Privacy Policy

1. Who We Are

SFTWARES LTD ("we", "us", "our") operates Invoice4You — an invoicing, quoting and expense-tracking app for UK sole traders and small businesses, available at invoice4you.app and as a mobile app on iOS and Android.

We are the data controller for the personal data described in this policy. You can reach us at privacy@invoice4you.app.

2. Data We Collect

We collect only what the app needs to work. There is no advertising, no behavioural profiling and no third-party analytics SDK in Invoice4You.

Account data

• Your name and email address
• If you sign up with a password: a secure hash of that password. We never see or store the password itself.
• If you sign in with Apple or Google: the identifier they give us, and the email address they choose to share. If you use Apple's Hide My Email, we only ever see the relay address Apple generates — never your real one.
• Your business type (sole trader, self-employed or limited company)

Business data

• Company name, address, phone number and email address
• Your logo, if you upload one
• Bank name, sort code and account number — stored so they can be printed on your invoices as payment details. We do not connect to your bank, initiate payments, or have any ability to move money.
• VAT number, VAT scheme and flat-rate percentage, if you are VAT registered
• Company registration number, for limited companies

Client, invoice and quote data

• Your clients' names, email addresses, phone numbers and postal addresses
• Invoice, quote and credit-note amounts, line items, dates, payment status and notes

Expenses and receipts

• Expense amounts, dates, suppliers, categories and VAT
• Photographs of receipts you choose to capture or upload — see Section 5 for what happens to them
• Mileage and home-office figures you enter

Device data

• If you turn on payment reminders, a push notification token issued by your device, used to deliver those reminders and nothing else
• Technical logs generated by our hosting provider when the app talks to our servers. These are used to diagnose faults and are retained only for the short period our provider's platform keeps them.

3. How We Use Your Data

We do not use your data for advertising, we do not profile you, and we never sell it.

4. Legal Basis for Processing

Where you enter personal data about your own clients, you are the controller of that data and we process it on your behalf as part of providing the service.

5. Receipt Scanning & AI

Invoice4You can read a receipt from a photograph so you don't have to type it in. This is the only part of the app that uses artificial intelligence, it is entirely optional, and you can always enter an expense by hand instead.

What happens when you scan a receipt

• The photograph is sent to Anthropic, which operates the Claude AI models, and their model reads the date, supplier, amount and VAT from it.
• Only the image is sent. Your name, email address, account identifier, company details and client records are not included in that request.
• The figures come back to your device and are only saved if you save the expense.
• The receipt image itself is stored in your own account so you can refer to it later, and is deleted when you delete the expense or your account.

What Anthropic does with it

• Anthropic is a US company, so this is a transfer outside the UK — see Section 7.
• Anthropic states that it does not use inputs or outputs from its commercial API to train its models by default.
• Anthropic states that it deletes API inputs and outputs within 30 days by default, with longer retention only where required for legal reasons or where a request is flagged for a policy violation.
• Their privacy information is at privacy.claude.com.

We do not use AI to make any decision about you, and nothing in the app is decided automatically in a way that produces legal effects.

6. Who We Share Data With

We use a small number of service providers to run Invoice4You. Each one receives only what it needs for its role, and none of them are permitted to use your data for their own purposes.

We may also disclose data if we are legally required to — for example in response to a valid court order. We will tell you if that happens unless we are legally prevented from doing so.

We never sell your data, and we do not share it with advertisers, data brokers or analytics companies.

7. International Data Transfers

Your account data is stored in the European Union, in Amazon Web Services' Ireland region.

Some of the providers listed in Section 6 — Resend, Anthropic and Expo — are based in the United States, so using those features involves transferring data outside the UK. Those transfers are made under the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with the safeguards each provider commits to in their own data processing terms.

If you would rather no data reached a US provider at all, you can use the app without scanning receipts and without push reminders. Sending documents by email necessarily involves our email provider.

8. Data Retention

We do not keep a copy of your records after you delete your account. If you need your invoices for your own tax records — HMRC generally expects businesses to keep records for several years — export them before deleting, using Export My Data in the app.

9. Deleting Your Account

You can delete your account from inside the app at any time: Profile → Danger zone → Delete Account. You can also request deletion at invoice4you.app/delete-account.

When you confirm, we immediately and permanently delete:

• your account and sign-in credentials
• every company, client, invoice, quote, credit note and expense in it
• every file you uploaded, including receipt images and logos
• your push notification token and app preferences

If you signed in with Apple, we also tell Apple to revoke the app's access to your Apple ID, so Invoice4You no longer appears in your list of authorised apps.

This is not reversible and there is no grace period. We cannot restore a deleted account, so export anything you need first.

10. Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected; most of it you can edit yourself in the app
• Erasure — have your data deleted, which you can do yourself at any time (Section 9)
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a machine-readable format, using Export My Data in the app
• Object — object to processing we carry out on the basis of legitimate interests

To exercise any of these, email privacy@invoice4you.app. We will respond within one month, which we may extend by up to two further months for complex requests — we will tell you if that applies.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would appreciate the chance to put it right first.

11. Cookies & Tracking

• Website and web app: we use browser storage to keep you signed in. There are no advertising cookies, no tracking pixels and no analytics tools such as Google Analytics. As noted in Section 6, page typefaces are loaded from Google Fonts.
• Mobile apps: your session is stored in your device's secure storage (iOS Keychain, Android EncryptedSharedPreferences). There are no third-party tracking SDKs in the apps, and we do not use any advertising identifier.

12. Security

• In transit: everything is sent over HTTPS/TLS
• At rest: the database and uploaded files are encrypted at rest by our hosting provider
• Separation: row-level security policies mean each account can only ever read its own rows — enforced by the database itself, not just the app
• Sign-in: passwords are stored only as secure hashes; optional two-step verification is available on password accounts
• Sessions: kept in your device's encrypted storage
• Breaches: if a personal data breach occurs we will notify the ICO within 72 hours where required, and tell affected users where the risk to them is high, as UK GDPR Articles 33 and 34 require

No system is perfectly secure. If you believe you have found a security problem in Invoice4You, please tell us at support@invoice4you.app — we would rather hear it from you than from anyone else.

13. Children's Privacy

Invoice4You is a business tool. Our Terms require you to be at least 18 to use it, and we do not knowingly collect data from anyone under 18. If we find that an account belongs to someone under 18, we will delete it.

14. Changes to This Policy

If we make a material change we will tell you by email or in the app at least 14 days before it takes effect. The "last updated" date at the top of this page always reflects the current version.

15. Contact Us

Unresolved complaints can be escalated to the Information Commissioner's Office: