Privacy Policy

TidyBill is operated by Pixel Bridge Lab Ltd (company number 17106644), registered in England and Wales. We are committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what data we collect, why we collect it, how we use it and what rights you have. If you have any questions, please contact us at hello@tidybill.co.uk.

Data controller

Pixel Bridge Lab Ltd is the data controller responsible for your personal data. You can reach us by email at hello@tidybill.co.uk.

What data we collect

We collect and process the following personal data when you use TidyBill:

• Account information: your name, email address and a securely hashed password.
• Company information: business name, trading name(s), registered address, company number, VAT number and contact details.
• Invoice and financial data: invoices, quotes, credit notes, payment records and client details that you create within the platform.
• Usage data: log in timestamps, feature usage and session information used to improve the service.

Why we collect your data

We collect your data to provide and improve the TidyBill invoicing service. This includes creating and managing your account, generating and sending invoices on your behalf, processing payments tracking, and communicating with you about your account.

Legal basis for processing

We rely on the following lawful bases under the UK GDPR:

• Contract performance (Article 6(1)(b)): processing is necessary to provide you with the TidyBill service that you have signed up for.
• Legitimate interest (Article 6(1)(f)): we process certain data to improve our service, prevent fraud and ensure security.
• Legal obligation (Article 6(1)(c)): we may be required to retain certain financial records under UK law.

Data retention

We retain your personal data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days. However, we are required by UK law to retain financial records (invoices, credit notes, payment records) for a minimum of 7 years after the relevant tax year. These records will be anonymised where possible.

Receipt files you upload are deleted from our storage when you delete the related expense or close your account. Internal activity logs, which may reference client email addresses, are automatically deleted after 18 months.

Third party processors

We use the following third party service providers to operate TidyBill. Each processor has been selected for their commitment to data protection:

• Hosting (20i, United Kingdom): the TidyBill application and its database, including your invoices, clients and account data, are hosted on servers located in the United Kingdom.
• Stripe (payments): we use Stripe to manage your subscription. Stripe receives your name and email address. Your card details are entered directly with Stripe and are never seen or stored by TidyBill.
• Google Cloud Storage (receipts): receipt images and PDFs you upload to the expenses feature are stored using Google Cloud Storage.
• Google Cloud Vision (receipt scanning): when you scan a receipt, its contents are sent to Google Cloud Vision to read the text automatically (OCR).
• Resend (email): we use Resend to send transactional emails such as invoice delivery, account notifications and password resets.

Your account and invoicing data are stored in the United Kingdom. Some processors, in particular Google Cloud (used to store and read the receipts you upload), may process data outside the UK. Where that happens, the transfer is protected by appropriate safeguards, such as data protection commitments from the provider and standard contractual clauses.

We do not sell, rent or share your personal data with any third parties for marketing purposes.

Your rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct any inaccurate or incomplete data.
• Right to erasure: you can request that we delete your personal data, subject to legal retention requirements.
• Right to data portability: you can request your data in a structured, commonly used and machine readable format.
• Right to restrict processing: you can ask us to limit how we use your data in certain circumstances.
• Right to object: you can object to processing based on legitimate interest.

To exercise any of these rights, please email us at hello@tidybill.co.uk. We will respond within 30 days.

Cookies

TidyBill uses only essential session cookies that are strictly necessary to operate the service. These cookies keep you signed in and maintain your session. We do not use any tracking cookies, analytics cookies or third party advertising cookies. Because these cookies are essential for the service to function, no consent banner is required.

Data security

We take the security of your data seriously. All data is transmitted over encrypted HTTPS connections. Passwords are stored using industry standard one way hashing algorithms. We regularly review our security practices and access controls to protect against unauthorised access, alteration, disclosure or destruction of your personal data.

Children's privacy

TidyBill is a business tool intended for use by adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to this policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you by email or through a notice within the TidyBill application. We encourage you to review this page periodically.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk/make-a-complaint or by phone on 0303 123 1113. We would appreciate the chance to address your concerns before you contact the ICO, so please reach out to us first at hello@tidybill.co.uk.

Contact us

If you have any questions about this privacy policy or our data practices, please contact us: