Privacy notice
Last updated 26 October 2026.
This notice explains how Athri & Aurva Limited, trading as InterchangeGate ("InterchangeGate", "we") uses personal information about people who visit our website, contact us, or use our service on behalf of a business.
Who we are
InterchangeGate is a trading name of Athri & Aurva Limited, registered in England and Wales, company number 09585163. Registered office: 71 Engaine Drive, Shenley Church End, Milton Keynes, England, MK5 6BB. VAT number GB 217 8359 86.
We are the controller for the information described in this notice. Contact us about privacy at hello@interchangegate.com.
Documents we process for our customers
Our customers send business documents through our service, such as orders, invoices and delivery notes. These can contain names, addresses and contact details. For these documents we act as a processor on our customer's instructions, under a data processing agreement. If your details appear in such a document, the business that sent or received it is responsible for it, and you should contact them first. We use Claude (Anthropic) to help build and maintain the service and to help prepare mappings; it is one of the reasons our costs stay low. Customer data is anonymised wherever possible before any AI use, and model training is switched off. Anthropic is listed on our Sub-processors page, with the other companies that help us process these documents.
What we collect and why
| Who | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitors | Technical data needed to deliver pages securely (IP address, browser, pages requested) in server logs | To run and protect the website | Legitimate interests |
| People who contact us | Name, work email, company, reason, your message | To answer you and, if you ask, prepare a quote | Legitimate interests |
| Customer contacts | Name, work email, phone, job title, billing contact details | To provide the service, support and billing | Contract with your employer; legitimate interests |
| Portal users | Name, work email, login records, two-factor authentication settings, actions taken in the portal | To give secure access and keep an audit trail | Contract; legitimate interests (security) |
| Business contacts | Name and work email | To send occasional service news or updates, which you can stop at any time | Legitimate interests |
We do not use your information for automated decisions with legal effects, and we do not sell it.
Cookies and similar technologies
Our website uses only what is strictly necessary: remembering your light or dark theme choice in your browser, and the sign-in session for the portal. We do not use advertising or analytics cookies, or any other tracking, so we do not ask for cookie consent.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| ig-theme | Website and portal (browser storage, not a cookie) | Remembers your light or dark theme choice | Until you clear it |
| ig_theme | Website and portal | Remembers your light or dark theme choice, only once you change it | 1 year |
| ig_access | Portal | Keeps you signed in (strictly necessary) | 15 minutes |
| ig_refresh | Portal | Renews your sign-in (strictly necessary) | 7 days |
| ig_mfa | Portal | Links the password and two-factor steps of sign-in (strictly necessary) | 5 minutes |
| ig_trusted_device | Portal | "Remember this browser", only if you choose it | 30 days |
Who we share it with
We use trusted suppliers to run our business. They act on our instructions and are bound to protect your information.
| Supplier | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting the website, portal and service | UK (London) |
| Amazon Web Services | Sending and receiving email, file storage | UK (London) |
| hosting.com | Domain email and the website contact mailbox | United States (to be confirmed); transfers under the provider's data processing terms |
| Google (Gmail) | Mailbox where we read enquiries | Google; may include the United States |
We may also share information with our professional advisers and insurers, or where the law requires it.
International transfers
Our hosting and service run in the UK. Where a supplier processes information outside the UK, we rely on UK adequacy regulations or the ICO's international data transfer agreement or addendum to protect it.
How long we keep it
- Enquiries that don't lead to business: 2 years from our last contact.
- Customer and billing records: 6 years after the contract ends, for tax and legal reasons.
- Portal login and audit records: 12 months.
- Website server logs: 90 days.
Your rights
You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can object to updates or marketing at any time and we will stop. Email us at the address above; we reply within one month.
If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
We will update this notice when our practices change and show the date at the top.