Privacy notice

Last updated 6 October 2026

What Dunny holds about you and your company, why, who else handles it and what you can ask us to do.

Who we are

Dunny is made and run by Murphee Limited, a company registered in England and Wales, number 15920043. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. In this notice "we" means Murphee Limited, and "Dunny" means this site, the app at app.dunny.life and the Dunny Companion browser add-on.

For anything about your personal information, write to privacy@dunny.life.

Whose records these are

Dunny holds two kinds of information, and the law treats them differently.

Your account: The details you give us so that you can sign in: your name, email address and password. We decide how these are used, so we are their controller.
Your company's records: Everything a company puts into Dunny or lets Dunny read: its documents, receipts, email, contacts and the rest. The company decides what goes in and what happens to it, so the company is the controller. We look after those records on the company's instructions, as its processor. Our terms set out what we promise when we do.

If your details are in a company's Dunny because you work with that company, receive its email or appear in its paperwork, ask that company first. It decides what happens to them, and we will help it answer you.

What we hold

About you, when you have an account

Your name and email address.
Your password, stored only in a scrambled form that we cannot read back.
The companies you belong to and the roles you have in each.
A record that you agreed to this notice and the terms: the version, the date and time, the internet address you agreed from and the type of browser you used.
Records of who did what and when, such as who approved a receipt or opened a vault entry. These never contain the secret itself.
If something goes wrong, a record of the error with the page it happened on and your account.

What a company keeps in Dunny

This depends on which parts of Dunny the company has turned on.

Company details: The company's name, number, addresses and business details, and its public Companies House record, which names its directors and the people with significant control.
People and roles: The names and email addresses of the people the company invites, their roles and who invited them.
Receipts and expenses: Dunny reads each connected mailbox to find receipts and invoices, and keeps a list of the messages it has looked at. Where a message looks like a receipt or an invoice, Dunny keeps the email and its attachments, what was read from them and every decision made about them. It does not keep the rest of the mailbox.
Accounts: Figures read from the company's FreeAgent account, to show them in plain words.
Relationships: The outside organisations the company deals with, the names and email addresses of contacts there, notes and follow-up dates. Dunny keeps the messages you write or send through it, with the message you were answering, and a record of each reply received: who it was from, its subject and when it arrived. Other email is read from your own mailbox when you look at it and is not kept.
Email marketing: The people the company emails: name, email address, organisation, country, the reason the company gives for being allowed to email them and its evidence. Also the messages sent, replies and bounces, and everyone who has unsubscribed.
Documents and compliance: The company's documents and their earlier versions, files it imports, who has confirmed reading what, and the answers, facts and evidence it records when preparing for a standard.
Strategy: Goals, priorities and the business structure, which can name people and what they own. The owner's private financial plan is encrypted and only the owner can open it.
Vaults: Codes, sign-in details and tax references that a person or company chooses to save. The contents are encrypted. The name and group of each entry are not, so that entries can be listed without unlocking the vault.
What Bruce remembers: Facts about the company that its owner has checked and asked Bruce to remember. Conversations with Bruce are not stored. They last until you reload the page, change company or sign out.

When you visit this site

This site sets no cookies, runs no scripts and loads nothing from anyone else. Like any web server, ours keeps a technical log of each request: the internet address it came from, the page asked for and the type of browser.

Why we hold it

To provide Dunny: We use your account details and your company's records to do what Dunny is for. The law calls this performing a contract: our terms with you and your company.
To keep Dunny safe and working: Error records, activity records, request logs and limits on repeated sign-in attempts help us find faults and stop misuse. We also keep the record that you agreed to this notice and the terms, so we can show that you did. We rely on our legitimate interests in running a secure service.
To meet the law: Where a law requires us to keep or hand over information, we do.

We do not sell personal information or use it for advertising, and we do not train AI models on it. What Bruce's AI service may do with the text it is sent is set out below. No decision with a legal or similar effect on a person is made by a machine alone.

Bruce and AI

Bruce is run by AI models. When you ask Bruce for something, the text needed to answer is sent to an AI service: your question, the page you are on, the draft you have open and the last few turns of the conversation. Depending on what you are working on, that can include the email you are replying to, the document you are writing, the text of your company's website, your answers in Compliance or, for the owner alone, their private plan.

The AI service is run by NVIDIA Corporation in the United States. NVIDIA uses the text to produce the answer. Its terms also allow it to keep the text to watch for misuse, and to use it to improve its own products, including AI models.

We are moving Bruce to a service that keeps nothing and trains on nothing. This notice will change when that is done.

Receipts are different. They are read by a model on our own server, and receipt emails and attachments are not sent to any outside AI service.

Bruce drafts. He does not save, send, file or delete. A person does those things, after checking.

Services you connect

Dunny works with accounts you already have. Each connection asks for only the permission its job needs, at the moment you use it.

Gmail and Microsoft 365: With your permission Dunny reads your mail to find receipts and invoices, files a receipt's email in a folder once the receipt is recorded, shows the email that goes with a relationship, sends the messages and campaigns you have approved, and reads or applies your email signature. Receipt processing never sends or deletes mail.
FreeAgent: Dunny reads the company's details, people, categories and account figures. It records an expense, with its receipt, when a bookkeeper approves it. When a person is given the expenses role, Dunny sets them up as a user in FreeAgent with their name and email address.
Companies House: Dunny reads the company's public record. If you turn on the Dunny Companion, it fills in an unchanged confirmation statement on the Companies House website in your own browser, using the sign-in details saved in your vault, one page at a time.

You can disconnect a service at any time. Dunny then discards its keys to that account and keeps the receipts and records it has already made. To withdraw the permission itself, remove Dunny in your Google, Microsoft or FreeAgent account.

Others who handle it for us

NVIDIA Corporation, United States: Runs the AI models behind Bruce, as described above.
Microsoft: Our own email runs on Microsoft 365. Sign-in codes, invitations and receipt summaries are sent through it, so Microsoft handles the address and content of those messages, and of anything you write to us.
Google: The app loads its typeface from Google Fonts, so Google sees your internet address when the app opens. This site does not.

Nobody else. Dunny has no advertising and no analytics. We would pass information to the police, a court or a regulator only where the law requires it.

Where it is kept

Dunny's database and files are kept on servers that we own and run in the United Kingdom.

Text sent to Bruce's AI service goes to the United States. Google and Microsoft may handle information outside the United Kingdom under their own terms with you.

How long we keep it

Your account and your company's records are kept for as long as the company uses Dunny. Turning a part of Dunny off hides its records and keeps them.
You can have your account and your company's records deleted at any time. See Deleting your account and data.
Receipts, including ones that were skipped or found to be duplicates, are kept as evidence until the company asks us to delete them.
Unsubscribes are kept so that the person is not emailed again.
Removing a vault entry destroys its contents. A record that the entry existed, and who removed it, stays.
A sign-in lasts 24 hours. An invitation lasts 14 days. A sign-in code lasts 15 minutes.
The sign-in the Dunny Companion uses for a filing is wiped when the filing is stopped or accepted, and after 15 minutes at the latest.
We take a copy of the database before each new release of Dunny. Deleted information can remain in those copies until they are removed.

Deleting your account and data

You can ask us to delete your account, and everything Dunny holds about you, at any time and at no charge.

How to do it

If you are a company's owner or an admin, open Company settings, then Account, and choose Delete my account. Dunny shows you what will be deleted before anything happens.

Your account is deleted 60 days later. We email you the date, and remind you a week before.
Changed your mind? Sign in before that date and choose Keep my account. While you wait, Dunny reads none of the accounts you connected.
Do not want to wait? Choose Delete now instead. It is deleted at once and cannot be brought back.

Anyone else, or anyone who cannot sign in, can email privacy@dunny.life from the address they sign in with. We delete the account within one month and confirm when it is done.

What is deleted

Your account: Your name, email address, password, roles, and your personal vault and private plan. You will no longer be able to sign in.
Your connected mailbox: Dunny's keys to your Gmail or Microsoft 365 account, and its list of the messages it has looked at. Dunny stops reading that mailbox at once. Nothing in the mailbox itself is deleted.
Your company's records: If you are the company's owner, deleting your account deletes the company and everything in it, and everyone else's access to it, including the emails, attachments and receipts Dunny took from connected Gmail and Microsoft 365 mailboxes. If you are not the owner, records you added to the company's work, such as receipts and documents, belong to the company and stay with it. Ask its owner, or ask us and we will pass your request on.

What is not deleted

Anything already in your own accounts elsewhere, such as expenses recorded in FreeAgent or email filed in your mailbox. Those are yours and stay where they are.
Copies of the database taken before a release, until those copies are removed.
Anything a law requires us to keep, for as long as it requires.

Withdrawing access without deleting

To stop Dunny reading a mailbox or FreeAgent without closing your account, disconnect it in Dunny. You can also remove Dunny's access yourself, at any time, in your Google Account, your Microsoft account or FreeAgent.

How it is protected

Each company's records are kept apart from every other company's.
People see only what their role allows. A mailbox is private to its owner unless they choose to share it.
Everything between your browser and Dunny travels encrypted.
Vault entries, the owner's private plan and Dunny's keys to the services you connect are encrypted in the database.
The vault is encrypted on our servers with keys that we hold, so that Dunny can use an entry when you ask it to. It is not a password manager that only you can open.

If we learn that personal information has been lost or seen by someone who should not have seen it, we will tell the company concerned without delay, and the Information Commissioner's Office and the people affected where the law requires.

Cookies and your browser

Neither this site nor the app sets cookies.

The app keeps your sign-in in the browser tab, where it is cleared when the tab closes. It keeps a few preferences in the browser's storage, such as whether the menu is collapsed and which tips you have dismissed. While you reset a password, it keeps your email address there so that you can finish. None of this is used to track you.

Your rights

You can ask us to:

give you a copy of the information we hold about you;
correct it;
delete it;
stop or limit what we do with it;
give it to you in a form you can take elsewhere.

Write to privacy@dunny.life. We will answer within one month and there is no charge. Where the information belongs to a company's records, we will pass your request to that company.

If you are unhappy with our answer, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

When what Dunny does with information changes, this notice changes with it and the date at the top moves. If a change matters to you, we will tell you by email or in Dunny before it takes effect.