Privacy Policy

Who is responsible

DROP DASH UK LTD (14749884), 10 Cranford Gardens, Royston, Barnsley, England, S71 4SP, is the data controller for the personal data described here. Contact us at support@invoo.uk about anything in this policy.

What we collect

Your account. Your name, email address and password. Passwords are stored only as a hash — we cannot read them.

Your business details. Trading name, address, contact details, company number, VAT number and bank details, so they can be printed on your invoices. Bank details are stored so they appear on the invoice; we never initiate payments and never see money moving.

Your customers and work. The client names, addresses and job records you enter, and the invoices produced from them. Where those records identify individuals, you are the controller of that data and we process it for you.

Notifications. If you turn on phone notifications, we store the anonymous address your browser gives us for delivering them. It identifies a device, not a person, and you can turn it off at any time.

Technical logs. Our hosting and database providers record request logs and error diagnostics, which include IP addresses, for security and reliability.

Cookies

We use only the cookies the service cannot work without: the ones that keep you signed in. They are set when you log in and cleared when you log out. Your light or dark appearance choice is saved on your own device, not sent to us.

We do not use analytics, advertising or tracking cookies, and we do not track you across other websites. Because every cookie we set is strictly necessary, there is nothing to consent to and no cookie banner.

Why we are allowed to hold it

We process your account and business data to perform our contract with you. We process technical logs and security records under our legitimate interest in keeping the service working and safe. Where we ask for consent — phone notifications — you can withdraw it at any time.

Who else sees it

We use a small number of providers to run the service. Each processes data only on our instructions, under a contract that requires them to keep it secure. We do not sell your data or share it for marketing.

• Supabase — the database that stores your account, clients and invoices, and the sign-in system that holds your email address and password. Hosted in the United Kingdom (London).
• Vercel — hosting for the app itself, which sees each request as it is served. The app runs on servers in London.
• Resend — sends the only emails we send you, from noreply@invoo.uk: confirming your address and resetting your password. Hosted in Ireland (EU).
• Stripe — takes payment for the Pro and Work plans. Your card details go straight to Stripe and never reach us; we store only the customer and subscription identifiers Stripe gives back, so we know which plan you are on.

Some of these providers are based outside the United Kingdom, or use infrastructure that is. Where your data leaves the UK it is protected by the safeguards UK data protection law requires for international transfers, which form part of our contract with each provider.

How long we keep it

We keep your data while your account is open. If you close it, we delete your data within 90 days, except anything we must retain to meet a legal or accounting obligation. Backups are overwritten on a rolling basis.

Deletion is real, not a flag: removing your account removes the sign-in, your business, your clients, every invoice and payment, and the PDFs generated from them. We cannot recover any of it afterwards, so export anything you still need first — every invoice can be downloaded as a PDF from the app. We keep a short record that an account was deleted, when, and by whom, which is what lets us show a deletion request was honoured.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email support@invoo.uk and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change this policy in a way that materially affects you, we will tell you by email before it takes effect.