Who we are
TheInvoiceAI (theinvoiceai.com) is operated by SmartFing Ltd, a company registered in the United Kingdom. In this policy "we" and "us" mean SmartFing Ltd. For our users' personal data we are the controller under the UK GDPR and the Data Protection Act 2018 (and the EU GDPR where it applies). Questions or requests: support@theinvoiceai.com.
Your clients' data
When you add clients and send them invoices, estimates or reminders, you decide what data goes in. For that data you are the controller and we act as your processor: we only use it to provide the service to you, keep it confidential, and delete it when you delete it or close your account. Clients who open a pay page or estimate link don't need an account. We record when an invoice is first viewed so we can tell you.
What we collect
- Account: your email address, plus your name and profile picture if you sign in with Google.
- Business profile: business name, address, VAT number, logo, the payment details you add to invoices, and settings.
- Your work: clients, invoices, estimates, payments, expenses and receipts, reminders and notifications.
- What you give the AI: text, PDFs, screenshots and receipts you paste or upload, and the questions you ask. Voice dictation is turned into text by your browser (e.g. Chrome or Edge), not by us.
- Billing: your plan and subscription status from Paddle. Paddle handles your card and billing address. We never see card numbers.
- Payments from your clients: amounts and status from Stripe. Card details stay with Stripe.
- Technical: IP address and basic request logs (for security, rate limits and fixing errors), and a monthly count of AI actions.
Why we use it (legal basis)
- To provide the service you signed up for, including sending the emails you ask us to send: contract.
- To keep the service secure, stop abuse (rate limits, bot checks) and fix problems: legitimate interests.
- To keep billing and tax records: legal obligation.
- Waitlist and product news emails: consent, which you can withdraw at any time.
We don't sell your data, don't show ads, and don't use your data or your clients' data to train AI models.
AI features
When you use an AI feature, the content you provide is sent to Anthropic's API to produce a draft. Anthropic doesn't use API data to train its models and keeps it only for a limited time for safety and abuse monitoring. The AI only fills in forms that you review. Nothing is sent to a client until you choose to send it.
Who we share it with
We use these service providers (processors), each bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage (logos, receipts) | Company in the US; data hosted in its cloud region |
| Vercel | Hosting the website and app | Global network, company in the US |
| Anthropic | AI: reading what you paste or upload to draft invoices, reading receipts, answering questions, writing reminders | US |
| Resend | Sending emails: sign-in links, invoices, reminders, notifications | US |
| Stripe | Card payments from your clients, through your own Stripe account (Stripe Connect) | US / EU |
| Paddle | Selling the Pro plan as our reseller and merchant of record: checkout, tax, receipts, refunds | UK |
| "Continue with Google" sign-in, only if you use it | US | |
| Cloudflare | Turnstile bot check on guest sign-up and AI features, when switched on | Global network, company in the US |
Your clients receive what you send them. We may also disclose data where the law requires it. Some providers are outside the UK and EU. Those transfers are covered by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.
How long we keep it
- Your account and work: while your account is open. When you ask us to close it, we delete it within 30 days, except records we must keep by law.
- Guest accounts (trying the app without signing up): deleted automatically after 30 days unless you save your work with an email address.
- Billing records: 6 years, as UK tax law requires (kept by Paddle as merchant of record, and by us).
- Server logs: up to 30 days.
Cookies
We only use cookies the service needs to work: the sign-in session cookie, plus cookies set by Paddle's checkout or Cloudflare's bot check when those are used. There are no advertising or analytics cookies, which is why there is no cookie banner.
Your rights
You can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent. Email support@theinvoiceai.com and we'll reply within one month. You can also edit most of your data yourself in the app. If you're a client of one of our users, please contact them first: they control that data, and we'll help them. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Security
Data is encrypted in transit and at rest. Each account can only reach its own records (database row-level security), receipts are stored privately, and payment card data never touches our servers.
Children
TheInvoiceAI is a business tool and isn't meant for anyone under 18.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the app before the change applies. See also our Terms of service and Refund policy.