TLA X-MCP Privacy Notice

Last updated: 5 November 2026

1. About this notice

TLA X-MCP is an internal application operated by Trayler Lane Accountancy Limited(“Trayler Lane”, “we”, “us” or “our”).

TLA X-MCP connects authorised Microsoft 365 services used by Trayler Lane with Xero in order to allow authorised users to access and analyse accounting information as part of the provision and administration of accountancy and related professional services.

This notice explains how information may be processed when TLA X-MCP is used.

2. What the application does

TLA X-MCP provides an authorised connection between Microsoft 365 and Xero.

The integration may enable authorised Trayler Lane users to retrieve and analyse accounting information held within an authorised Xero organisation.

Access to Xero is provided using Xero’s OAuth 2.0 authorisation process. OAuth allows an application to receive authorised access to Xero data without requiring the user’s Xero password to be shared with the application. Xero confirms that third-party integrations require the user to authorise the connection. [developer.xero.com], [central.xero.com]

3. Information that may be processed

Depending on the permissions granted to TLA X-MCP and the information contained within the connected Xero organisation, information processed may include:

• accounting transactions;

• invoices and credit notes;

• payments;

• bank transactions;

• manual journals;

• accounting reports;

• customer and supplier information;

• names, email addresses and other contact information contained within accounting records;

• financial information associated with clients, customers, suppliers or other parties;

• Xero organisation and user identifiers; and

• information necessary to authenticate and maintain the authorised connection.

The application is intended to request only the Xero permissions reasonably required for its authorised functions.

4. How we use the information

Information accessed through TLA X-MCP may be used for legitimate accountancy and business purposes including:

• preparing and reviewing accounting records;

• financial analysis and reconciliations;

• preparing management information;

• reviewing VAT and tax-related information;

• investigating accounting balances and transactions;

• preparing reports and working papers;

• assisting with client service delivery; and

• improving the efficiency of Trayler Lane’s internal accounting workflows.

TLA X-MCP is not intended to use client accounting information to train or fine-tune artificial intelligence models.

5. Xero access

TLA X-MCP accesses Xero only after an authorised user has granted the relevant permissions.

Xero’s OAuth process issues access credentials following authorisation, rather than requiring the user’s Xero password to be provided to the connected application. [developer.xero.com], [developer.xero.com]

Access may be revoked through the relevant Xero connected-app controls.

6. Microsoft 365

TLA X-MCP is designed to operate with Microsoft 365 services used by Trayler Lane.

Information retrieved from Xero may therefore be processed through Microsoft’s services when authorised users use the application.

Microsoft applies its own contractual privacy and security terms to customer data processed through its online services. [microsoft.com]

7. Security and access controls

Trayler Lane takes reasonable technical and organisational measures to protect information processed through TLA X-MCP.

Access is intended to be limited to authorised users and authorised Xero organisations.

Credentials, authentication tokens and other security information should not be disclosed to unauthorised persons.

8. Data retention

Information accessed through TLA X-MCP will be retained only where necessary for legitimate business, professional, legal, regulatory or record-keeping purposes.

Information already held within Xero or Microsoft 365 remains subject to the retention arrangements applying to those systems and to Trayler Lane’s applicable data-retention procedures.

9. Data protection rights

Individuals may have rights under applicable data protection legislation in relation to their personal information, including rights of access, correction, erasure, restriction and objection, depending on the circumstances.

UK GDPR requires organisations processing personal data to be able to demonstrate compliance and incorporates rights relating to access, correction and erasure. [xero.com], [xero.com]

10. Third-party services

TLA X-MCP interacts with services provided by:

• Xero; and

• Microsoft.

Those organisations operate under their own applicable privacy, security and contractual arrangements.

11. Contact

Questions about this privacy notice or the use of personal information through TLA X-MCP should be directed to:

Elementor #2118

TLA X-MCP Privacy Notice