Privacy Policy

Invoots is bookkeeping and accounting software for small businesses in the United Kingdom. It is provided by Invoots, a business established in the United Kingdom.

For the personal data described in this policy, Invoots is the data controllerin respect of your account and billing information. Where you enter your own customers’, suppliers’ or employees’ details into your books, you are the controller of that data and we act as your data processor, processing it only on your instructions.

You can contact us about anything in this policy at info@invoots.com.

We collect the following categories of personal data:

• Account data — your first and last name, email address, telephone number if you choose to provide one, and a securely hashed form of your password. We never store your password in a readable form.
• Company data — the name, address, contact details, VAT registration number and financial-year settings of each business you manage in Invoots, plus the roles and permissions of the people you invite.
• Bookkeeping data you enter — customers, suppliers, products and services, sales receipts, bills, expenses, payments, bank statement lines and the chart of accounts for each company. This may include personal data about your own customers and suppliers, which you control.
• Technical and security data — IP address, browser and device type, and timestamps of sign-in attempts and significant actions, recorded in our application and security logs.
• Correspondence — messages you send us by email or through a support channel, and our replies.

We do not buy personal data from third parties, and we do not run advertising, analytics or tracking scripts belonging to third parties on this site.

• To provide the service — creating and running your account, storing your books, producing your reports and VAT figures. Lawful basis: performance of a contract with you.
• To keep the service secure — authenticating you, detecting and investigating suspicious sign-ins, preventing fraud and abuse, and maintaining audit trails. Lawful basis: legitimate interests in protecting our users and our systems.
• To support you — answering your questions and diagnosing faults you report. Lawful basis: performance of a contract and legitimate interests.
• To meet legal obligations — retaining records where tax, accounting or company law requires it, and responding to lawful requests from authorities. Lawful basis: legal obligation.
• To send service messages — for example password resets, security notices and material changes to the service. Lawful basis: performance of a contract. These are not marketing messages and cannot be unsubscribed from while your account is open.

Invoots uses cookies that are strictly necessary to operate the service. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies, which is why you are not shown a cookie consent banner — strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations.

• Authentication cookies — a short-lived access token and a longer-lived refresh token that keep you signed in as you move between pages. They are set as HttpOnly and Secure cookies, so they cannot be read by JavaScript in your browser and are only sent over HTTPS.
• Company selection cookie — records which of your companies you are currently working in, so you are not asked on every page.
• Preference storage — your light or dark theme choice is stored locally in your browser and is never sent to us.

Your session ends when you sign out, when your refresh token expires, or after a period of inactivity. Clearing cookies in your browser will sign you out.

Your data is hosted on Amazon Web Services in the AWS eu-west-2 (London) region. Your bookkeeping records and account data are stored and processed in the United Kingdom and the European Economic Area, and are not routinely transferred outside the UK or EEA.

Where a service provider we rely on necessarily processes limited data outside the UK or EEA, we only use providers that offer appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Data is encrypted in transit using TLS, and encrypted at rest in our hosting environment. Access to production systems is restricted to personnel who need it and is logged.

We do not sell your personal data, and we do not share it for advertising. We share data only with:

• Infrastructure providers — our hosting and database providers, who store the data on our behalf under contract.
• Service providers — for example transactional email delivery and error-monitoring services, acting as our processors and permitted to use the data only to provide that service to us.
• People you invite — anyone you add to one of your companies can see the data their assigned role permits.
• Authorities and advisers — where we are required to disclose by law, or where necessary to establish, exercise or defend legal claims.
• A successor — if the business is reorganised, merged or sold, in which case your data remains subject to this policy or a policy at least as protective.

• While your account is open — we keep your account and bookkeeping data for as long as you maintain an account, because it is the record of your business.
• After closure — when you close your account we delete or anonymise your personal data within 90 days, except where we must keep it longer.
• Financial records — records needed for tax and accounting purposes are retained for six years plus the current financial year, in line with HMRC and Companies House requirements.
• Security logs — sign-in and security logs are kept for up to 12 months.
• Backups — deleted data may persist in encrypted backups for up to 35 days before those backups are rotated out.

You can export your bookkeeping data from within the application before closing your account.

You have the right to:

• Be informed about how we use your data — which is the purpose of this policy.
• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete. Most account details can be corrected directly in your settings.
• Erasure of your data where we no longer have a lawful reason to keep it.
• Restrict processing in certain circumstances, for example while you contest the accuracy of data.
• Data portability — to receive the data you provided in a structured, commonly used, machine-readable format.
• Object to processing carried out on the basis of our legitimate interests.
• Withdraw consent at any time, where we rely on consent for a particular use.

To exercise any of these rights, email info@invoots.com. We will respond within one month. We may need to verify your identity before acting on a request.

If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to address your concern first.

Invoots is a business product and is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy as the service develops or the law changes. The date at the top of this page shows when it was last revised, and we will notify account holders by email before any change that materially affects your rights takes effect.

For anything in this policy — including a data subject request — email info@invoots.com. This address is monitored and reaches the data controller directly.

See also our Terms of Service.