Privacy Policy

1. Who We Are

SFTWARES LTD ("we", "us", "our") operates Invoice4You — an invoicing, quoting and expense-tracking app for UK sole traders and small businesses, available at invoice4you.app and as a mobile app on iOS and Android.

We are the data controller for the personal data described in this policy. SFTWARES LTD is registered in England and Wales, company number 17126208, with its registered office at Suite RA01, 195-197 Wood Street, London E17 3NU. You can reach us at privacy@invoice4you.app.

2. Data We Collect

We collect only what the app needs to work. There is no advertising, no behavioural profiling and no third-party analytics SDK in the Invoice4You apps. Our website offers optional analytics, and only with your consent — see Section 11.

Account data

• Your name and email address
• If you sign up with a password: a secure hash of that password. We never see or store the password itself.
• If you sign in with Apple or Google: the identifier they give us, and the email address they choose to share. If you use Apple's Hide My Email, we only ever see the relay address Apple generates — never your real one.
• Your business type (sole trader, self-employed or limited company)

Business data

• Company name, address, phone number and email address
• Your logo, if you upload one
• Bank name, sort code and account number — stored so they can be printed on your invoices as payment details. We do not connect to your bank, initiate payments, or have any ability to move money.
• VAT number, VAT scheme and flat-rate percentage, if you are VAT registered
• Company registration number, for limited companies

Client, invoice and quote data

• Your clients' names, email addresses, phone numbers and postal addresses
• Invoice, quote and credit-note amounts, line items, dates, payment status and notes

Expenses and receipts

• Expense amounts, dates, suppliers, categories and VAT
• Photographs of receipts you choose to capture or upload — see Section 5 for what happens to them
• Mileage and home-office figures you enter

Device data

• If you turn on payment reminders, a push notification token issued by your device, used to deliver those reminders and nothing else
• Technical logs generated by our hosting provider when the app talks to our servers. These are used to diagnose faults and are retained only for the short period our provider's platform keeps them.

Crash reports. When the mobile app hits an error it automatically sends a crash report to Sentry, our crash-reporting provider, so we can find and fix the fault. This happens automatically and cannot be turned off in this version of the app. A report contains the technical stack trace, the app version, your device model and OS version, the state of the device at the time (memory, battery, thermal state, orientation), a random identifier for the app installation, and the last few actions taken in the app. It does not contain your invoices, clients, expenses or receipt images, nor the contents of anything the app was sending or the credentials it was sending it with — request contents and sign-in headers are removed on your device before the report is sent, and record identifiers are removed by Sentry on arrival, before the report is stored. Your IP address is not stored with the report and no location is derived from it.

Support requests

• The name and email address you give us when you use the support or contact form on invoice4you.app
• The subject and message you write, and any files you attach
• If the email address you use matches an Invoice4You account, we link your request to that account so we can answer it accurately. This happens automatically, and we never confirm to anyone whether an address has an account with us.

3. How We Use Your Data

We do not use your data for advertising, we do not profile you, and we never sell it.

4. Legal Basis for Processing

Where you enter personal data about your own clients, you are the controller of that data and we process it on your behalf as part of providing the service.

5. Receipt Scanning & AI

Invoice4You can read a receipt from a photograph so you don't have to type it in. This is the only part of the app that uses artificial intelligence, it is entirely optional, and you can always enter an expense by hand instead.

What happens when you scan a receipt

• The photograph is sent to Anthropic, which operates the Claude AI models, and their model reads the date, supplier, amount and VAT from it.
• Only the image is sent. Your name, email address, account identifier, company details and client records are not included in that request.
• The figures come back to your device and are only saved if you save the expense.
• The receipt image itself is stored in your own account so you can refer to it later, and is deleted when you delete the expense or your account.

What Anthropic does with it

• Anthropic is a US company, so this is a transfer outside the UK — see Section 7.
• Anthropic states that it does not use inputs or outputs from its commercial API to train its models by default.
• Anthropic states that it deletes API inputs and outputs within 30 days by default, with longer retention only where required for legal reasons or where a request is flagged for a policy violation.
• Their privacy information is at privacy.claude.com.

We do not use AI to make any decision about you, and nothing in the app is decided automatically in a way that produces legal effects.

6. Who We Share Data With

We use a small number of service providers to run Invoice4You. Each one receives only what it needs for its role, and none of them are permitted to use your data for their own purposes.

We may also disclose data if we are legally required to — for example in response to a valid court order. We will tell you if that happens unless we are legally prevented from doing so.

We never sell your data, and we do not share your account or business data with advertisers, data brokers or analytics companies. The only analytics we use is the optional, consent-based Google Analytics on our website, described in Section 11.

7. International Data Transfers

Your account data is stored in the European Union, in Amazon Web Services' Ireland region.

Some of the providers listed in Section 6 — Resend, Anthropic and Expo — are based in the United States, so using those features involves transferring data outside the UK. Those transfers are made under the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with the safeguards each provider commits to in their own data processing terms.

Crash reports are stored in Sentry's EU data region in Frankfurt. Sentry is a United States company, so that processing is covered by Sentry's data processing agreement, which incorporates the Standard Contractual Clauses.

If you accept analytics on our website, Google may process that website data in the United States, under Google’s own data processing terms and the transfer safeguards they include.

If you would rather no data reached a US provider at all, you can use the app without scanning receipts and without push reminders. Sending documents by email necessarily involves our email provider.

8. Data Retention

We do not keep a copy of your records after you delete your account. If you need your invoices for your own tax records — HMRC generally expects businesses to keep records for several years — export them before deleting, using Download all my data in your profile.

9. Deleting Your Account

You can delete your account from inside the app at any time: Profile → Danger zone → Delete Account. You can also request deletion at invoice4you.app/delete-account.

When you confirm, we immediately and permanently delete:

• your account and sign-in credentials
• every company, client, invoice, quote, credit note and expense in it
• every file you uploaded, including receipt images and logos
• your push notification token and app preferences

If you signed in with Apple, we also tell Apple to revoke the app's access to your Apple ID, so Invoice4You no longer appears in your list of authorised apps.

This is not reversible and there is no grace period. We cannot restore a deleted account, so export anything you need first.

10. Your Rights Under UK GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected; most of it you can edit yourself in the app
• Erasure — have your data deleted, which you can do yourself at any time (Section 9)
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a machine-readable format, using Download all my data in your profile
• Object — object to processing we carry out on the basis of legitimate interests

To exercise any of these, email privacy@invoice4you.app. We will respond within one month, which we may extend by up to two further months for complex requests — we will tell you if that applies.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We would appreciate the chance to put it right first.

11. Cookies & Tracking

• Web app: app.invoice4you.app uses your browser’s storage to keep you signed in. It has no advertising cookies, no tracking pixels and no analytics.
• Website analytics (invoice4you.app only): if you click Accept Analytics on our cookie banner, some pages of our website load Google Analytics 4 so we can count visits and see which pages are useful. It sets two cookies, _ga and _ga_…, which last up to two years. If you click Decline, or ignore the banner, Google Analytics never loads. Your choice is saved in your browser. Google states that it does not log or store IP addresses from UK and EU visitors. As noted in Section 6, our web pages also load their typefaces from Google Fonts.
• Changing your mind: you can withdraw or change your choice at any time. Change my cookie choice
• Mobile apps: your session is stored in your device's secure storage (iOS Keychain, Android EncryptedSharedPreferences). There are no third-party tracking SDKs in the apps, and we do not use any advertising identifier.

12. Security

• In transit: everything is sent over HTTPS/TLS
• At rest: the database and uploaded files are encrypted at rest by our hosting provider
• Separation: row-level security policies mean each account can only ever read its own rows — enforced by the database itself, not just the app
• Sign-in: passwords are stored only as secure hashes; optional two-step verification is available on password accounts
• Sessions: kept in your device's encrypted storage
• Breaches: if a personal data breach occurs we will notify the ICO within 72 hours where required, and tell affected users where the risk to them is high, as UK GDPR Articles 33 and 34 require

No system is perfectly secure. If you believe you have found a security problem in Invoice4You, please tell us at support@invoice4you.app — we would rather hear it from you than from anyone else.

13. Children's Privacy

Invoice4You is a business tool. Our Terms require you to be at least 18 to use it, and we do not knowingly collect data from anyone under 18. If we find that an account belongs to someone under 18, we will delete it.

14. Changes to This Policy

If we make a material change we will tell you by email or in the app at least 14 days before it takes effect. The "last updated" date at the top of this page always reflects the current version.

15. Contact Us

Unresolved complaints can be escalated to the Information Commissioner's Office: