Privacy policy
Last updated: 23 September 2026 · Draft pending legal review
Who we are
InvoicingPortal is operated by [Company legal name], [registered address], company number [number] ("we", "us"). We are the data controller for the personal data described here. ICO registration number: [ICO number].
Questions or requests: [privacy contact email].
What we collect
- Account details — your name, email address and a securely hashed version of your password (we never store the password itself).
- What you put in your workspace — for example your clients and agencies, sessions and rates, invoices, expenses and receipt images, payslips and pension details, compliance documents and expiry dates, bank details you add to invoices, and your profile settings.
- Technical data — your IP address and basic request logs, used to keep the service secure (for example, limiting repeated failed sign-ins).
Please don't store patient or service-user identifiable information in the portal. It is designed for your own business records.
Why we use it, and our lawful basis
- To provide your account and workspace, and to send emails you ask for (such as invoices to your clients, email confirmation and password reset) — performance of our contract with you.
- To keep the service secure and prevent misuse — our legitimate interests.
- To meet legal obligations, where they apply — legal obligation.
We don't sell your data, and we don't use it for advertising.
Who can see it
Your workspace is private to your account. Other users can't see it. We use these service providers to run InvoicingPortal:
- Amazon Web Services — hosting and storage, in the EU (Stockholm) region.
- Resend — sending emails, including invoices you choose to send. Resend may process data in the United States under appropriate safeguards.
- Google Fonts — the typefaces used on our pages. Your browser requests them from Google, which receives your IP address.
Cookies
We use one strictly necessary cookie, lpp_session, to keep you signed in. It lasts up to 30 days or until you sign out. We don't use analytics or advertising cookies, so we don't ask for cookie consent.
How long we keep it
We keep your account and workspace while your account is open, including after your free period or plan ends, so you can come back to it. If you ask us to delete your account, we delete your data within 30 days, and it is removed from our backups within a further 7 days. Server logs are kept only as long as needed for security and troubleshooting.
Your rights
Under UK data protection law you can ask to access, correct, delete or receive a copy of your data, and to object to or restrict how we use it. Contact [privacy contact email]. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Passwords are hashed, sign-in sessions use secure cookies, repeated sign-in attempts are limited, and data is backed up daily. No system is perfectly secure, so please use a strong password that you don't use elsewhere.
Changes
If we change this policy in a meaningful way, we'll tell you by email or in the portal before the change takes effect.