Privacy Notice

1. Who we are

Bowraven Limited, a company registered in England and Wales, trading as AcquiLens, is the data controller for the personal data described in this notice. That means we decide why and how your personal data is used. You can contact us about privacy at privacy@acquilens.com.

2. What we collect and why

• Account data (name, email address, login credentials or Google sign-in identifier) — to create and secure your account and let you sign in. Legal basis: performance of our contract with you.
• Contact and address details (first and last name, email, postal address, phone number) — to prepare your assessment summary and documents such as an NDA or correspondence with a seller where you choose to proceed. Legal basis: performance of our contract with you.
• Assessment content (information you enter about a target business and its seller, uploaded documents, notes and recorded decisions) — to generate and store your assessments. Legal basis: performance of our contract with you.
• Disclaimer and consent records (acceptance status, date and time, version, user identity) — to evidence that terms and disclaimers were accepted. Legal basis: legal obligation and our legitimate interest in keeping accurate records.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting our customers.
• Usage, telemetry and device data (pages visited, feature usage, device and browser type, IP address, error logs) — to keep the service secure, prevent fraud and abuse, diagnose problems and improve the product. Legal basis: legitimate interests in security and service improvement.
• Marketing preferences — if you opt in, to send you product updates. Legal basis: consent, which you can withdraw at any time.

Please only enter information about a seller or third party that you are entitled to share, and avoid entering special category data (such as health or ethnicity information).

3. Automated analysis

To produce your assessment we send relevant answers and documents to trusted AI processing providers acting on our instructions. These providers process the content to generate analysis and are contractually prevented from using it to train their own models. No decision with a legal or similarly significant effect on you is made solely by automated means — the assessment is guidance for you to act on.

4. Who we share data with

• Service providers and subprocessors who host our infrastructure and database, provide authentication, AI analysis, error monitoring and customer support tooling.
• Paddle, our Merchant of Record, for the sale of subscriptions, subscription management, payments, tax compliance and invoicing. Paddle acts as a controller for the payment data it collects directly from you.
• Professional advisers such as our accountants and lawyers, where necessary.
• Authorities, regulators or law enforcement where we are legally required to disclose data.
• A buyer or successor, if our business is reorganised, merged or acquired.

We do not sell your personal data.

5. International transfers

Some of our providers are located outside the UK and EEA, including in the United States. Where personal data is transferred outside the UK/EEA we rely on an adequacy decision where one applies, or on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses together with appropriate additional safeguards.

6. How long we keep it

We keep your account, contact and assessment data for as long as your account is active and for up to 12 months after you close it, so you can reactivate or export your work. Records needed for tax, accounting and legal purposes (including consent and disclaimer records) are kept for up to 7 years. Security and error logs are typically kept for up to 12 months. When data is no longer needed it is deleted or anonymised.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, row-level access controls so users can only reach their own records, private document storage, least-privilege access for staff, and monitoring for unusual activity. No system is completely secure, but we take these obligations seriously and will notify you and the ICO where required if a breach occurs.

8. Cookies

We use essential cookies and similar local storage to keep you signed in, maintain your session and protect against abuse — these are required for the service to work. Our checkout provider Paddle sets cookies necessary to process payments and detect fraud. Where we use analytics or marketing cookies we ask for your consent first, and you can change or withdraw it at any time through your browser settings or by contacting us.

9. Your rights

Under UK and EU data protection law you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing, including profiling based on legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time where we rely on consent;
• complain to a supervisory authority.

To exercise any of these rights, email privacy@acquilens.com. We will respond within one month. If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.

10. Changes to this notice

We may update this notice from time to time. The current version is always published here with the date it was last updated.