1. Who We Are
SFTWARES LTD ("we", "us", "our") operates Invoice4You — a cloud-based invoicing application available in your web browser at app.invoice4you.app (native mobile apps are in development).
We are the data controller for personal data you provide to us.
2. Data We Collect
Account Data
- Full name, email address, password (stored as a secure hash — never in plain text)
- Business type (sole trader, limited company, etc.)
Business & Company Data
- Company name, address, phone number, email
- Bank account details (bank name, sort code, account number) — used for payment details on invoices
- VAT number, VAT scheme, flat rate percentage
- UTR (Unique Taxpayer Reference) number
- Company registration number
Invoice, Client & Quote Data
- Client names, email addresses, phone numbers, postal addresses
- Invoice amounts, line items, due dates, payment status, notes
- Quote values and proposal details
- Expense records and receipts
Usage & Diagnostic Data
- App interactions, device type, operating system version
- Error logs and crash reports (retained for 90 days)
3. How We Use Your Data
| Purpose | Data used |
|---|---|
| Providing the Invoice4You service | Account, business, invoice, client data |
| Sending invoices and reminders by email | Client email, invoice details, company details |
| Account security and authentication | Email, hashed password, session tokens |
| Customer support | Account data, error logs |
| Improving the service | Anonymised usage statistics |
We do not use your data for advertising, behavioural profiling, or selling to third parties.
4. Legal Basis for Processing
| Processing activity | Legal basis |
|---|---|
| Providing the service you signed up for | Contract performance (UK GDPR Art. 6(1)(b)) |
| Sending marketing communications | Consent (UK GDPR Art. 6(1)(a)) |
| Diagnosing errors and improving the service | Legitimate interests (UK GDPR Art. 6(1)(f)) |
5. Data Sharing & Third Parties
We share data only as necessary to provide the service:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase (database & auth) | Hosting your account, invoices, and company data | All user data (encrypted at rest, EU region) |
| Resend | Sending transactional emails (invoices, reminders) | Client email address, invoice content |
| Apple / Google (mobile stores) | App distribution (when the mobile apps launch) | None — they process their own analytics separately |
We never sell your data. Data may be disclosed to law enforcement or courts if required by a valid legal obligation.
6. HMRC Making Tax Digital
Invoice4You is building support for HMRC's Making Tax Digital programme. These features are not yet available, and we do not currently transmit any data to HMRC. Before MTD features launch, this policy will be updated to describe exactly what is sent to HMRC, the fraud-prevention data HMRC's specification requires, and how HMRC tokens are protected.
7. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Retained while active + 30 days after deletion request |
| Invoice & client data | Deleted 30 days after account closure (or earlier on request) |
| Financial records (invoices, expenses) | Up to 7 years for tax compliance where required by law |
| Error logs & crash reports | 90 days |
8. Your Rights Under UK GDPR
You have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion of your data (subject to legal retention requirements)
- Restriction — limit how we process your data
- Portability — receive your data in a machine-readable format (use the "Export My Data" feature in Settings)
- Object — object to processing based on legitimate interests
To exercise any right, contact us at the address in Section 14. We will respond within 30 days (extendable by two months for complex requests).
To complain about our handling of your data, contact the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
9. Cookies & Tracking
- Website — essential: Session storage and strictly-necessary cookies that make the site and its support forms work. These are always on and involve no tracking.
- Website — analytics (optional, consent only): If you click "Accept Analytics" on our cookie banner, we load Google Analytics 4 (provided by Google LLC) to measure visits and page usage, with IP anonymisation enabled. No analytics cookies are set if you decline or ignore the banner. You can withdraw consent at any time by clearing this site's browser data, after which the banner will ask again. Google's processing is described in its privacy policy. No advertising pixels are used.
- App sessions: login sessions are stored in your browser's secure storage (and, when the mobile apps launch, the device's iOS Keychain / Android EncryptedSharedPreferences). No third-party tracking SDKs.
10. Security
We implement the following security measures:
- Encryption in transit: All data transmitted over HTTPS/TLS
- Encryption at rest: Database encrypted at rest by Supabase (AES-256)
- Session security: Login sessions stored in your browser's secure storage (and, when the mobile apps launch, the device's iOS Keychain / Android EncryptedSharedPreferences)
- Row Level Security: Database policies ensure each user can only access their own data
- Authentication: Passwords stored as secure hashes
- Breach notification: We will notify affected users and the ICO within 72 hours of discovering a personal data breach, as required by UK GDPR Article 33
11. Children's Privacy
Invoice4You is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If we discover that a child under 16 has created an account, we will delete their data promptly.
12. International Data Transfers
Your data is primarily stored within the UK and European Economic Area (EEA). Where we use US-based service providers (such as Resend for email delivery), transfers are protected by Standard Contractual Clauses (SCCs) approved by the UK ICO.
13. Changes to This Policy
We will notify you of material changes by email or in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Invoice4You after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
We aim to respond to all privacy enquiries within 30 days. For complex requests, we may extend this by up to two months and will inform you accordingly.
Unresolved complaints may be escalated to the Information Commissioner's Office (ICO):