Privacy policy

Last updated 15 October 2026

This explains what personal information Squinvoice collects, why, who sees it and what your rights are. We've tried to keep it plain.

Who we are

Squinvoice is run by Sarah Montier, a sole trader, of Priory Terrace, London, NW6 4DH, United Kingdom. We are the "data controller" for your account information. You can reach us through the contact page. We are registered with the Information Commissioner's Office (ICO) under number TBC.

What we collect

Your account: your email address and a scrambled (hashed) version of your password. If you sign in with Google or Facebook, the identifier they give us for you and your email address, but never your password there.
Your business details, if you add them: business name, address, email, phone number, VAT number and payment details. We print these on your invoices.
Your settings: for example the colour theme you choose and your next invoice number.
Your usage: the date and time of each invoice download, so we can apply the free allowance of 3 downloads in any 30 days.
Your subscription: if you subscribe, your Stripe customer reference, plan status and billing dates. We never see or store your card number; Stripe handles that.
Messages you send us through the contact page: your name, email address and message.
Technical logs: a record of requests to the site, errors, and the IP address in some security events (such as too many attempts). Logs refer to you by an internal ID, not your email address.

The invoices you create

The customer and item details you type into an invoice are used only to create your PDF. We don't save them to your account. A temporary copy is kept in your own browser tab (so you don't lose your work if you go off to pay, for example) and goes when you start a new invoice or close the tab.

Those details are about your customers. You decide what to put in an invoice, and you are responsible for having a proper reason to use it. We handle it only on your behalf, to make your document.

Why we use it, and our legal basis

To provide the service you asked for (running your account, making your PDFs, taking payment, sending account emails such as confirming your address or resetting your password). The basis is that it is needed to carry out our contract with you.
To keep the service secure and fair (logs, rate limits, and the record described under "If you delete your account"). The basis is our legitimate interest in protecting the service and preventing abuse.
To answer you when you contact us. The basis is our legitimate interest in replying to your message.
To meet legal duties such as keeping accounting records. Stripe also keeps payment records it is required to keep.

We don't sell your information, we don't run advertising or tracking cookies, and we don't send marketing emails.

Who else handles your information

We use a few companies to run the service. They only get what they need:

Stripe takes payments and manages subscriptions.
Resend sends our emails (confirmations, password resets, notices about your account and subscription, and contact-form messages to us).
Google and Facebook (Meta), only if you choose to sign in with them.
Our hosting provider, WebHostingUK, which stores the site and its database.

Some of these companies are based outside the UK, mainly in the United States. Where information is sent abroad, it's protected by the safeguards UK law requires, such as approved contract terms or the UK-US data bridge. We may also share information if the law requires it.

Cookies and similar storage

We only use what the site needs to work: a cookie that keeps you logged in, security cookies that protect forms, and short-lived storage in your browser for your invoice in progress. Because these are essential, we don't need to ask for consent. We don't use analytics or advertising cookies.

How long we keep it

Account, business details, settings and usage records: until you delete your account.
Technical logs: general logs for 14 days; the log of warnings and errors for 90 days.
Contact messages: only as long as we need them to deal with your message and any follow-up.
Payment records: held by Stripe for as long as the law requires.

If you delete your account

You can delete your account at any time from your account. We then delete your account, business details and usage records, and cancel your subscription.

To stop the free allowance being reset just by deleting and re-registering, we keep a short-lived record of your downloads from the last 30 days. It contains only a scrambled (hashed) version of your email address and the download times: no readable email, name or anything else. It is deleted automatically when each entry is 30 days old.

Your rights

Under UK data protection law you can ask us to: see the information we hold about you, correct it, delete it, restrict or object to how we use it, and give you a copy you can reuse elsewhere. You can download your data and delete your account yourself from your account. For anything else, use the contact page; we'll reply within one month.

If you're unhappy with how we've handled your information you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put things right first.

Children

Squinvoice is for people running a business and isn't meant for anyone under 18.

Changes

If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell you by email.