Privacy Policy

1. Introduction

Paido ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our invoicing service.

We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us:

• Account information (name, email address, password)
• Business information (company name, address, VAT number)
• Client information (names, addresses, contact details)
• Invoice data (products, services, pricing)
• Payment information (processed securely by Stripe)

2.2 Automatically Collected Information

• Device and browser information
• IP address and location data
• Usage data and analytics
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your information for the following purposes:

• To provide and maintain our invoicing service
• To process your subscription payments
• To send you transactional emails (invoices, receipts)
• To provide customer support
• To detect and prevent fraud or security issues
• To comply with legal obligations
• To improve our services and develop new features

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Contract Performance: To provide our invoicing services to you
• Legal Obligation: To comply with tax, accounting, and other legal requirements
• Legitimate Interests: To improve our services, prevent fraud, and ensure security
• Consent: For marketing communications (where applicable)

5. Information Sharing and Disclosure

5.1 Third-Party Service Providers

We share your information with trusted third parties who assist us in operating our service:

• Stripe: Payment processing (PCI-DSS compliant)
• AWS / Cloud Provider: Hosting and infrastructure
• Email Service Provider: Transactional email delivery
• Analytics Services: Usage analytics and service improvement

5.2 Legal Requirements

We may disclose your information if required by law, legal process, or to protect the rights and safety of ourselves and others.

6. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained while your account is active
• Invoice data: Retained for 6 years (UK tax requirements)
• Transaction logs: Retained for 12 months
• Audit logs: Retained for 12 months

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing communications

To exercise any of these rights, please contact us at accountant@paido.app

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit (HTTPS/TLS)
• Encrypted database connections
• Secure password hashing (bcrypt)
• Regular security audits
• Access controls and authentication
• Audit logging for security events

9. Cookies

We use cookies and similar tracking technologies to improve your experience. For detailed information about our cookie usage, please see our Cookie Policy.

10. International Data Transfers

Your data may be transferred and processed in countries outside the UK. We ensure appropriate safeguards are in place, including:

• EU-US Data Privacy Framework compliance
• Standard Contractual Clauses with service providers
• Adequacy decisions by the UK government

11. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

14. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the supervisory authority: