Skip to main content
Legal

Privacy Policy

Version 2.1 · Effective 17 October 2026 · IBIOS Limited (company number NI743167)

This policy explains how IBIOS Limited handles personal data. IBIOS Limited is a private limited company registered in Northern Ireland (company number NI743167), registered office 10 Ballyclare Road, Doagh, Ballyclare, Northern Ireland, BT39 0PE. We provide the IBIOS business software platform, marketed under the allforone.ai name ("IBIOS", "we", "us").

Contact for anything in this policy: hello@allforone.ai, or by post to the registered office above.

1. Our two roles

  • Controller. We decide how and why we use personal data about our business customers and their account users, people who visit this website, and people who contact us. This policy covers that data.
  • Processor. Our business customers ("Tenants") put data about their own customers, contacts and staff into IBIOS. For that data the Tenant is the controller and its own privacy notice applies; we act only on its instructions under our Data Processing Terms. If a business holds your data in IBIOS, please contact that business first. We will help it respond to you.

2. What we collect as controller

  • Account details: name, business name, email, phone number, role, and your password (stored only as a one-way hash).
  • Billing details: billing contact, address, VAT number and invoice history.
  • Usage and security data: sign-in records, IP address, browser and device type, feature usage, AI usage counts, and audit logs of changes made in the system.
  • Messages you send us: support requests and emails.
  • Waiting list: your name, business name, email, phone number (optional), sector, team size, the products you are interested in, how you heard of us, whether you are an investor, any referral code you used, and whether you asked for occasional news by email.
  • Referrals: when a business joins the waiting list through a referral link, we record the referred business's name and email domain, who referred it, and the referral's status, so we can check it and credit any reward.
  • Website analytics: this website uses a self-hosted, cookie-free analytics tool (Plausible) that counts page views without identifying you. We do not use advertising pixels or ad-tracking tags (such as Meta or Google Ads tags), we do not run paid advertising, and we do not share website visitor data with advertising platforms. See the Cookie Policy.

3. Why we use it and our lawful basis

  • Providing, running and supporting the service: contract.
  • Billing and keeping accounting records: contract and legal obligation.
  • Keeping the service secure, preventing fraud and enforcing the Acceptable Use Policy: legitimate interests.
  • Improving the service using aggregated or de-identified information: legitimate interests.
  • Service and security notices: contract and legal obligation.
  • Managing the waiting list and contacting you about early access: steps you asked us to take before a contract and legitimate interests.
  • Checking referrals and crediting referral rewards: legitimate interests, and contract with the referring customer.
  • Marketing to business contacts: legitimate interests or consent, always with an easy opt-out. For the waiting list, we only send news if you ticked the box when confirming your email.
  • Meeting legal requirements and responding to lawful requests from authorities: legal obligation.

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for that assessment.

4. Artificial intelligence

IBIOS uses AI models for tasks such as reading documents, drafting text, answering staff questions and transcribing audio. AI output can be wrong; see AI Use and Limitations. We do not make decisions about you that have legal or similarly significant effects by purely automated means.

The AI providers we use are listed on the Sub-processors page. We use them to process requests only. Their terms say they do not train their models on data sent through their business APIs by default.

5. Accounting connections (QuickBooks and Xero)

A Tenant can choose to connect IBIOS to its own QuickBooks Online or Xero account. When it does:

  • Authorisation. A Tenant administrator signs in to Intuit or Xero directly and approves access. We never see or store their accounting-system password.
  • What we store. We store the access and refresh tokens that Intuit or Xero issues, the connected company or organisation ID, and the date of connection. Tokens are encrypted at rest and are only used by our servers.
  • What we send. IBIOS sends the records the Tenant has switched on, such as: customer name, billing address, email and phone; invoice number (the IBIOS quote reference); invoice lines, amounts and VAT; and payments received, refunds, credits and write-offs against those invoices. Web-shop orders are only sent if the Tenant turns that on for that sales channel.
  • What we read back. Only what is needed to keep the two systems in step and avoid duplicates, such as invoice and payment status, IDs and VAT codes, and the Tenant's chart of accounts and item list for mapping.
  • Who controls the data. The accounting data belongs to the Tenant. Intuit or Xero holds it under the Tenant's own agreement with them. We act as the Tenant's processor when we send it.
  • Disconnecting. A Tenant administrator can disconnect at any time in IBIOS, and access can also be removed from the Intuit or Xero account. When a connection is ended we stop syncing, ask Intuit or Xero to revoke the tokens, and delete the stored tokens. Records already created in QuickBooks or Xero stay in the Tenant's account.
  • Logs. We keep a sync log (what was sent, when, and the result) for 12 months so problems can be traced and fixed.

6. Who we share data with

We use carefully chosen service providers ("sub-processors") for hosting, AI processing, notifications and network delivery. The current list, with what each does and where it processes data, is on the Sub-processors page. We do not sell personal data.

We may also share data where the law requires it, to protect our rights or the safety of others, or with a buyer if our business is sold (in which case this policy continues to apply).

7. Transfers outside the UK

Our production system is hosted in the UK. Some providers process data outside the UK, including in the United States (for example, the AI providers Groq and OpenAI) and the European Union. We do not claim that all processing stays in the UK.

When personal data leaves the UK we rely on one of these safeguards under UK data protection law: a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. The safeguard used for each provider is shown on the Sub-processors page.

8. How long we keep data

  • Account data: while the account is open, then 6 months.
  • Invoices, billing and accounting records: 6 years, as UK tax law requires.
  • Security and audit logs: 12 months, or longer if needed for an investigation or legal claim.
  • Support messages: 24 months.
  • Accounting-connection tokens: until the connection is ended, then deleted.
  • Accounting sync logs: 12 months.
  • Waiting-list entries: if not confirmed, 30 days after the confirmation email was sent; if confirmed, 6 months.
  • Referral records: 6 years if a reward was credited (an accounting record); otherwise 6 months after the referral was last updated.

For data we hold as a processor, the Tenant sets the retention period and the Data Processing Terms apply.

9. Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, to have it moved to another provider, and to withdraw consent where we rely on consent. We will normally respond within one month and will not usually charge.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to sort out any concern first.

10. Security

Our measures include encryption in transit (TLS); encryption at rest for stored secrets and integration tokens; separation of each Tenant's data, enforced in the database; role-based access with hashed passwords and expiring sessions; audit logs of changes; and regular backups. No system is perfectly secure, and we do not claim it is. If a personal data breach is likely to put you at risk, we will tell you and the ICO as the law requires.

11. Children

IBIOS is a business service and is not aimed at children. We do not knowingly collect children's data.

12. Changes to this policy

We will publish any change on this page with a new version number and date. If a change is significant, we will also tell account holders by email or in the app.

Change history

  • 2.1, 17 October 2026: Added the waiting list and referrals: what we collect, why, and how long we keep it. Stated that we use no advertising pixels or ad-tracking tags.
  • 2.0, 16 October 2026: Rewritten. The provider is now correctly named as IBIOS Limited (NI743167). Added the QuickBooks and Xero section, a link to the public sub-processor list, and an honest statement about transfers outside the UK. Removed earlier wording that all data stays in the UK.
  • 1.0: First version.