Privacy Policy | Zinvoice

1. Who this policy covers

This policy covers visitors to the Zinvoice website, account holders, people whose details are entered into a Zinvoice workspace, and recipients invited to read or sign an agreement through Zinvoice.

2. Controller and processor roles

Privacy and account questions can be sent through the contact form on the website.

Zinvoice is operated by Rob Saunders trading as Zinvoice. For the activities where Zinvoice decides why and how personal data is used, Rob Saunders trading as Zinvoice is the data controller.

For account administration, website operation, support, billing, service communications, fraud prevention, and platform security, Zinvoice acts as a data controller.

For client, customer, invoice, address, payment, and expense data that a user uploads to the service for their own business purposes, the user will usually be the data controller and Zinvoice will usually act as a processor or service provider on that user's behalf. In practice, that means the user decides why the data is being used, while Zinvoice provides the software and hosting needed to process it.

The same normally applies to agreements and signing records. The Zinvoice account holder who sends the agreement decides why it is sent, who receives it, what it contains and how the resulting record is used. Questions about the agreement itself, or requests concerning that business's use of signing data, should normally be directed to the sender first.

3. The personal data we may process

Account and website data

Name, email address, phone number, company details, login activity, and support-related communications.

Service content

Invoices, repeat invoice schedules, client names, billing addresses, expense details, and payment records entered by the user.

Agreement and signing data

The agreement PDF, sender and recipient names and email addresses, business or address details included by the sender, the name typed when signing, the acceptance statement, and dates and times for sending, opening, downloading, signing, completion, cancellation or expiry.

What the agreement record does not collect

The agreement signing feature does not add the recipient's IP address, browser user-agent string or device fingerprint to the agreement or its activity history.

The sender supplies the agreement, recipient name and recipient email address. A recipient who chooses to sign supplies the typed signing name and acceptance confirmation. Zinvoice then creates the relevant timestamps, signed copy and activity record. The typed name and confirmation are required to complete the electronic-signature step; without them, Zinvoice will not record the agreement as signed.

4. Why we use personal data

To provide and secure the Zinvoice service.
To create and manage user accounts.
To deliver invoice, receipt, and service-related emails.
To deliver agreements, provide private read-and-sign pages, record electronic acceptance, create signed PDFs, and keep the related activity history.
To maintain platform performance, integrity, and auditability.
To respond to support requests and operational issues.
To comply with legal obligations, prevent misuse, and protect the platform.

5. Lawful bases

Where Zinvoice acts as controller, we generally rely on contract, legitimate interests, and legal obligation, depending on the processing involved.

Where an account holder uses Zinvoice to send an agreement, that account holder is normally responsible for identifying and documenting the lawful basis for using the recipient's details and signing record. Zinvoice processes that data to provide the requested service.

6. Sharing and service providers

We may use trusted service providers for hosting, infrastructure, transactional email delivery, queue processing, backups, security, and related platform operations. This can include delivering an agreement link and emailing a completed signed PDF to the sender and recipient. Providers only receive the data needed for the relevant service.

7. International transfers

Some service providers may process data outside the UK. Where that happens, we expect appropriate safeguards to be used, such as adequacy decisions or contractual protections where required.

8. Retention

We keep personal data only for as long as reasonably necessary for account operation, service provision, security, dispute handling, backup integrity, and legal compliance.

If a subscription is cancelled or remains unpaid, workspace access may be limited or locked. Where a renewal payment remains past due, the workspace is normally locked after three days. In that situation, we may retain account data for up to 90 days to give the account holder a fair chance to reactivate. After that, the workspace and related data may be permanently deleted, and we aim to send warning emails before that happens.

During an account lock, repeat invoices due under existing schedules may be generated as drafts only. They are not sent automatically to clients while the workspace is locked.

Agreement files, recipient details, signing names, signed copies and activity records form part of the account holder's workspace data. They are retained and deleted with that workspace under the same account-retention process, subject to limited backup rotation and any legal reason requiring particular records to be kept for longer. Senders and recipients should keep their own copy of any signed agreement they need.

9. Your rights

Depending on the circumstances, you may have rights to access, rectify, erase, restrict, or object to certain processing, and to complain to the Information Commissioner's Office if you believe your personal data has been handled unlawfully.

For customer and client data stored in a user account, requests may need to be directed to the relevant user as controller first.

If you received or signed an agreement through Zinvoice, the business or person who sent it will usually be the controller for that agreement and its signing record. Contact the sender first where possible; Zinvoice will assist the sender with an appropriate request where required.

10. Contact and complaints

If you have a privacy question or complaint, contact Zinvoice through the website contact form. You also have the right to raise concerns with the Information Commissioner's Office.