GDPR and UK hosting
Your data is stored in the United Kingdom, protected under UK GDPR and the Data Protection Act 2018.
Draft for review. Have this checked by a solicitor before publishing, replace every item in [square brackets], then delete this box.
Where your data lives
Invoice Universe runs on servers provided by Hostinger in their United Kingdom data centre. Your account, clients, quotes, invoices, uploaded logos and signed documents are stored there. Our backups are kept in the UK too: one copy with Hostinger and an encrypted copy with a second UK storage provider, so we can recover even if one provider fails.
Our service providers
| Provider | What for | Where data is processed |
|---|---|---|
| Hostinger | Hosting the app, database and backups | United Kingdom |
| [Offsite backup provider] | Second encrypted backup copy | [United Kingdom] |
| Stripe | Card payments from your clients, and subscription billing | UK, EU and USA, under the UK International Data Transfer Addendum |
| [Email sending provider] | Sending quotes, invoices and reminders | [Location] |
| Google reCAPTCHA | Stopping bots on forms | USA, under the UK Extension to the EU-US Data Privacy Framework |
Where a provider handles data outside the UK, we rely on UK adequacy regulations or the ICO's approved transfer terms.
Who is responsible for what
- Your account details: we are the controller.
- Your clients' details: you are the controller and we are your processor. We act only on your instructions, keep it confidential and help you meet your own GDPR duties. Our data processing agreement is part of our terms, and a signed copy is available on request.
How we protect it
- Encryption in transit (HTTPS) and for backups at rest.
- Staff accounts have two-step login and only the access their role needs. Our IT developer cannot see your clients, invoices or bank details.
- Your company data is confidential: nobody, including Invoice Universe staff, can see it unless you authorise it. Support access is only by your approval, read-only, time-limited, logged and shown to you.
- Backups are tested by restoring them to a separate test system every month.
- Automatic error reports are only sent with your consent and contain no client or invoice details.
Customers outside the UK
Invoice Universe is used by businesses in many countries. Wherever you are, your data is stored in the UK and protected to UK GDPR standards. For customers in the European Economic Area, transfers to the UK rely on the European Commission's adequacy decision for the UK. If you are elsewhere (for example the USA, Canada, Australia, India or the UAE), local privacy laws may give you extra rights, and we will help you use them. [Have your adviser confirm this for the countries you sell to.]
Your rights
You can export everything from the app at any time (accountant export or an encrypted full backup), and ask us to see, correct or delete your data. See our privacy policy, or email mail@invoiceuniverse.com. If you're not happy with our answer, you can complain to the ICO at ico.org.uk.