Privacy Policy

1. Who we are

Only Invoicing is operated by [Only Invoicing Ltd], a company registered in England and Wales (company number [company number]), whose registered office is at [registered address]. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

For anything relating to your personal data, email [privacy@onlyinvoicing.com].

2. Controller and processor

We act in two different capacities depending on the data:

• Controller — your account data. Information about you as a user of Only Invoicing (your name, email, login and security settings, billing relationship with us, and how you use the service). We decide why and how this is processed.
• Processor — your business data. Information you put into your workspace about your clients and business: client names, contact details and addresses, invoices, quotes, line items, expenses and receipts. You (the workspace owner) are the controller of that data; we process it only on your instructions to provide the service. The data processing terms in our Terms of Service govern this relationship.

If you are one of our users' clients (for example you received an invoice or quote from a business that uses Only Invoicing), please contact that business about your data first — they are responsible for it. We will help them respond.

3. Data we collect

Information you give us

• Account details: name, email address, password (stored only as a salted hash).
• Security data: two-factor method, an encrypted authenticator secret, hashed backup codes and short-lived hashed email codes.
• Workspace details: company name, address, logo, payment details you choose to print on invoices, branding and preferences.
• Business content: clients, invoices, quotes, recurring templates, expenses and receipt files, notes and messages to the AI assistant.
• Support correspondence when you contact us.

Information collected automatically

• Technical and security logs: IP address, browser/user-agent, timestamps, and request details, used for security, rate limiting and debugging.
• Audit and activity records inside your workspace (e.g. “invoice sent”, “member invited”).
• Email delivery records for invoices, quotes and reminders sent from the app.
• Error reports if something breaks (see Sentry under Subprocessors).

Information from third parties

• If you sign in with Google or GitHub: your name, email and provider account ID.
• Stripe: subscription and payment status for your Pro plan, and connected-account status and payment confirmations if you accept card payments via Stripe Connect. We never receive or store full card numbers.

We do not use advertising trackers or analytics cookies, and we do not sell personal data.

4. How we use it and why (lawful bases)

Where we rely on legitimate interests we have balanced them against your rights; you can ask us for details or object at any time (see Your rights). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Your clients’ data

When you add clients and send them documents, you are the controller. You are responsible for having a lawful basis to process their data (for most businesses, contract or legitimate interests for invoicing an existing customer) and for telling them how you use it. We process it only to provide the service: storing it, rendering documents and payment pages, sending emails you trigger or schedule, and processing card payments through your own connected Stripe account.

Clients who receive automated payment reminders can unsubscribe from further reminders for that invoice using the link in the email.

6. The AI assistant

The optional AI assistant (Pro) sends your prompt, the conversation so far and the workspace data needed to answer it to our AI provider, Anthropic, which processes it as our subprocessor. Anthropic does not use API inputs or outputs to train its models. Conversations are stored in your workspace so you can revisit them, and are deleted with your workspace or account. The assistant asks for confirmation before changing anything.

7. Subprocessors

We use the following service providers to run Only Invoicing. Each is bound by a data processing agreement with appropriate security and confidentiality terms.

We will update this list before adding a new subprocessor that handles your business data. Workspace owners may object to a new subprocessor by contacting us; if we cannot reasonably accommodate the objection you may close your account.

8. International transfers

Some of our providers are based in, or access data from, the United States or other countries outside the UK. Where personal data leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or the ICO's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with supplementary measures such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards.

9. How long we keep data

A note on your own records: UK businesses are generally required to keep invoices and accounting records for at least 6 years (HMRC). Only Invoicing is not an archive service — before deleting your account, use Settings → Account → Export my data and download PDFs of anything you need to keep.

10. Security

We use encryption in transit (TLS) and at rest, mandatory two-factor authentication for password accounts, hashed passwords and codes, encrypted authenticator secrets, tenant isolation between workspaces, role-based access, audit logging and rate limiting. No system is perfectly secure; if we become aware of a personal data breach affecting you we will notify you and, where required, the ICO within 72 hours.

11. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate data (most can be edited in Settings).
• Erasure — you can delete your account yourself in Settings → Account.
• Data portability — download a machine-readable JSON export in Settings → Account → Export my data.
• Restriction of processing in certain circumstances.
• Object to processing based on legitimate interests.
• Withdraw consent, where processing is based on consent.

To exercise any right, email [privacy@onlyinvoicing.com]. We will respond within one month and may need to verify your identity. If your request concerns data a business holds about you as its client, we will pass it to that business.

12. Cookies

We only use cookies and similar storage that are strictly necessary to run the service (signing in, keeping you in the right workspace, remembering your theme). We do not use analytics or advertising cookies. See our Cookie Policy for the full list.

13. Children

Only Invoicing is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “last updated” date and, for material changes, tell you by email or in the app before they take effect.

15. Contact and complaints

Questions or concerns: [privacy@onlyinvoicing.com], or write to [Only Invoicing Ltd], [registered address].

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to address your concerns first.