Privacy Policy
Your privacy matters. This policy explains what we collect, why, who we share it with, how long we keep it, and the choices you have. It applies to your use of Your Invoices on the web and in our iOS app. We do not sell your data and we do not use it for advertising.
Who we are
Your Invoices is operated by North East VAG Adaptions LTD, a company registered in England and Wales (company number 15225495), trading as Your Invoices, whose registered office is at Unit 9, Dragonville Industrial Park, Durham, DH1 2XH. For anything in this policy, email us at privacy@yourinvoices.co.uk or use the support page.
For your own account and business data, we are the data controller. For the personal data of yourcustomers that you put into the service, you are the controller and we act as your processor - see “Your customers’ data” below.
What we process
Account data. Your name, email address, and optionally your phone number, avatar image and timezone.
Business data. Your company name and address, logo, VAT number, bank details for payment instructions on invoices, your invoices, estimates, products, expenses, mileage and time entries, and who else you invite to your business.
Your customers’ data. The names, email addresses, phone numbers, postal addresses and tax references you enter for the people and businesses you invoice. You decide what goes in; we only store it, show it back to you and put it on the documents you choose to send.
Technical and security data. IP address, request path and timestamps in our security and audit logs, plus the session cookie (or, in the app, the session token) that keeps you signed in. Billing identifiers come back to us from Stripe; we never see or store your card number.
Mobile app
Our native iOS app signs in to the same account and reads and writes the same data as the website, over an authenticated connection to our API. On your device it stores only your authentication session, held in the iOS keychain (encrypted, app-private), and the ID of the business you last had open. Signing out removes them.
The app contains no advertising SDKs and no third-party analytics. It does not collect the advertising identifier (IDFA), does not track you across other companies’ apps or websites, and so never asks for App Tracking Transparency permission. It asks for a device permission only when a feature you tap needs one.
Why we process it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Running the service - your account, your invoices, estimates, customers and expenses | Performance of a contract (UK GDPR Art. 6(1)(b)) |
| Taking subscription payments and handling billing queries | Performance of a contract (Art. 6(1)(b)) |
| Security logging, rate limiting, abuse and fraud prevention, keeping the service reliable | Legitimate interests (Art. 6(1)(f)) - keeping businesses' financial records safe |
| Keeping our own accounting and tax records for the subscriptions you pay us | Legal obligation (Art. 6(1)(c)) |
| Any optional marketing email you opt into | Consent (Art. 6(1)(a)) - you can withdraw it at any time |
Who we share it with
We share data only with the sub-processors that run the service. Each is bound by a contract that lets them use the data only to provide their service to us. We do not sell data or share it with advertisers or data brokers.
| Sub-processor | What it does | Processing region |
|---|---|---|
| Supabase | Database, authentication and file storage (logos, avatars) | eu-west-2 (London, United Kingdom) |
| Cloudflare | Hosting, CDN and bot protection on our contact form (Turnstile) | Global edge network; requests are served from the location nearest you |
| Stripe | Subscription payments and billing | United States, Ireland and the UK (Stripe group companies) |
| Resend | Delivery of transactional email (invoices, estimates, reminders, invites) | United States |
We may also disclose data where the law requires it, or to establish or defend legal claims. If the business is ever sold or merged, your data may transfer to the buyer under the same protections, and we will tell you first.
International transfers
Some of the providers above process data outside the UK, including in the United States. Where they do, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the IDTA), together with the technical measures those providers apply - encryption in transit and at rest. You can ask us for a copy of the safeguards we rely on.
How long we keep it
Account, business and customer data - for as long as your account is open. When you delete your account we permanently delete the businesses you own and their data. Residual copies may persist in encrypted backups for up to Daily backups, retained for 7 days. Point-in-time recovery is not enabled. before those backups roll off.
Audit logs (what changed in your account) - 90 days. Security logs (sign-in attempts, rate limiting, blocked requests) - 12 months. Both are then deleted automatically.
Our billing records - six years after the end of the accounting period, because UK tax law requires it. This covers the subscriptions you pay us; it does not keep your invoice data alive.
You are responsible for keeping your own copies of your business records for as long as HMRC requires (normally six years). Export them before you delete your account - once deleted we cannot get them back.
Your customers’ data
When you enter details about your own customers, you are the controller of that personal data and we process it on your instructions. That means you decide what to collect and why, you handle requests your customers make to you, and you are responsible for telling them how you use their data. We process it only to run the service for you, keep it isolated from every other account, and delete it when you delete it or close your account. If you need a written data processing agreement, ask us at privacy@yourinvoices.co.uk.
Your rights
Under UK GDPR you can ask us to:
- Access the data we hold about you - most of it is visible in the app, and you can request the rest from us.
- Correct anything inaccurate - account details in Account, business details in Settings, on the web or in the iOS app.
- Erase your data - delete your account from Account settings, which permanently removes the businesses you own and their data.
- Port your data - export everything as a machine-readable file from Settings at any time.
- Restrict or object to processing we base on legitimate interests, and withdraw consent where we rely on it - for example by unsubscribing from optional email.
Email privacy@yourinvoices.co.uk or use the support page. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
Cookies
We use only the cookies the service needs to work: the ones that keep you signed in and protect forms against abuse. No advertising or cross-site tracking cookies, so there is nothing to consent to.
Children
Your Invoices is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Complaints
If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes
If we change this policy we will update the date below, and tell you by email before any change that materially affects you takes effect.
Last updated: 26 July 2026.