Privacy Policy

Last updated 27 July 2026.

This notice explains what personal information NYAS collects when you use this website or get in touch, how we use it, and the rights you have over it. We keep it plain and honest.

Who we are

This site is run by NYAS Group Ltd (trading as Not Your Average Solutions), a company registered in England and Wales, company number 16146745. We are the data controller for the information described here.

We are registered with the Information Commissioner's Office (ICO), registration reference ZC200462.

For anything to do with your data, contact Hayley directly at hayley@nyas.co.uk. She reads every message herself.

The information we collect

Information you give us

When you fill in a form on this site (an enquiry, a call request, or a waitlist), or when you email or message us, we collect what you choose to send. That usually includes your name, email address, business name, business type, the department you want help with, and your message.

Information collected automatically

• Analytics: only if you accept analytics cookies, we use Google Analytics (loaded through Google Tag Manager) to see how the site is used, for example which pages are visited and roughly where visitors come from. Until you accept, these cookies are not set. See our Cookie policy.
• Server logs: our hosting provider records standard technical data such as your IP address and browser type, to keep the site secure and running. This is normal for any website.

How we use your information, and our lawful basis

We do not sell your data, and we do not make automated decisions about you that have legal or similarly significant effects.

Who we share it with

We only share your data with the providers we rely on to run the business, and only so they can act on our instructions. Each one is under contract to protect it.

• Supabase, who host our client portal database, logins and file storage.
• Vercel, who host and run our client portal software.
• Anthropic, who provide the AI models we use to analyse information and draft work. They do not train their models on our data.
• Google (Google Workspace for our email and document storage, and Google Analytics and Tag Manager for site analytics).
• Stripe, who process card payments. We never see or store your card details.
• Zapier, who send some of our automated emails.
• Xero, who hold our accounting and invoicing records.
• Hostinger, who host this website.

Some of these providers process data outside the UK. Where they do, we rely on the appropriate safeguards allowed under UK data protection law, such as the UK's adequacy decisions, the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses.

If you are a business client, ask us for our full Sub-processor List. It sets out for each provider what it does, what data it holds, where it processes it, and which safeguard applies.

If we carry out a Discovery and Audit for you

When you buy a Discovery and Audit, we collect more detail about how your business runs. That includes the names and roles of the people who work with you, how long tasks take them, and information from systems you give us read only access to.

For that information you are the data controller and we are the processor. We only handle it under a signed Data Processing Agreement, and only to produce your audit.

• We record and transcribe our calls so we capture your figures accurately rather than from memory. We ask out loud at the start of every call and you can say no, in which case we take written notes instead. Recordings and transcripts are analysed using AI and deleted twelve months after your audit is delivered.
• We do not ask for salaries. We ask what it would cost to pay someone else to do a piece of work. That is a market rate, not anyone's personal pay.
• We never ask for passwords. Access is granted by connecting an account, by adding us as a named collaborator, or by an access token you can revoke whenever you like. During an audit everything we ask for is read only.
• If you do not become a client, we remove all access we were given within 30 days of delivering your audit, and we log that we have done it.

Meetings and calls

When we meet you on a video call, the call may be transcribed and summarised automatically. Google Meet tells everyone on the call when that is happening, and produces a set of notes and a written transcript afterwards.

We keep a copy of those notes and that transcript, and we use them to write a summary of what was discussed, a list of what we agreed to do, and a running record of your account. Part of that summarising is done by an AI assistant, which reads the transcript and writes the summary. No decision about you is made by that assistant on its own, and nothing about you is used to train anybody's AI model.

Our lawful basis is legitimate interests: keeping an accurate record of what was agreed with clients and prospective clients, and being able to act on it. The call is one you chose to attend, you are told at the time that it is being transcribed, and the record covers only the business discussed.

The transcript is stored in our private Google Drive and in our own client portal, both restricted to our own login. Nobody outside NYAS Group Ltd sees it. If you would rather we did not transcribe a call, tell us before or during it and we will turn it off, or delete the transcript afterwards if one has already been made.

How long we keep it

• Enquiries that do not become clients: kept for up to 24 months from your last contact, then deleted.
• Client records: kept for the length of our work together, and afterwards for as long as we are required to keep financial records (usually six years, to meet HMRC rules).
• Analytics data: kept for the retention period set in Google Analytics.
• Audit records for businesses who do not become clients: deleted 12 months after the audit is delivered.
• Meeting notes and transcripts: deleted 12 months after the call, or 12 months after your audit is delivered where the call was part of one. The summary of what was agreed is kept with your client record.
• Access you granted us to your systems: revoked within 30 days if you do not proceed, and the revocation is logged.

Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct anything that is wrong;
• ask us to delete your data;
• ask us to restrict or stop using it;
• object to us using it, including for our legitimate interests;
• ask for your data in a portable format;
• withdraw your consent to analytics at any time, using the cookie controls on the site.

To use any of these, email hayley@nyas.co.uk. We will respond within one month.

Children

This site and our services are meant for businesses and are not aimed at anyone under 18. We do not knowingly collect data about children.

Changes to this notice

If we change how we handle your data, we will update this page and change the date at the top. Please check back from time to time.

Contact

NYAS Group Ltd, by email at hayley@nyas.co.uk.