Privacy notice
How Practice Portal handles personal data
Last updated 19 August 2026.
Who we are
Practice Portal is run by Chivvy Ltd, registered in England and Wales (company no. 17040454), registered office 71–75 Shelton Street, London WC2H 9JQ. Questions about this notice: portal@practiceportal.uk.
Two kinds of data, two roles
Firm accounts. When an accountancy firm signs up, we are the controller of the data about that firm and its staff: names, work email addresses, sign-in records, billing details (held by Stripe, not by us) and how the service is used. We use it to provide the service, to bill for it, to keep it secure and to tell you about it. The lawful basis is the contract with the firm and our legitimate interest in running the service.
Client data inside a firm's portal. The documents, messages, requests, dates, director details and anything else a firm or its clients put into the portal belong to the firm. For that data the firm is the controller and Chivvy Ltd is the processor: we hold it and act on the firm's instructions, and we do not use it for anything else. If you are a client of a firm and want to exercise your rights over that data, the firm is the right first contact; we will help them respond.
What we collect about clients who use a portal
To let a client open their portal we record the email address a code was sent to, the time, and a signed cookie on the device they used. We record when documents are viewed and when things are signed (name typed, time, IP address, browser) because that record is the point of a signature. We do not track clients across other websites.
Where data is held and who helps us
- Supabase — database, authentication and file storage, hosted in London (AWS eu-west-2). Each firm's data is separated by row-level security; files are private and reached only through short-lived signed links.
- Netlify — hosts the application.
- Brevo — sends the emails (codes, notifications, signed copies). We send the recipient's address, name and the message; nothing is used for marketing.
- Companies House — we read public company data by company number; nothing is sent to Companies House.
- Stripe — takes payment from firms. Card details never touch our systems.
How long we keep it
For as long as the firm has an account, plus a short period afterwards so a firm can come back or export. Signed documents and their certificates are kept for the firm for as long as its account exists, because they are evidence. One-time sign-in codes are deleted once used or expired. When a firm closes its account we delete its data within 30 days, except what we must keep for tax and accounting records.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, object to or restrict how we use it, and complain to the Information Commissioner's Office (ico.org.uk). Email portal@practiceportal.uk and we will reply within a month.
Cookies
The app uses only the cookies it needs to work: a session cookie for firm staff, a signed device cookie for a client who has entered their code, and a theme preference. This website sets none.
Changes
If this notice changes in a way that matters, firms will be told by email and the date at the top will change.