1. Who we are
Twelve Trees Consulting and Clearli are run by K. H. Cheung, a sole trader in the United Kingdom ("we", "us"). For anything about your personal data, email privacy@12treesconsulting.com.
This policy covers this website, our calls and client work, and the tools we build and run, including Veri and Clearli.
2. Our two roles
When we decide how data is used, for example your enquiry, our client contacts, or accounts on our tools, we are the controller under the UK GDPR. For personal data from Hong Kong, we also follow Hong Kong's Personal Data (Privacy) Ordinance.
When we handle data for a client, such as the documents and records a client puts into a tool we run for them, the client decides how that data is used and we process it on their instructions under a written agreement. In Clearli, for example, the person keeping the books decides what is recorded about their partners. If your data reached us that way, the client is the best first contact; we will help them answer you.
3. What we collect
Visiting this website. We set no cookies and use no analytics or advertising. Your browser remembers your language choice. Our hosting provider records technical details such as your IP address and browser to keep the site running and secure, and the fonts load from Google, which receives your IP address.
Booking or having a call. Calendly collects your name, email address and any answers you give when booking. We keep notes of what you tell us.
Working with us. Names, job titles, email addresses and phone numbers of the people we deal with, billing details, and the materials you share with us, which may include personal data about your staff, customers or suppliers.
Using Veri. Your email address, company name, name and WeChat ID if you give them, your role and permissions, and the IP address you sign up from. The documents you upload, such as receipts, invoices and PDFs, and what is read from them: stores, dates, amounts, items and reference numbers. A record of who uploaded, changed, confirmed, exported or deleted what, and when. Signing in uses essential cookies.
Using Clearli. Your name, email address, company, phone number if you give it, and your password, which is stored only in hashed form and cannot be read back. The receipts, invoices and transfer screenshots you upload and what is read from them, which can include stores, items, amounts, VAT, currencies, dates, transaction numbers, the last four digits of a payment card, and the receiving account's number, sort code or IBAN. If you allow photo access, the date a photo was taken and whether it is a screenshot, a camera photo or an image saved from WeChat. Comments you add, who uploaded and confirmed each entry, and a device token so we can send you notifications.
To run Clearli and bill for it, we also keep when you were last active, how many documents were read each month, and the time, IP address and browser when you accept our terms. If you pay by card, Stripe handles your card and billing details (see section 6). Clearli does not collect your location or contacts and contains no advertising or third-party analytics code.
4. How we use it
- To reply to you and hold the calls you book.
- To prepare proposals and agreements, do the work, and run and support the tools.
- To invoice and take payment, including counting the documents read each month against a Clearli plan, and to keep the accounting records the law requires.
- To keep our services secure and prevent misuse, for example by limiting sign-ups from one IP address and reviewing new Veri accounts before they open.
- To meet our legal obligations.
We do not sell personal data, use it for advertising, or use it to train AI models. To read screenshots more accurately, Clearli keeps a short note when someone corrects how a transfer screenshot was classified, for example which payment app's screen it was, and uses these notes for all users. The notes describe how a screen looks; they contain no names, amounts or account details.
Our legal bases under the UK GDPR are: performing a contract with you or your employer; our legitimate interests in running, improving and securing our business and replying to enquiries; legal obligations; and your consent where we ask for it, which you can withdraw at any time.
5. AI reading of documents
To read documents automatically, Veri and Clearli send the images and files you upload to Anthropic's Claude API. The fields it finds are stored with the original, so a person can check one against the other. Under its commercial terms, Anthropic does not use this content to train its models and keeps it only for a limited time. In Clearli you can skip automatic reading and type the details in yourself.
6. Who we share it with
We share personal data only with the service providers below, which handle it for us under contract; with our professional advisers, in confidence; and with authorities when the law requires.
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting for this website and Veri | United States and other regions |
| Website fonts; our email | United States and other regions | |
| Calendly | Booking calls | United States |
| Supabase | Veri's database, file storage and sign-in | United Kingdom |
| Anthropic | AI reading of documents in Veri and Clearli | United States |
| Railway | Clearli's servers, database and file storage | Netherlands (EU) |
| Cloudflare | Daily backups of Clearli's database and uploaded documents | United States and other regions |
| Stripe | Card payments and subscriptions for Clearli: name, email, billing address, and company name and VAT number if given. Card numbers go straight to Stripe; we see only the card brand and last four digits | United Kingdom, EU and United States |
| Revolut | Our business bank account, which receives bank transfers and Stripe payouts | United Kingdom and EU |
| ImprovMX | Forwarding email sent to our business addresses to our mailbox | United States and other regions |
| Apple | Notifications in Clearli | United States |
| Telegram | Alerts to us when someone signs up for Veri: email, company, WeChat ID if given, IP address | Several regions outside the UK |
7. Data sent to other countries
As the table shows, some providers process data outside the UK. We choose providers with strong security and bind them by contract. Transfers of personal data from the UK rely on UK adequacy regulations or on the UK's approved contract terms (the International Data Transfer Agreement or Addendum).
8. How long we keep it
- Enquiries and call notes that do not lead to work: up to 12 months after we last spoke.
- Agreements, invoices and accounting records: as long as UK tax law requires, currently at least five years after the 31 January filing deadline for the tax year they relate to.
- Data in a tool we run for a client: for as long as the service runs. When it ends, we return the data to the client and then delete it, as the client's agreement sets out.
- Items deleted in Veri or Clearli can be restored for 30 days.
- If you close a Clearli account, we remove your sign-in details. Records both sides have already confirmed may be kept so the accounts stay complete, without your name attached.
- Clearli's database backups are kept for 30 days. Backup copies of uploaded documents are kept so records can be restored; when a Clearli account closes, or you ask us to delete documents, we delete the backup copies too.
- Copies in our providers' own backups are removed as those backups expire.
9. Keeping it secure
- All traffic is encrypted (HTTPS).
- Each customer sees only their own data: in Veri this is enforced in the database itself, and in Clearli on the server for every request.
- Uploaded documents are never public; they open only through signed links that expire, within an hour in Veri and within a day in Clearli.
- Passwords are stored only in hashed form, and sign-in attempts are limited.
- Administrative access is limited to us.
If a breach affects your data, we will tell the clients concerned promptly, and notify regulators and the people affected where the law requires.
10. Your rights
You can ask for a copy of the personal data we hold about you, and ask us to correct or delete it, to restrict or object to how we use it, or to send it to you or another organisation in a portable form. We reply within one month.
Email privacy@12treesconsulting.com. If you are unhappy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk). If you are in Hong Kong, you can also complain to the Privacy Commissioner for Personal Data (pcpd.org.hk).
11. Other points
Direct marketing. We will not use your personal data for direct marketing without your consent, and you can opt out at any time.
Children. Our services are for businesses and are not meant for anyone under 18.
12. Changes
When this policy changes, we update the date at the top of the page. We tell clients directly about significant changes.
13. Contact
一、我们是谁
Twelve Trees Consulting 和 Clearli 由英国个体经营者 K. H. Cheung 经营（下称“我们”）。有关个人资料的任何问题，请发邮件至 privacy@12treesconsulting.com。
本政策适用于本网站、我们的咨询通话和客户项目，以及我们开发和运行的工具，包括 Veri 和 Clearli。
二、我们的两种身份
由我们决定资料用途时，例如你的咨询、客户联系人资料、工具的账号资料，我们是英国 GDPR 下的控制者；来自香港的个人资料，我们也遵守香港《个人资料（私隐）条例》。
代客户处理资料时，例如客户放进我们所运行工具里的单据和记录，资料怎么用由客户决定，我们按书面协议和客户的指示处理。比如在 Clearli 里，记什么关于合作方的内容，由记账的人决定。如果你的资料是这样到了我们手上，建议先联系该客户，我们会协助对方答复你。
三、我们收集哪些资料
浏览本网站。我们不设 Cookie，也不使用任何分析或广告工具。你选的语言保存在你自己的浏览器里。网站托管服务商会记录 IP 地址、浏览器类型等技术信息，用于维持网站运行和安全；网页字体从 Google 加载，Google 因此会收到你的 IP 地址。
预约或进行通话。通过 Calendly 预约时，Calendly 会收集你的姓名、邮箱和你填写的回答。通话中你告诉我们的内容，我们会记下笔记。
与我们合作。对接人员的姓名、职位、邮箱和电话，账单资料，以及你交给我们的材料。这些材料里可能有你的员工、客户或供应商的个人资料。
使用 Veri。你的邮箱、公司名称、姓名和微信号（如有提供）、你的角色与权限，以及注册时的 IP 地址；你上传的收据、发票、PDF 等单据，和从中识别出的商户、日期、金额、商品明细与单号；谁在什么时间上传、修改、确认、导出或删除了哪些内容的记录。登录功能需要使用必要的 Cookie。
使用 Clearli。你的姓名、邮箱、公司、电话（如有提供）和密码，密码只保存经过哈希处理的形式，无法还原；你上传的收据、发票和转账截图，以及从中识别出的内容，可能包括商户、商品、金额、VAT、币种、日期、交易编号、银行卡号末四位，以及收款账户的账号、Sort Code 或 IBAN；如果你允许读取相册，还有照片的拍摄时间，以及它是截图、相机拍的还是从微信存下来的；你留下的备注，每笔是谁上传、谁确认的，以及用来给你发送通知的设备标识。
为了运行 Clearli 和收费，我们还会记下你最近一次使用的时间、每月识别了多少张单据，以及你同意条款时的时间、IP 地址和浏览器。刷卡付款时，卡和账单资料由 Stripe 处理（见第六节）。Clearli 不收集你的位置或通讯录，也没有任何广告或第三方分析代码。
四、资料用途
- 回复你的咨询，安排你预约的通话。
- 准备方案和协议，完成项目，运行和维护工具。
- 开具发票和收款，包括按 Clearli 套餐统计每月识别的单据张数，以及按法律要求保存会计记录。
- 保障服务安全、防止滥用，例如限制同一 IP 地址的注册次数，新的 Veri 账号经审核后才开通。
- 履行法律义务。
我们不出售个人资料，不拿来做广告，也不用来训练 AI 模型。为了把截图认得更准，有人改正转账截图的类型时（比如是哪个支付软件的界面），Clearli 会记下一句简短的说明，供所有用户的识别参考。这些说明只描述界面长什么样，不含姓名、金额或账户资料。
按英国 GDPR，我们处理资料的法律依据是：履行与你或你的雇主之间的合同；经营、改进业务和保障安全、回复咨询的正当利益；法律义务；以及我们征求时你给予的同意，你可以随时撤回。
五、用 AI 识别单据
为了自动读取单据，Veri 和 Clearli 会把你上传的图片和文件发送到 Anthropic 的 Claude API。识别出的字段和原件一起保存，方便人工对照核查。按照 Anthropic 的商业条款，这些内容不会用来训练它的模型，也只保留有限的时间。在 Clearli 里，你可以跳过自动识别，自己填写。
六、与谁共享
我们只与下列服务商共享个人资料，它们按合同代我们处理；此外会在保密前提下提供给我们的专业顾问，或在法律要求时提供给有关当局。
| 服务商 | 用途 | 处理地点 |
|---|---|---|
| Vercel | 托管本网站和 Veri | 美国及其他地区 |
| 网站字体；我们的电子邮件 | 美国及其他地区 | |
| Calendly | 预约通话 | 美国 |
| Supabase | Veri 的数据库、文件存储和登录 | 英国 |
| Anthropic | Veri 和 Clearli 的 AI 单据识别 | 美国 |
| Railway | Clearli 的服务器、数据库和文件存储 | 荷兰（欧盟） |
| Cloudflare | Clearli 数据库和上传单据的每日备份 | 美国及其他地区 |
| Stripe | Clearli 的刷卡付款和订阅：姓名、邮箱、账单地址，以及公司名和 VAT 号（如有填写）。卡号直接交给 Stripe，我们只看得到卡的类型和末四位 | 英国、欧盟和美国 |
| Revolut | 我们的商业银行账户，接收银行转账和 Stripe 打款 | 英国和欧盟 |
| ImprovMX | 把寄到我们商业邮箱的邮件转到我们的信箱 | 美国及其他地区 |
| Apple | Clearli 的推送通知 | 美国 |
| Telegram | 有人注册 Veri 时通知我们，内容包括邮箱、公司、微信号（如有）和 IP 地址 | 英国以外的多个地区 |
七、跨境传输
如上表所示，部分服务商在英国以外处理资料。我们选择安全措施完善的服务商，并以合同约束。从英国传出的个人资料，依据英国的充分性认定，或英国认可的合同条款（国际数据传输协议或附录）。
八、保存期限
- 没有促成合作的咨询和通话笔记：最后一次联系后最多保留 12 个月。
- 协议、发票和会计记录：按英国税法要求保存，目前是相关税年报税截止日（1 月 31 日）之后至少五年。
- 我们为客户运行的工具里的资料：服务期间一直保留；服务结束后，按客户协议的约定交还客户，然后删除。
- 在 Veri 或 Clearli 里删除的内容，30 天内可以恢复。
- 注销 Clearli 账号后，我们会删除你的登录资料。双方已确认的记录可能继续保留，以保持账目完整，但不再与你的身份关联。
- Clearli 的数据库备份保留 30 天。上传单据的备份副本会留着，以便恢复记录；Clearli 账号注销，或你要求删除单据时，备份副本也一并删除。
- 服务商自己备份里的副本，随备份到期删除。
九、安全措施
- 所有传输都经 HTTPS 加密。
- 每位客户只能看到自己的资料：Veri 由数据库本身强制执行，Clearli 由服务器在每次请求时把关。
- 上传的单据从不公开，只能通过会失效的签名链接打开：Veri 一小时内失效，Clearli 一天内失效。
- 密码只保存哈希值，登录尝试次数设有上限。
- 管理权限仅限我们自己。
如果发生涉及你资料的泄露事件，我们会尽快通知相关客户，并在法律要求时通知监管机构和当事人。
十、你的权利
你可以要求查阅我们持有的你的个人资料，也可以要求更正或删除、限制或反对某项处理，或以可携带的格式把资料交给你或其他机构。我们会在一个月内答复。
请发邮件至 privacy@12treesconsulting.com。如对答复不满意，可以向英国信息专员办公室（ico.org.uk）投诉；你在香港的话，也可以向香港个人资料私隐专员公署（pcpd.org.hk）投诉。
十一、其他
直接促销。未经你同意，我们不会把你的个人资料用于直接促销；你可以随时要求停止。
未成年人。我们的服务面向企业，不适用于 18 岁以下人士。
十二、政策更新
本政策如有修改，我们会更新页首的日期。重大修改会直接通知客户。