Last updated 6 November 2026 (receipts on an invoice’s lines)
This notice explains what happens to personal data in this invoicing application. It is written to be read, not to be survived.
The application is operated by Odisal Ltd, a company registered in England and Wales, company number 17500421, whose registered office is 58 Penrhyn Gardens, Kingston upon Thames, KT1 2EG. Questions, requests and complaints: info@odisal.com.
We are registered with the Information Commissioner’s Office as a data controller, registration number ZC272858.
This matters, because it decides who answers to whom:
| Data | Where it comes from | Why |
|---|---|---|
| Name, email address, profile picture, and your Google or Microsoft account identifier | Google or Microsoft, when you sign in; or you, if you sign in with a link emailed to you, when we hold only your address | To identify you and decide what you may see. There is no password to store. |
| Which businesses you may open, and your role in each | Set by an owner of that business | Access control |
| Invoices, quotes, client names, addresses, emails, amounts, payments, notes | Entered by users of the business | To produce and keep the business’s invoices |
| Receipts: photos and PDFs a business attaches to an invoice’s lines, and whatever they show | Uploaded by users of the business. A photo is redrawn in the browser before it is sent, so where and with what it was taken is not kept; a PDF is kept as it was uploaded | To keep the evidence for the costs an invoice bills, beside it. Anyone the business sends the invoice’s link to can see and download its receipts, as they can the invoice, and the business may print the photos with it |
| Card payments: that an invoice was paid by card, the amount and the date | Stripe, when a client pays an invoice by card | To mark the invoice paid. We never see or store card details. |
| Your plan: which plan, its add-ons, its status and renewal date, your Stripe customer reference and when your trial ends; and each month, how many times you used writing help and how often your plan's limits stopped you (counts only, never what was written) | Stripe, when you choose a plan; the trial from when your account was made | To provide the plan you pay for, to keep writing help within each month's allowance, and to know when an account should become read only. We never see or store card or bank details. |
| Emails the application sends for a business: who to, the subject, a copy of the message, when, and whether it arrived | Created when a business sends an invoice, switches on reminders or receipts, or gives someone access | So a business can see exactly what was sent, and so the application does not send twice. The message holds nothing the invoice does not: the client's name, the amounts and dates, and the link to it. |
| Email addresses that bounced, or whose owner marked an email as spam | Reported by our email provider | So the application never writes to them again |
| A change history: who changed which record, when, and a copy of the record | Created automatically as records change | So a business can see what happened to its own invoices |
| If you try the demo: an anonymous account and your own copy of the sample business, with whatever you type into it | Created when you press Try the demo. No name, email or sign-in account is asked for | So you can try the app. Nobody else can see your copy |
| If you ask to hear when Invoicing opens: your email address, and when you asked and confirmed | You, on the page a client’s invoice link points to | To send one email to check it was you, and one when new businesses can start. Nothing else is sent, and the address is used for nothing else |
| A session cookie | Set when you sign in | To keep you signed in. See the cookie notice. |
These are facts about the system, not promises of intent:
| Who | What they see | Where |
|---|---|---|
| Google (sign-in) | That you signed in to this application, and your basic profile. We receive your name, email and picture; we discard the access tokens immediately. | Google Ireland / United States |
| Microsoft (sign-in, if you choose it) | That you signed in to this application, and your basic profile. We receive your name and email address, and whether your organisation has verified that address; we discard the access tokens immediately. | Microsoft Ireland / United States |
| Amazon Web Services (Lightsail) | Holds the server and its disks. Data is stored in London, eu-west-2. | United Kingdom |
| Amazon Web Services (S3) | Holds an encrypted, off-site copy of the nightly backups, in a separate account, so that losing the server cannot lose your data. Stored in Stockholm, eu-north-1. | Sweden (EU) |
| Stripe (payments) | Only if a business takes payments through Stripe and its client chooses to pay by card or from their bank app (Pay by Bank). The client pays on Stripe’s own page, so Stripe — and, for Pay by Bank, the client’s own bank — receives the payment details, and acts under its own privacy policy. We receive only that the invoice was paid, the amount and the date. The money goes to the business’s own Stripe account. Stripe also takes payment for your own plan with us: your name, email address and card or bank details go to Stripe, and we keep only your Stripe customer reference, your plan and when it renews. On the page where you choose a plan, Stripe’s script also receives your IP address and information about your browser and device, which Stripe uses to prevent fraud. | Ireland / United States |
| Amazon Web Services (Simple Email Service) | If you ask to sign in with an emailed link, SES delivers it, so it receives your email address. If an owner gives you access to a business, SES delivers the email saying so, and receives your address and the names of the business and the owner. Otherwise, only when a business sends an email through the application. SES delivers it, so it receives the client’s name and email address, the business’s name and email address, and the message, which includes the invoice’s figures and a link to it. It tells us whether the email bounced or was marked as spam. Run from London, eu-west-2. | United Kingdom |
| Exchange-rate provider (Frankfurter) | Nothing about you. Rates are fetched by our server, not by your browser, so only a currency pair and a date are sent. Your address is never disclosed to them. | — |
Google, Microsoft and Stripe may handle data in the United States. They do so under the UK Extension to the EU–US Data Privacy Framework where they are certified, and otherwise under the ICO’s International Data Transfer Addendum.
Personal data may also be disclosed where the law requires it.
The application logs no IP addresses. The server’s system log, which can include the email address of a person who signed in, made a change or was refused, is kept for 30 days and then deleted. The web server keeps no separate access log.
| What | How long |
|---|---|
| Invoices and clients | Until deleted by the business. Deleted invoices sit in a recycle bin until purged. |
| Nightly snapshots inside the database | 90 days |
| Nightly file backups | Every copy from the last 7 nights, the newest from each of the last 4 weeks, and the newest from each of the last 6 months |
| A space its owner has deleted | Set aside for 30 days, so it can be restored on request, then removed |
| Off-site copies of those backups | 90 days from when each is copied |
| Sign-in sessions | 7 days, then expired and deleted |
| A demo copy and its anonymous account | One day, then deleted. Its session lasts the same day |
| Change history | For as long as the business keeps the record |
| Receipts | Until the business removes one, or deletes the invoice for good. A receipt on a line that was removed is kept until the invoice is issued, so the line can be put back with it |
| The record of emails sent | For as long as the business keeps the invoice it was for |
| The record of an invitation to a business | 30 days, then deleted. Your access stays until an owner removes it |
| Addresses that bounced or complained | Until the business, or the person, asks us to remove one |
| An address left to hear when Invoicing opens | Seven days if never confirmed. Once confirmed, until the one email about opening has been sent, and never more than 12 months. Deleted at once if you use the link in the email |
| User accounts | Until you delete yours (Settings, Your account), which takes you out of every business at once. Your name stays on the change history of businesses other people own, as part of their records. Spaces only you used are set aside for 30 days, then removed |
| The record of your plan and payments | Six years after the payment, as tax law requires, even after your account is deleted |
Because backups are kept for a time, data you delete can persist in a backup for up to about six months before the last copy holding it ages out, and in the off-site copy of those backups for up to 90 days from when each was copied.
You can delete your account yourself, in Settings under Your account. It says what will happen to each business before anything does.
You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how it is used, or to receive it in a portable form. Write to info@odisal.com and we will respond within one month. If you complain to us about how we handle your data, we acknowledge it within 30 days and tell you what we have done.
If the request concerns the contents of a business’s invoices, we will pass it to that business, because it is their decision, not ours.
You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first.
No system is perfectly secure, and we do not claim otherwise.
If this notice changes materially, we will tell the businesses using the application. The date at the top always reflects the current version.