscription payments. Stripe receives your billing details and card details directly, and uses some information to prevent fraud. Stripe's privacy policy explains how it handles this information.
• Google Workspace which provides our email and calendar, including emails with you about your account.
• Google, which provides Google Analytics. Google receives basic signals about visits without cookies, and only uses analytics cookies if you allow them. We have switched off Google's advertising features and Google signals. Google's privacy policy explains how it handles this information.
• Google Workspace (Google Calendar), where booked demos go into our diary. The diary entry holds your name, firm, email address, the apps you're interested in and your note.
• Microsoft (Microsoft Teams), which hosts the demo call. Microsoft receives the meeting time and title, and, when you join, what Teams needs to run the call.
• Professional advisers, regulators or law enforcement, but only where the law requires it or where we need to establish, exercise or defend a legal claim.

We don't share your information with anyone for their own marketing.

Transfers outside the UK

Some of these providers, including Google and Stripe, may store or process information outside the UK. Where they do, we make sure the transfer is protected as UK GDPR Chapter V requires. That means the destination is covered by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework, for certified US companies), or the transfer uses an approved safeguard such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Waiting list: for as long as you're on the list and ifatools.ai is inviting new firms. If you unsubscribe, we stop emailing you and keep your details only as a record that you opted out, unless you ask us to delete them.
• Demo bookings, demo requests and messages: for as long as we need to deal with your enquiry and any follow-up, after which we delete them, including the diary entry.
• Your firm's account: while the account is open, and for up to 12 months after it closes, unless the law requires us to keep it longer.
• Device records: until the computer is signed out from your account, or the account closes.
• Invoices and payment records: for 6 years, as HMRC requires.
• Google Analytics: analytics cookies expire after 13 months, and Google Analytics keeps the usage data for up to 14 months.
• Security logs: the website's own logs are deleted automatically after 14 days. Our host's server logs follow its own retention periods.

How we protect it

We use appropriate technical and organisational measures to keep personal information secure (UK GDPR Article 32). These include encrypted connections, an admin area that only named members of our team can reach with their own passwords, card details handled only by Stripe, and limits that stop automated attacks on the forms and sign-in pages.

Your rights

Under the UK GDPR you have the right to:

• access the personal information we hold about you (Article 15)
• have information that is wrong or incomplete corrected (Article 16)
• have your information erased (Article 17)
• restrict how we use your information (Article 18)
• receive your information in a portable format (Article 20)
• object to how we use your information, including to direct marketing at any time (Article 21)
• not be subject to decisions based solely on automated processing (Article 22)
• withdraw your consent at any time, which doesn't affect anything we did before you withdrew it (Article 7(3))

If you have an ifatools.ai account, you can export your data and request deletion of your account from your account's Security page. We'll still keep invoices and payment records for as long as the law requires.

To use any of these rights, email hello@ifatools.ai or write to us at the address above. There's normally no charge. We'll reply within one month. If a request is complex, or you've made several, we may extend this by up to two further months, and we'll tell you why within the first month. We may ask you to confirm your identity before we act on a request.

Complaints

If you're unhappy with how we've handled your information, please contact us first so we can put it right. We'll acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commission (formerly the ICO), the UK's data protection regulator:

Children

ifatools.ai is for people who work at financial planning firms. It isn't intended for children, and we don't knowingly collect their information.

Changes to this notice

We'll update this notice if the way we handle personal information changes, or if the law changes. The date at the top shows when it was last updated.