Privacy Policy

This Privacy Policy explains how Meridian View Ltd handles personal data when you visit obnexo.com, request access to Obnexo, use the Obnexo Google Sheets add-on, or contact us for support.

1. Who we are

Obnexo is developed and operated by Meridian View Ltd. Meridian View Ltd is the controller of personal data used to operate the Obnexo website, access process, accounts, installations, security, and customer support.

• Company: Meridian View Ltd
• Company number: 16522958
• Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Privacy and support contact: support@obnexo.com

Where an accounting practice determines why and how personal data is used in its own workbook, that practice is normally the controller of that data. Meridian View Ltd processes the data needed to provide Obnexo on the practice's instructions.

2. Personal data we handle

Information provided by you or your practice

• Your work email address and practice details supplied during access or support requests
• Company numbers that your practice chooses to track
• Practice-controlled workbook data, including practice dates, actions, and other information entered into the Obnexo workflow
• Information you include when you contact us for support

Google account and Google Sheets data

• Your Google account email address, used to identify and authorise the add-on user
• The current spreadsheet and the Obnexo data it contains
• Spreadsheet and installation metadata, including the workbook identifier, template version, and connection state

Public Companies House information

When you request a refresh, Obnexo processes public Companies House information for the companies you have chosen to track. This includes company status, filing and deadline information and, where relevant to the compliance service, public registered-office or officer information. This public source information is kept distinct from dates and actions supplied by your practice.

Operational and security data

• Setup intent, setup-code generation, transactional email delivery, installation, replacement, and security audit records
• Technical and security data such as IP address, browser and device information, request timestamps, and server logs

Please do not enter special category personal data or other unnecessary personal information into Obnexo. We do not collect payment-card details through the current access flow.

3. How we collect personal data

We collect personal data:

• Directly from you when you request access, use the add-on, or contact support
• From the Obnexo add-on when it communicates with our service at your request
• From Companies House when you refresh public company and filing information
• Automatically through essential operational, security, and server logging

4. Why we use personal data

Our legitimate interests include operating a reliable service, preventing fraud and abuse, maintaining appropriate audit records, and supporting customers. We consider these interests against your rights and expectations.

5. Google user data

The Obnexo Google Sheets add-on requests limited access needed to work in the spreadsheet where you run it. The permissions presented by Google are the authoritative description of the access granted.

Data accessed

• Your Google account email address, to identify the authorised add-on user
• The current spreadsheet and its Obnexo workbook data
• The ability to display menus, dialogs, and status messages in that spreadsheet
• The ability to make secure requests to the Obnexo service

How the data is used

Google user data is used only to connect and validate the workbook, maintain the tracked-company list, request refreshes, and write the resulting company and obligation information back into the current spreadsheet. Obnexo does not use Google user data for advertising or to build advertising profiles.

How the data is stored

The workbook remains in your Google Drive. Obnexo stores only the account, installation, credential, company, refresh, and audit data required to operate and secure the service. Authentication credentials are protected and are not displayed in the workbook or sent in support communications.

How the data is shared

We do not sell Google user data. It is shared only with service providers acting for us where necessary to host, secure, and operate Obnexo, or where disclosure is required by law. We do not allow those providers to use it for their own advertising.

Obnexo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Setup requests and security checks

When you request access, we process your work email address, IP address, browser and request information, and the result of a Cloudflare Turnstile verification. Turnstile helps us distinguish legitimate requests from automated abuse.

We use this information to handle the request, prevent abuse, apply rate limits, investigate security incidents, and maintain appropriate operational and security records.

7. Service providers and data sharing

We use the following providers and sources where necessary to deliver Obnexo:

• Google: Google Sheets, Google Drive, Google account identity, and Apps Script add-on operation
• Cloudflare: Pages hosting, request handling, security controls, and Turnstile verification
• Postmark: transactional setup and operational email delivery
• DigitalOcean: application hosting and supporting production infrastructure
• Companies House: source of public company and filing information requested through Obnexo

We may also disclose personal data to professional advisers, regulators, courts, or law-enforcement bodies where necessary and lawful. Service providers may process data only for the agreed service and subject to appropriate contractual and security requirements.

8. International data transfers

Some providers may process personal data outside the United Kingdom. Where UK data protection law requires safeguards, we rely on an applicable adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, or another lawful transfer mechanism. You may contact us for more information about the safeguards relevant to your data.

9. Retention

We keep personal data only for as long as it is needed for the purpose for which it was collected, and to meet security, support, accounting, and legal requirements.

• A setup intent can normally be used for up to 24 hours. Expiry prevents the intent from being used after that period; it does not mean that the intent record or related operational records are automatically deleted after 24 hours
• Setup codes are short-lived and expire after the period stated in the setup process
• Account, installation, and workbook records are retained while the service or customer relationship remains active and for a reasonable period afterwards where needed for support, security, dispute resolution, or legal compliance
• Setup-intent, transactional delivery, refresh, audit, and security records may be retained beyond their validity period while reasonably required to operate, secure, troubleshoot, and demonstrate the integrity of the service
• Server and security logs are retained according to operational and provider retention settings

When personal data is no longer required, we delete or anonymise it unless the law requires us to keep it.

10. Cookies, local storage, and analytics

Obnexo does not currently use advertising cookies or a non-essential website analytics service. The website may use limited browser storage for essential display settings, and Cloudflare Turnstile may use cookies or similar technologies needed for security and abuse prevention.

If we introduce non-essential analytics or marketing technologies, we will update this policy and request consent where required.

11. Security

We use technical and organisational measures designed to protect personal data, including encrypted connections, restricted access, short-lived setup codes, credential revocation and replacement controls, rate limiting, security logging, and reputable infrastructure providers. No internet service can guarantee absolute security.

12. Your UK data protection rights

Depending on the circumstances, you may have the right to:

• Request access to your personal data
• Ask us to correct inaccurate or incomplete data
• Ask us to erase personal data
• Ask us to restrict processing
• Object to processing based on legitimate interests
• Receive certain data in a portable format
• Withdraw consent where processing relies on consent
• Complain to the Information Commissioner's Office

These rights are subject to legal conditions and exemptions. To make a request, email support@obnexo.com. We may need to verify your identity before responding.

13. Changes to this policy

We may update this Privacy Policy when the product, providers, or legal requirements change. We will publish the current version and its effective date on this page.

14. Contact us

For privacy questions, requests, or complaints, contact: