Your privacy.
What personal data we collect, why, where it goes, how long we keep it, and your rights under UK GDPR.
Version 1.2 · 2 October 2026
1. Who we are
InvoicePro is operated by AX Studio Labs Ltd, company number 17076527, registered in England and Wales, whose registered office is at 17 Oxhayes Close, Balsall Common, Coventry, CV7 7PS. We are the data controller for the personal data described in this policy. For any data protection query, email privacy@invoicepro.co.uk. We are registered with the UK Information Commissioner's Office as a data controller, registration reference ZC223349.
InvoicePro is a separate product from StatementPro, also operated by AX Studio Labs Ltd. They share no account and no database, and personal data is not moved between them. Card payments for both are taken through the same Stripe account, under separate customer records.
2. What this policy covers
The personal data we process when you create or are given an InvoicePro account and use it to convert invoice documents into schedules. It does not cover third-party sites you reach from links in our service.
3. The personal data we process
- Account data — your email address, the firm your account belongs to, and sign-in timestamps.
- Billing data — if you pay by card: your billing email and name, which option you chose, and the status of your payments. Card details are entered on Stripe's page and held by Stripe; we never see or store a card number.
- Usage data — a record of each job: when it ran, how many documents it held, how many were billable, and the price that applied.
- Document contents — the files you upload and the rows extracted from them. These routinely contain personal data about third parties: supplier contacts, sole traders' names and addresses, and similar.
- Technical data — request logs and IP addresses, generated by our hosting provider in the ordinary course of serving the site.
We do not use cookies for advertising or analytics profiling. The only cookie we set is the one that keeps you signed in.
4. Your clients' data — who is responsible for what
Where you upload documents relating to your clients, you are the controller of the personal data inside those documents and we are your processor. We process it only on your instructions — which, in practice, means converting the documents you upload and letting you download the result. A Data Processing Agreement is available on request.
5. Why we process it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Giving you an account and signing you in | Performance of a contract |
| Converting your documents and storing the output for re-download | Performance of a contract |
| Taking payment by card, through Stripe | Performance of a contract |
| Keeping a usage record so we can bill you | Performance of a contract; legal obligation for accounting records |
| Keeping the service secure and diagnosing faults | Legitimate interests |
| Answering a support request you raise | Legitimate interests |
We do not sell personal data, we do not share it for advertising, and we do not use your documents or your clients' documents to train models.
6. Who we share it with
Five sub-processors, each listed with its role, region and what it can see, on our security page. In summary: Render (hosting and file storage, Frankfurt), Supabase (authentication and database, London), Anthropic (reading document contents during conversion, United States), Resend (sign-in emails, United States) and Stripe (card payments, UK, EU and United States). Stripe also acts as an independent controller of payment data for fraud prevention and its own legal obligations, under its own privacy policy. We may also disclose data where we are legally required to.
7. How long we keep it
Uploaded source files are kept until the job they belong to is deleted. There is no scheduled deletion: you can remove any job, and the files that came with it, yourself at any time from the app, and we will act on a written request to delete within five working days. Extracted rows are stored with the job so it stays re-downloadable, and go when it goes. Usage records are retained for as long as required for accounting and tax purposes; when files are deleted the usage record keeps the fact and the date. Account data is deleted when your account is closed, subject to those record-keeping obligations.
8. Your rights
You have the right to be informed, to access, to rectification, to erasure, to restrict processing, to data portability and to object. To exercise any of them, email privacy@invoicepro.co.uk — we respond within 7 working days, and in any event within one month as the legislation requires. If you are not satisfied, you may complain to the Information Commissioner's Office at ico.org.uk.
9. Security
Encryption in transit and at rest, per-row access control enforced at the database, magic-link sign-in with no passwords stored anywhere, and no upload until a payment arrangement is in place. The detail, including where documents are read, is on the security page.
10. Changes to this policy
If we change it materially we will email account holders and update the version and date at the top of this page. Previous versions are available on request.