Privacy Policy

Electric Trade Solutions Ltd is the Data Controller for personal data collected through InvoiceFlow.

• Company: Electric Trade Solutions Ltd
• Registered in: England and Wales
• Company Number: 17055534
• Trademark: InvoiceFlow® is a registered UK trademark (UK00004347223)
• ICO Registration: Registered with the Information Commissioner's Office (ICO) — Registration Reference: ZC099605 (registered 27 February 2026, expires 26 February 2027)
• Data Protection Contact: electrictradesolutions@invoiceflow.uk
• Website: www.invoiceflow2026.uk

We collect the minimum data necessary to provide the Service. Here is what we collect and why:

We use your data only for the purposes described above, and specifically to:

• Provide, operate, and maintain the InvoiceFlow Service
• Process your subscription payments via Stripe
• Send transactional emails (invoices, quotes, reminders) on your behalf via Resend
• Generate financial reports and tax summaries
• Enable bank reconciliation features (if used)
• Provide the Client Portal feature, allowing your clients to view and pay invoices
• Process receipt images and financial data using AI to extract information and suggest categories
• Enable the Accountant Access feature, where you can invite an accountant to view your financial data (see Section 5A)
• Send you push notifications about invoice payments, overdue reminders, and account activity
• Improve the App, fix technical issues, and develop new features
• Comply with legal, regulatory, and tax obligations
• Respond to support and data subject requests
• Prevent fraud and maintain the security of the Service

We do not use your data for advertising, profiling, or sell it to any third party.

Under UK GDPR, we rely on the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to provide the Service you subscribed to
• Legal obligation (Article 6(1)(c)): Compliance with UK tax law, HMRC requirements, and financial regulations
• Legitimate interests (Article 6(1)(f)): Operating and improving the Service, security monitoring, email delivery tracking, and fraud prevention — balanced against your rights and interests
• Consent (Article 6(1)(a)): Where you have explicitly opted in (e.g. optional marketing communications, if applicable)

When you enable the Client Portal feature, your clients receive a secure link to view their invoices. These links use cryptographic tokens generated from a combination of the client's email address and a server-side secret key. This means:

• Only the intended client (with their specific email address) can access their portal
• Tokens cannot be guessed or replicated without the server secret
• Each client only sees their own invoices — no cross-client data access is possible

InvoiceFlow includes an optional Accountant Access feature that allows you to invite your accountant or bookkeeper to view your financial data within the App. When you use this feature:

• You control access: You invite the accountant by email and choose their access level (read-only or full access)
• What they see: Your invoices, expenses, bank transactions, VAT returns, and financial reports — depending on the access level you grant
• Activity logging: All actions performed by your accountant are logged (viewed data, reconciled transactions, filed VAT returns, etc.) and visible to you in the App
• Revocation: You can revoke accountant access at any time, immediately removing their ability to view your data
• Your responsibility: You are responsible for ensuring you have the lawful basis to share your clients' data with your accountant

Your accountant is a separate Data Controller or Processor for the data they access — their access is governed by their own professional obligations and data protection arrangements.

We only share data with trusted third-party providers who are essential to delivering the Service. All processors are bound by data processing agreements:

• Base44 — Cloud application platform and database hosting (data stored in EU region)
• Stripe — Subscription and payment processing. Their Privacy Policy governs payment data
• Resend — Transactional email delivery service for sending invoices and quotes
• OpenAI — AI processing for receipt data extraction, expense categorisation, and bank transaction matching (data used solely for processing your request, not for model training)
• Google (Gemini) — AI processing for receipt scanning and web-context-enhanced features (data used solely for processing your request, not for model training)
• HMRC (HM Revenue & Customs) — When you use the Making Tax Digital integration, your tax returns, quarterly updates, final declarations, and fraud prevention header data are transmitted to HMRC to fulfil your legal tax obligations. This data is processed by HMRC under their own data protection arrangements as a public authority

We do not sell, rent, or trade your personal data with any third party for commercial purposes.

We may disclose data if required to do so by law, court order, or regulatory authority (e.g. HMRC, ICO, or law enforcement).

We retain your data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations:

• Active account data: Retained for the duration of your subscription
• Post-cancellation: Account and business data deleted within 90 days of account closure, subject to legal obligations
• Financial records: Invoice, expense, and tax data retained for 6 years as required by HMRC for Making Tax Digital (MTD) record-keeping, or up to 5 years and 10 months after the 31 January submission deadline for Self Assessment records (whichever is longer). VAT records retained for a minimum of 6 years per VAT Notice 700/22
• Security logs: Technical access logs retained for up to 12 months
• Backup data: Any data backups you create are stored encrypted and are deleted on account closure

You may request early deletion of your data at any time (subject to legal retention obligations) by emailing electrictradesolutions@invoiceflow.uk.

You have the following rights regarding your personal data. To exercise any right, email electrictradesolutions@invoiceflow.uk. We will respond within 30 calendar days:

• Right of Access (Article 15): Request a copy of all personal data we hold about you (Subject Access Request / SAR)
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your data ("right to be forgotten"), where no legal basis exists to retain it
• Right to Restriction (Article 18): Request we limit processing of your data in certain circumstances
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format (e.g. JSON or CSV export)
• Right to Object (Article 21): Object to processing based on legitimate interests
• Rights related to automated decision-making (Article 22): We do not use automated decision-making or profiling that produces legal or similarly significant effects

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

Under the Data Use and Access Act 2025 (DUAA) and UK GDPR, you have the right to make a complaint about how we handle your personal data. We operate a formal complaints procedure to ensure all complaints are handled fairly and promptly:

• How to complain: Email electrictradesolutions@invoiceflow.uk with "Complaint" in the subject line, or use the Help & FAQ section within the App
• Acknowledgement: We will acknowledge your complaint within 48 hours
• Full response: We aim to resolve complaints within 30 calendar days. Data protection complaints are handled within one month (extendable by two months for complex requests, per UK GDPR Article 12(3))
• Escalation: If you are not satisfied with our response, you can escalate to the Information Commissioner's Office (ICO) (Helpline: 0303 123 1113)

We implement appropriate technical and organisational security measures to protect your data, including:

• All data transmitted over HTTPS/TLS encryption
• Cryptographically secured client portal access tokens (HMAC-SHA256)
• Role-based access controls — users can only access their own data
• Regular security reviews of backend functions and data access patterns
• No storage of payment card details (delegated entirely to Stripe)
• No storage of HMRC sign-in credentials — OAuth 2.0 authentication means you authorise InvoiceFlow directly through HMRC without sharing your Government Gateway password
• HMRC OAuth access tokens and tax identifiers encrypted at rest and used only to submit returns on your behalf
• Fraud prevention header data submitted with all HMRC API requests in line with HMRC's specification
• AI processing limited to purpose-specific requests — no bulk data sharing or model training
• Production data access restricted to authorised personnel only

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by Article 33 UK GDPR. Where the breach affects HMRC-related data or MTD submissions, we will also notify HMRC within 72 hours by logging a ticket, providing a breach contact name and telephone number, as required by HMRC's service management practices.

If you become aware of a security vulnerability or incident, please report it immediately to electrictradesolutions@invoiceflow.uk with the subject line "SECURITY REPORT". We will acknowledge receipt within 48 hours.

The App uses:

• Essential cookies: Required for authentication and session management. The App cannot function without these.
• Local storage: Used to cache non-sensitive preferences (e.g. theme, UI settings) on your device

We do not use advertising cookies, third-party tracking cookies, or analytics cookies that track you across websites.

Your data is primarily stored and processed within the UK and EEA. Where any processing occurs outside the UK (for example, via US-based service providers such as Stripe), we ensure appropriate safeguards are in place including:

• UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs)
• Adequacy decisions where applicable

InvoiceFlow is a business tool intended for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in the law, our practices, or the Service. We will notify you of material changes by email and/or by displaying a prominent notice in the App at least 14 days before changes take effect. The "Last updated" date at the top always reflects the current version.

Continued use of the App after the effective date of changes constitutes your acceptance of the updated policy.

For any privacy-related questions, to exercise your rights, or to report a data concern:

Electric Trade Solutions Ltd
Company Number: 17055534
Email: electrictradesolutions@invoiceflow.uk
Website: www.invoiceflow2026.uk