Privacy Policy

Who we are

FoxInvoices is operated by FOXVISITS LTD("we", "us"), a company registered in Scotland, company number SC570723, registered office 5 South Charlotte Street, Edinburgh EH2 4AN, United Kingdom. You can reach us about anything in this policy at support@foxinvoices.space.

We are the controller for your login details and for the data we collect about how the website is used. For the business records you enter about your own clients (names, addresses, emails, VAT numbers, invoices), your company is the controller and we process that data on your behalf, only to provide the service.

What we collect

• Login data: your email address and password (stored only as a hash by our authentication provider), plus sign-in times and the IP address used.
• Company and business data: company details, bank accounts, clients, invoices, quotes, credit notes, recurring schedules, services, payments and uploaded logos. All of it is entered by you or by other logins you gave access to the company.
• Email records: when you email a document from FoxInvoices we keep the recipients, subject and time, so you can see what was sent and so we can apply sending limits.
• Technical data: server logs (IP address, browser, pages requested) for security and troubleshooting; cookieless, aggregated page statistics from Vercel Web Analytics; and Google Analytics, only if you accept it (see below).

Why we use it and our lawful basis

• Providing the service (your login, storing company data, creating PDFs, sending the emails you ask us to send, password reset emails): contract, UK GDPR Art. 6(1)(b).
• Keeping the service secure and preventing abuse (server logs, email sending limits, fixing errors): legitimate interests, Art. 6(1)(f).
• Cookieless page statistics (Vercel Web Analytics), to see which pages are used: legitimate interests, Art. 6(1)(f).
• Google Analytics on our public pages: consent, Art. 6(1)(a). You can withdraw it at any time.
• Meeting legal duties, for example answering a lawful request from an authority: legal obligation, Art. 6(1)(c).

We do not sell your data, we do not use it to train AI models and we do not show ads.

Who can see your data

• People you add to a company.Every login that is a member of a company can see and change all of that company's data. Other logins cannot: access is enforced in the database with row-level security.
• Supabase: database and authentication.
• Vercel: hosting, server logs, Web Analytics and storage of uploaded logos.
• Resend: delivery of sign-in emails and the documents you send.
• Google: Google Analytics, only after you accept it. Google never receives your invoice or client data.

These providers process data for us under their data processing terms. Some of them store or access data outside the UK, including in the United States; those transfers rely on the safeguards in their terms, such as the UK International Data Transfer Addendum to standard contractual clauses or the UK extension to the EU-US Data Privacy Framework.

Uploaded logos are stored as public files: anyone who has the exact file link can open them. Only upload images you are happy to print on your invoices.

How long we keep it

• Company data is kept for as long as the company exists in FoxInvoices.
• When you delete your login (on the Your login page in the dashboard), every company you are the only owner of is deleted with all of its data and uploaded logos. Companies that have another owner stay available to that owner, including documents you created there.
• Server and sign-in logs are kept only as long as needed for security and troubleshooting. Deleted data can remain in our providers' backups for a limited time until those backups are replaced.

Cookies and analytics

We use essential cookies to keep you signed in and to remember which company you are working in. They are always on because the service cannot work without them.

Google Analytics helps us understand how people find FoxInvoices. It does not load at all until you press Accept in the cookie banner, and even then it only runs on our public pages (home, terms, privacy and contact), never in the dashboard. If you press Reject or close the banner, nothing is sent to Google. You can change your choice at any time: Cookie settings. Withdrawing consent stops Google Analytics and removes its cookies.

We do not use advertising or cross-site tracking cookies.

Your rights

Under UK GDPR you have the right to:

• Access your data. Everything you entered is visible in the dashboard, and you can ask us for a copy.
• Take a copy with you: download invoices as PDFs and export invoices, credit notes and clients as CSV from Reports.
• Correct inaccurate data by editing it, or by asking us.
• Erase your data by deleting your login, as described above, or by asking us.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent to Google Analytics at any time.

If your clients ask about data you hold about them in FoxInvoices, you handle that request as their controller; we will help where we can.

To use any of these rights, email support@foxinvoices.space. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to put things right first.

Changes

If we update this policy we will change the date above and announce material changes inside the app.