Privacy Policy
Last updated: 12 October 2026
Nexus KPI Limited, trading as Qashivo (“Qashivo”, “we”, “us” or “our”), is committed to protecting personal information and handling data responsibly, securely and transparently.
This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, request a demonstration, use our products or receive communications through our services.
Our technology products include:
- Qashivo — AI-powered credit-control software for small and medium-sized businesses (SMEs).
- Qonfirm — independent debt-verification technology for the Invoice Finance marketplace.
This policy applies to our customers, users, prospective customers, website visitors and individuals contacted through our services.
1. Who We Are
The organisation responsible for this Privacy Policy is:
Nexus KPI Limited, trading as Qashivo
Company number: 16170050
Registered office: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX
Website: https://www.qashivo.com
Email: hello@qashivo.com
For data-protection enquiries, please contact hello@qashivo.com.
Depending on the processing activity, Nexus KPI Limited may act as either a data controller or data processor.
We act as a data controller where we determine why and how personal information is processed, including information concerning website visitors, account holders, prospective customers, business contacts and certain internal business activities.
We generally act as a data processor when handling invoice, customer and debtor information on behalf of businesses or Invoice Finance providers using our services.
2. Information We Collect
Depending on how you interact with us, we may collect and process the following categories of information.
Contact information
Names, job titles, company names, business addresses, email addresses and telephone numbers.
Account information
Account registration details, user identifiers, authentication information, permissions, access history and preferences.
Business and financial information
Information relating to organisations, customers, debtors, invoices, sales ledgers, outstanding balances, payment records, credit-control activity, disputes and payment arrangements.
This may include personal information about individuals working for our customers' customers, sole traders and other business contacts.
Communications information
Emails, SMS messages, call records, voice recordings where enabled, transcripts, communication preferences, responses and support enquiries.
Website and technical information
IP addresses, browser types, device information, pages visited, referring websites, security logs and website usage information.
Marketing information
Business contact information, communication preferences, enquiries and relevant interaction history.
Investor information
Where individuals enquire about investment opportunities or access investor-related materials, we may collect names, contact details, investment interests and information required to manage those enquiries.
Where information is supplied by a business using Qashivo or Qonfirm, that organisation will generally determine the purposes for which the information is processed.
See Section 8 for further information about people contacted through our services.
3. How We Collect Information
We may obtain personal information:
- Directly from you when you contact us, complete a form or request a demonstration.
- From your employer or organisation.
- When you register for or use our services.
- Through accounting platforms and authorised integrations.
- From businesses using Qashivo to manage outstanding invoices.
- From Invoice Finance providers and their invited clients using Qonfirm.
- From communications and responses provided through our platforms.
- From publicly available and authorised business-information sources.
- Through website analytics and technical security systems, where applicable.
We may use Companies House information to confirm company identity, registration details and other relevant business information.
Where appropriately licensed, we may also use authorised commercial business-information services to validate information and support verification processes.
Where personal information has been obtained indirectly, the relevant controller is responsible for ensuring applicable transparency obligations are met. We support our customers in providing appropriate information to affected individuals.
4. How We Use Your Information
We may process personal information to:
- Provide, operate and maintain our website and services.
- Register, authenticate and manage users.
- Deliver Qashivo credit-control functionality.
- Deliver Qonfirm debt-verification functionality.
- Process invoice and ledger information.
- Manage debtor communications and responses.
- Record payment commitments, disputes and other outcomes.
- Generate operational reports, alerts and audit records.
- Respond to enquiries and arrange product demonstrations.
- Provide technical and customer support.
- Maintain security and investigate suspected fraud or misuse.
- Administer customer relationships and our business operations.
- Manage investor enquiries where applicable.
- Comply with legal, regulatory and contractual obligations.
- Send relevant marketing communications where permitted by law.
- Improve the performance, reliability and functionality of our services.
Product Improvement and Aggregated Information
We may derive aggregated and anonymised statistics from information processed through our services to understand product performance, improve workflows and develop our technology.
Where we act as controller for the anonymisation process, we may rely on our legitimate interests, subject to appropriate safeguards and any contractual restrictions.
Properly anonymised information will not identify an individual or business.
We do not use identifiable customer or debtor information for unrelated commercial purposes.
5. Our Lawful Bases for Processing
Where Nexus KPI Limited acts as a data controller, we process personal information only where an appropriate lawful basis applies.
These may include:
Contract
Where processing is necessary to enter into or perform a contract with you.
Legitimate interests
Where processing is necessary for legitimate business purposes, including service administration, security, product improvement and appropriate business communications, provided those interests are not overridden by individuals' rights.
Legal obligation
Where processing is necessary to comply with applicable legal or regulatory requirements.
Consent
Where consent is required, including certain marketing activities and non-essential cookies.
Where we act as a processor, the relevant customer or other controller is responsible for identifying the lawful basis for its processing activities.
The applicable lawful basis depends on the specific purpose and circumstances of the processing.
6. Qashivo — Credit Control for SMEs
Qashivo provides AI-powered credit-control technology to help SMEs manage outstanding invoices and customer communications.
Where a business uses Qashivo, personal information may be processed to:
- Identify outstanding invoices and overdue balances.
- Prioritise credit-control activity.
- Send payment reminders and follow-up communications.
- Contact customers through email, SMS and telephone.
- Capture responses and payment intentions.
- Record promises to pay and payment arrangements.
- Identify disputes and exceptions.
- Manage credit-control workflows and escalation processes.
- Provide cashflow and collections reporting.
The business using Qashivo will generally act as the data controller for its customer and debtor information.
Nexus KPI Limited generally processes that information on the business's behalf and according to its documented instructions.
Qashivo may use automated systems to perform routine communications, with human oversight for matters requiring individual judgement.
7. Qonfirm — Independent Debt Verification
Qonfirm provides independent debt-verification technology for Invoice Finance providers.
It enables lenders to select clients, debtors and invoices for verification and obtain structured results.
Personal information may be processed to:
- Validate business and debtor contact information.
- Send independent verification requests.
- Confirm invoice amounts and outstanding balances.
- Record debtor responses.
- Follow up with non-responders.
- Identify discrepancies, disputes and verification exceptions.
- Maintain evidence and audit trails.
- Produce client-level and portfolio-level reports.
Verification requests may be issued through an independent third-party auditor acting within the agreed service arrangements.
Qonfirm may also process account and contact information relating to staff at borrower businesses invited onto the platform by an Invoice Finance provider.
Depending on the contractual and operational arrangements, the relevant Invoice Finance provider, borrower or another organisation may act as data controller.
Nexus KPI Limited generally acts as a processor where handling information on that controller's instructions.
8. If You Have Received a Communication from Qashivo or Qonfirm
You may receive an email, SMS message or telephone call through Qashivo or Qonfirm even if you have never visited our website or registered for our services.
This section explains why.
Why Have I Been Contacted?
You may have been contacted because:
- A business you trade with uses Qashivo to manage its outstanding invoices and credit control; or
- An Invoice Finance provider uses Qonfirm to independently verify an invoice or outstanding balance.
The communication will generally identify the relevant business or provide sufficient information to understand the reason for contact.
Where Did You Obtain My Information?
Your details may have been obtained from the accounting records, sales ledger, customer records or other authorised information sources used by the relevant business.
Information may include:
- Your name and company.
- Your business email address or telephone number.
- Invoice references and outstanding amounts.
- Payment and communication history.
- Information relevant to invoice verification.
Who Controls My Information?
The business responsible for the invoice or the relevant Invoice Finance organisation will generally be the data controller, depending on the service and circumstances.
Qashivo normally acts as a processor carrying out instructions for that organisation.
The communication you receive should identify the relevant business. You may contact that organisation regarding the underlying invoice or your personal information.
You may also contact Qashivo at hello@qashivo.com, and we will help direct your enquiry appropriately.
How Might You Contact Me?
Communications may take place through:
- Email.
- SMS.
- Telephone.
- Automated messaging systems.
- AI-powered voice systems.
Some communications may be drafted, scheduled or sent automatically.
Where telephone calls are conducted by an AI voice agent, the recipient should be informed that they are interacting with an automated system.
Calls may be recorded or transcribed where enabled and lawfully permitted, with appropriate notice provided.
What Happens to My Response?
Your response may be recorded and shared with the relevant business or Invoice Finance provider.
For example, we may record that:
- An invoice has been paid.
- A payment date has been agreed.
- An amount is disputed.
- An invoice balance is confirmed.
- Further information is required.
- No response was received.
This information supports the organisation's credit-control, reconciliation or verification processes.
Can I Ask You to Stop Contacting Me?
You may request that communications stop through a particular channel, or raise an objection to processing where applicable.
We will handle these requests in accordance with the relevant controller's instructions and applicable legal obligations.
Stopping contact through one channel does not necessarily remove an underlying payment obligation or prevent communications that are otherwise legally permitted.
Can I Request Human Assistance?
Yes.
If you have concerns about an automated communication, you may request human assistance or ask for the matter to be reviewed by an appropriate person.
Contact hello@qashivo.com or the organisation identified in the communication.
How Long Is My Information Retained?
Communication records, verification evidence and associated information may be retained for the periods described in Section 12.
Your rights in relation to this information are explained in Section 16.
9. Automated Systems and Artificial Intelligence
Qashivo and Qonfirm use automation and artificial intelligence to support their services.
These technologies may:
- Identify and prioritise outstanding invoices.
- Determine appropriate communication timing and channels.
- Generate or schedule messages.
- Conduct AI-powered telephone calls.
- Analyse responses.
- Record payment commitments.
- Categorise verification outcomes.
- Identify exceptions.
- Recommend operational follow-up activity.
Automated Communication Decisions
Our systems may determine when, how and in what tone to follow up on outstanding invoices and may generate or send those communications.
For business customers, payment history, including whether agreed payments were made, may be used to determine appropriate follow-up activity.
This behavioural analysis is intended to be limited to business customers and must not be described as excluding individuals or sole traders until that exclusion is confirmed in the live system.
Automated communications may be reviewed or challenged by contacting the relevant business or Qashivo.
Human Oversight
Decisions having legal or similarly significant effects on individuals, such as referrals for legal proceedings, are subject to appropriate human oversight.
Our services are not intended to make such decisions solely through automated processing without the safeguards required by applicable law.
AI Voice Communications
Where AI voice agents are used, recipients should be informed that they are communicating with an AI system.
Where calls are recorded or transcribed, appropriate notification and legal safeguards must be implemented.
AI Model Training
Customer information processed through our AI integrations is intended to be used to provide contracted services, subject to the contractual arrangements with each provider.
Any statement that AI suppliers are prohibited from using customer data for model training must be confirmed against the applicable supplier agreements before publication.
10. Sharing Your Information
We may share personal information with trusted service providers where necessary to operate our business and services.
These may include:
- Neon — database infrastructure.
- Railway — application hosting.
- Anthropic — AI model services.
- Twilio SendGrid — email delivery.
- Vonage — SMS communications.
- Retell AI — AI voice services.
- Clerk — authentication.
- Stripe — payment processing.
- Xero and other accounting platforms — authorised accounting integrations.
- Cloudflare — website infrastructure.
- Cal.com — demonstration scheduling, where used.
The list must be checked against the live production environment before publication to confirm which providers actually process personal information.
We may also disclose information:
- To authorised customers and their designated users.
- To independent verification providers operating under appropriate agreements.
- To professional advisers.
- To regulators or public authorities where legally required.
- Where necessary to investigate suspected fraud or protect our legal rights.
- In connection with a lawful corporate transaction or restructuring.
We require appropriate contractual, confidentiality and security arrangements where applicable.
We do not sell personal information to advertisers or share it with data brokers.
11. International Data Transfers
Some of our service providers operate outside the United Kingdom.
Personal information may therefore be processed or accessed internationally where required to deliver our services.
Where restricted international transfers take place, we use an appropriate transfer mechanism under applicable data-protection law.
These may include:
- UK adequacy regulations.
- The UK Extension to the EU-US Data Privacy Framework, where the recipient has the necessary active certification.
- The UK International Data Transfer Agreement (IDTA).
- The UK Addendum to the EU Standard Contractual Clauses.
- Other lawful transfer mechanisms where applicable.
We assess relevant international transfers and implement safeguards appropriate to the circumstances.
Information about relevant transfer arrangements may be requested using the contact details in this policy.
12. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it is processed.
Retention periods depend on the information involved, our contractual obligations and applicable legal or regulatory requirements.
Communication Records and Verification Evidence
Communication histories, recorded verification responses, audit records and associated evidence may be retained for up to six years after the relevant customer relationship ends, where necessary for contractual, evidential, legal or regulatory purposes.
This proposed retention period must be confirmed against Qashivo's operational retention schedule before publication.
Account Information
Personal account data will normally be deleted or anonymised within 90 days of account closure, unless continued retention is necessary for lawful purposes.
This proposed deletion period must be confirmed against the live system's capabilities before publication.
Other Information
Website enquiries, marketing information and business administration records are retained only for as long as necessary for their respective purposes.
Where information is no longer required, we will delete, anonymise or securely dispose of it in accordance with applicable retention procedures.
Where information must be preserved for legal or evidential purposes, access may be restricted to authorised personnel.
13. Information Security
We use appropriate technical and organisational measures designed to protect personal information from unauthorised access, loss, alteration, misuse or disclosure.
These may include:
- Role-based access controls.
- Authentication and access management.
- Encryption where appropriate.
- Secure hosting infrastructure.
- Logging and monitoring.
- Data minimisation.
- Supplier security reviews.
- Appropriate retention and deletion processes.
- Internal security procedures.
We review security practices as our technology and operations develop.
No technology system can guarantee absolute security.
14. Cookies and Website Analytics
Our website may use technical mechanisms necessary for website operation, security and performance.
Where analytics or third-party integrations are used, we will provide information about the relevant technologies and obtain consent where required by applicable law.
The cookie section must be checked against the live website configuration before publication, including any booking embeds, analytics cookies or marketing pixels.
Visitors may also manage cookies through their browser settings.
Where required, an appropriate cookie-consent mechanism will be provided before non-essential technologies are activated.
15. Marketing Communications
We may send business-related marketing communications where permitted under applicable law.
We distinguish between corporate subscribers and individual subscribers, including sole traders and certain partnerships, where different marketing consent requirements may apply.
Where consent is required, we will obtain it before sending communications.
You may unsubscribe from marketing at any time by:
- Using the unsubscribe link provided in a marketing email.
- Contacting hello@qashivo.com.
Unsubscribing from marketing will not prevent necessary service-related communications where these are lawfully required or permitted.
16. Your Data Protection Rights
Depending on the circumstances and applicable law, you may have the right to:
- Request access to your personal information.
- Request correction of inaccurate information.
- Request erasure of your information.
- Request restriction of processing.
- Object to certain processing activities.
- Request portability of eligible information.
- Withdraw consent where processing relies on consent.
- Raise concerns about automated processing or decisions.
- Request human involvement where applicable.
These rights may be subject to lawful limitations or exemptions.
Where Nexus KPI Limited is a data processor, we may need to refer your request to the organisation acting as controller.
To make a request, contact:
We may need to verify your identity before processing a request.
17. Complaints
If you have concerns about our handling of personal information, please contact us at:
We will review your concerns and respond appropriately.
You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the United Kingdom's data-protection regulator.
Website: https://ico.org.uk
18. Children's Privacy
Our website and services are intended for businesses and professional users.
They are not designed for children.
We do not knowingly collect personal information directly from children through our website.
19. Third-Party Websites
Our website and services may contain links to third-party websites or platforms.
We are not responsible for the privacy practices of those organisations.
We recommend reviewing their privacy information before providing personal data.
20. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our services, technology, legal requirements or business operations.
The latest version will be published on our website with its effective date.
Where significant changes require additional notification, we will take appropriate steps to inform affected individuals.
21. Contact Us
For questions about this Privacy Policy or how your personal information is handled, please contact:
Nexus KPI Limited, trading as Qashivo
Company number: 16170050
Registered office: 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX
Email: hello@qashivo.com
Website: https://www.qashivo.com