Privacy notice

Last updated 12 October 2026 (emails sent by the application added; operated by Odisal Ltd)

Before publishing Replace every [SQUARE BRACKET] below with your real details, and have this checked by someone qualified. It describes the system accurately as built, but accuracy is not the same as legal sufficiency.

This notice explains what happens to personal data in this invoicing application. It is written to be read, not to be survived.

Who is responsible

The application is operated by Odisal Ltd, a company registered in England and Wales, company number 17500421, whose registered office is 58 Penrhyn Gardens, Kingston upon Thames, KT1 2EG. Questions, requests and complaints: info@odisal.com.

[If registered with the ICO: “We are registered with the Information Commissioner’s Office, registration number [ICO NUMBER].”]

Two different roles

This matters, because it decides who answers to whom:

For people who sign in — we decide how their account data is handled. We are the controller.
For the contents of invoices — the business using the application decides what to record about its own customers. That business is the controller; we only host it. We are the processor, and act on that business’s instructions.

What we hold, and why

Data	Where it comes from	Why
Name, email address, profile picture, Google account identifier	Google, when you sign in	To identify you and decide what you may see. There is no password to store.
Which businesses you may open, and your role in each	Set by an owner of that business	Access control
Invoices, quotes, client names, addresses, emails, amounts, payments, notes	Entered by users of the business	To produce and keep the business’s invoices
Card payments: that an invoice was paid by card, the amount and the date	Stripe, when a client pays an invoice by card	To mark the invoice paid. We never see or store card details.
Emails the application sends for a business: who to, the subject, when, and whether it arrived	Created when a business sends an invoice, or switches on reminders or receipts	So a business can see what was sent and so the application does not send twice. The message itself is not stored: it is rebuilt from the invoice.
Email addresses that bounced, or whose owner marked an email as spam	Reported by our email provider	So the application never writes to them again
A change history: who changed which record, when, and a copy of the record	Created automatically as records change	So a business can see what happened to its own invoices
If you try the demo: an anonymous account and your own copy of the sample business, with whatever you type into it	Created when you press Try the demo. No name, email or Google account is asked for	So you can try the app. Nobody else can see your copy
A session cookie	Set when you sign in	To keep you signed in. See the cookie notice.

Our lawful bases

Contract — account data, because you cannot be given access to a system without it.
Legitimate interests — the change history and security records, so a business can account for its own invoices and so access can be kept to the people who should have it; and the list of addresses that bounced or complained, so nobody is written to who has asked not to be or cannot receive it.
The client business’s own basis — for invoice contents, which that business decides and we merely store.

What we do not do

These are facts about the system, not promises of intent:

No analytics, no tracking pixels, no advertising, no profiling.
No third-party scripts, fonts or embeds of any kind. Everything the page loads comes from this server.
No selling, sharing or renting of data to anyone.
No access by other clients. Each client’s data is in a separate database, chosen by the domain you visit, and a session issued on one client’s domain is refused on another’s.
No marketing email, ever. The application sends only what a business asks it to send to its own clients: an invoice or quote when the business presses Send, and — only if the business switches them on — payment reminders and payment receipts. Each comes from the business’s name and replies go to the business.

Who else is involved

Who	What they see	Where
Google (sign-in)	That you signed in to this application, and your basic profile. We receive your name, email and picture; we discard the access tokens immediately.	Google Ireland / United States
Amazon Web Services (Lightsail)	Holds the server and its disks. Data is stored in London, eu-west-2.	United Kingdom
Amazon Web Services (S3)	Holds an encrypted, off-site copy of the nightly backups, in a separate account, so that losing the server cannot lose your data. Stored in Stockholm, eu-north-1.	Sweden (EU)
Stripe (card payments)	Only if a business takes card payments and its client chooses to pay by card. The client pays on Stripe’s own page, so Stripe receives the card details and the payment, and acts under its own privacy policy. We receive only that the invoice was paid, the amount and the date. The money goes to the business’s own Stripe account.	Ireland / United States
Amazon Web Services (Simple Email Service)	Only when a business sends an email through the application. SES delivers it, so it receives the client’s name and email address, the business’s name and email address, and the message, which includes the invoice’s figures and a link to it. It tells us whether the email bounced or was marked as spam. Run from London, eu-west-2.	United Kingdom
Exchange-rate provider (Frankfurter)	Nothing about you. Rates are fetched by our server, not by your browser, so only a currency pair and a date are sent. Your address is never disclosed to them.	—

Personal data may also be disclosed where the law requires it.

Check before publishing Your web server (Caddy) may keep access logs containing IP addresses. The application itself records none, but if the server does, say so here and give the retention period.

How long it is kept

What	How long
Invoices and clients	Until deleted by the business. Deleted invoices sit in a recycle bin until purged.
Nightly snapshots inside the database	90 days
Nightly file backups	Every copy from the last 7 nights, the newest from each of the last 4 weeks, and the newest from each of the last 6 months
A space its owner has deleted	Set aside for 30 days, so it can be restored on request, then removed
Off-site copies of those backups	90 days from when each is copied
Sign-in sessions	7 days, then expired and deleted
A demo copy and its anonymous account	One day, then deleted. Its session lasts the same day
Change history	For as long as the business keeps the record
The record of emails sent	For as long as the business keeps the invoice it was for
Addresses that bounced or complained	Until the business, or the person, asks us to remove one
User accounts	Until removed. [CONFIRM YOUR PERIOD.]

Because backups are kept for a time, data you delete can persist in a backup for up to about six months before the last copy holding it ages out, and in the off-site copy of those backups for up to 90 days from when each was copied.

Your rights

You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how it is used, or to receive it in a portable form. Write to info@odisal.com and we will respond within one month.

If the request concerns the contents of a business’s invoices, we will pass it to that business, because it is their decision, not ours.

You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first.

Security

All traffic is encrypted in transit (HTTPS).
Each client’s data is in a separate database file, selected by the domain in the request.
Access is by invitation. Signing in is not enough on its own: an address must be permitted for that client and given access to a specific business.
Sign-in is by Google. We never see or store a password.

No system is perfectly secure, and we do not claim otherwise.

Changes

If this notice changes materially, we will tell the businesses using the application. The date at the top always reflects the current version.