Privacy Policy

Last updated: 16 October 2026  ·  Unobtrusive Ltd

1. Who we are

Sendinvo is operated by Unobtrusive Ltd (“we”, “us”, “our”). We provide a cloud-based invoicing and job management platform for small businesses. Our registered contact address is available on request at privacy@sendinvo.com.

Who is responsible for what. Your business decides what it keeps in Sendinvo about its clients, the people it deals with there, and its own team. For that data your business is the controller, and we process it on your business’s behalf, as “Data processing” in our Terms of Service sets out. If you are one of those clients, ask the business that sent you the invoice or quote about your data. For your own account, your subscription, and the counts described in sections 4 and 6, we are the controller.

2. What data we collect

Account data. When you register we collect your name, email address, and password (stored as a one-way hash, we never see it in plain text). Your account is given an identifier of its own, which is how your work is linked to you across the service.

Free access. If we give a business free access to Sendinvo, we keep the email address we gave it to, a short note to remind us who it is for, and when it starts and ends, so it reaches the account that signs up with that address. We keep this while the free access lasts and for 12 months after it ends, then delete it.

Your business. Its name and address, its company and VAT numbers, and the bank details that appear on your invoices so your clients know where to pay.

Your clients. Each client’s name and billing address, and its phone number and VAT number if you enter them. The people you deal with there: each person’s name, email address, and phone number, the role you note for them, and whether they get your invoices and quotes. The sites where you do the work, each an address and, if you give one, the short name you pick it by.

Your documents. Invoices, quotes, credit notes and recurring schedules: what is on them, the site and reference they carry, the notes you add, the text of the emails they go out in and who they went to, and the payments recorded against them, each with how it was paid: bank transfer, cash, card, cheque, or other. A card payment your client makes online is taken on Stripe’s page, and we never see the card.

Your saved items. The things you charge for again and again, each with a name, a price, the unit it’s priced by, and, if you give one, a VAT rate of its own.

What people on your team do. When an owner or admin invites someone, we keep the email address the invite goes to and the role it gives them. When someone sends, changes, or deletes something, we record who it was and when. Everyone in the business except people in the Field role can read that record, under Team activity and on each document’s Activity. Someone in the Field role sees only the visits given to them and the jobs those are on, with each client’s name, address, and phone number, and no prices. They hear the voice notes on those jobs, except a note on a job whose notes are kept from them.

Jobs, their photos, files and voice notes. If your business uses jobs: each job’s name, its site and who to ask for there, its notes, and its visits, each with its day and time, how long it is, who it’s for, its notes, and when it was started and finished. When you book or move a visit, we email your client when it is and where, and on a team the first name of who’s coming, unless you choose not to tell them. The photos you take on a job, each with when your phone says it was taken and who took it, are kept in Cloudflare’s storage in the European Union, made smaller on your phone or in your browser before they leave it, which leaves behind where they were taken. They are read back only through addresses we make for your business, each working for an hour. A photo is deleted when someone deletes it, or with its job or your business. The files you keep on a job or a visit, such as a certificate, a drawing, or a supplier’s quote, each with its name, when it was added, and who added it, are kept the same way: in Cloudflare’s storage in the European Union, a picture without the record of where it was taken, read back only through addresses we make for your business, each working for an hour. A file is deleted when someone deletes it, or with its job or your business. Sendinvo keeps a file as you give it and says nothing about what it certifies. The voice notes you record on a job, each with when it was recorded, how long it is, and who recorded it, are transcribed on your phone by iOS. The recording is kept in Cloudflare’s storage in the European Union, and its text with the rest of your business’s data. Recordings are played back only through addresses we make for your business, each working for an hour, and deleted when someone deletes them, or with their job or your business. If you record someone else, such as your client, tell them first: the recording is your business’s, and so is the duty to tell them.

Your calendar. Each person can add their visits to a calendar app such as Apple Calendar or Google Calendar, by a private link from Calendar, in your account: each visit’s time, job, client, site, and who to ask for there with their phone number, and never a price or a note. If you add your calendar link to a calendar app, that app’s provider fetches your visits from us and keeps them under its own terms. Reset the link in Calendar to stop it. We keep when the link was last fetched and which kind of calendar app fetched it, so Calendar can say it’s working.

Files you attach. Documents and photos you attach to an invoice, quote or credit note email are stored so we can send them, and deleted with the document they belong to. A file kept on a job and chosen to go with that job’s invoice isn’t copied: it is read from the job when the email goes. Once the email has gone, your client has their copy, and deleting the file from the job afterwards doesn’t change the email they received.

Emails you send us. If you email us, for example from Help or Send feedback, we keep your email address, your message, and anything you include with it. Send feedback starts the email with details that help us answer: from the app, its version, your iPhone’s model and its iOS version; from our website, your browser and its version. We use them to answer you and to improve Sendinvo. Our mailboxes are provided by Google, which holds these emails for us. We keep an email only for as long as we need it to answer you and deal with what you raised, then delete it.

Usage data. We collect basic server logs (IP address, timestamps, HTTP method and path) for security and debugging. These are kept for a limited period, no more than 30 days, then deleted.

Your accounting software. If an owner or admin connects your business’s accounting software (Xero or QuickBooks), it becomes somewhere your business’s data goes, at your request. You sign in on Xero’s or Intuit’s own page, so your password there never reaches us. To set it up we read your organisation’s name, VAT number, currency, chart of accounts, VAT rates, CIS setting, and contacts, so we can say where things will be recorded and which contact each of your clients is. We keep the organisation’s name and VAT number, Xero’s identifier for the person who connected it, and which contact each client is matched to. From the start date you choose, we send it every invoice and credit note that goes out from Sendinvo, each with the PDF your client received, and the payments against them, so you don’t type them twice. A client that isn’t in Xero yet is added with its name, email address, VAT number, and billing address; a contact already there is never changed. If you take payments through Stripe, we may add a bank account called “Stripe (Sendinvo)” and a contact called Stripe to it. For a payment through Stripe we also send the fee Stripe took from it. If you void or replace an invoice or credit note, we void it in Xero too, and when Mark unpaid takes a payment back, we delete it there. Xero holds what we send under your business’s own agreement with Xero. We keep the access Xero grants us encrypted, and never show it to your browser or your phone. Disconnecting stops anything more going across and ends that access; it deletes nothing, in Sendinvo or in Xero. QuickBooks works the same way, with five differences: from QuickBooks we read your company’s name and country rather than its VAT number, currency, or CIS setting, and keep only its name, with nothing about who connected it; a client is added there without its VAT number, and with a note of Sendinvo’s reference for it; each line is recorded under an item called “Sendinvo” that we add; Stripe’s fee is recorded with no contact, so no Stripe contact is added; and a credit note you void is deleted in QuickBooks, because QuickBooks can’t void one.

3. The Sendinvo app for iPhone

The app is the same service. Your account, your business details and your documents are the same data described above, whichever way you sign in. Eight things are particular to the app, and one thing it deliberately does not do.

Signed-in devices. When you sign in on a phone we store the device’s name and whether it is an iPhone or an iPad, so you can see where you are signed in and sign a device out from anywhere. The sign-in tokens themselves are stored as one-way hashes, the same way your password is.

Notifications. If you allow notifications, the app gives us the token Apple issues for Sendinvo on that device. We keep it with that device’s sign-in so we can tell you when a client pays, when a quote is accepted or declined, when a scheduled or recurring invoice wasn’t sent, and, if you hold retentions, when a retention is due for release. A notification says what happened: who paid and how much, which quote was answered, which invoice wasn’t sent and why, or how much retention is due from which client. That text reaches your phone through Apple’s push notification service. You choose which ones you get under Notifications in the app’s profile. Signing the device out removes the token. Turning notifications off in Settings removes it the next time you open the app. A device signed out with no signal keeps its token until Apple tells us it no longer works, or until the sign-in lapses 60 days after it was last used.

The camera, the microphone and Face ID. The app uses the camera only when you choose to take a photo or scan a document, to attach to an email, to use as your company logo, or to add to a job. A photo you choose from your library instead is the one you pick, and the app sees no other. It uses the microphone only while you record a voice note on a job, and stops when you let go, when a call comes in, or when you leave the app: it never records in the background, and never records a call. iOS turns the recording into text on your phone, so it isn’t sent to Apple or to us to be transcribed. It asks for Face ID when App lock is on, and before a refund, deleting your account or a company, or transferring ownership of a company. iOS does the recognising and tells the app only whether it worked; nothing about your face reaches the app or us.

The share sheet. You can send a PDF or a picture to a job from another app’s share sheet, by choosing Sendinvo there. So the share sheet can offer today’s visits and your recent jobs, the app keeps their names, clients, and times in a folder on your iPhone that only Sendinvo and its share sheet can read, and a file you share waits in the same folder until it has uploaded. Signing out removes both.

Your location, for On my way. When you press On my way in the iPhone app, the app can ask Apple Maps how long the drive to the visit will take. To do that it reads your iPhone’s location once, with your permission, and sends it to Apple for the route. Your location is never sent to us, and we don’t keep it.

Messages to your clients. The app can open Messages or WhatsApp on your phone with a message to your client written for you, and our website can open WhatsApp or Messages on your computer the same way. You send it from your own account; we don’t send it, see it, or receive replies. We record in your company’s Activity that you sent it or opened WhatsApp or Messages to send it, who to, and when, but not what it said.

Diagnostics. When syncing goes wrong the app sends us a short report, so we find out before you have to tell us. It carries what went wrong, which half of syncing it happened in, which of our two syncing addresses it was, the HTTP status, a short error code, and the app and iOS versions. There is no field your clients’ names, amounts, email addresses or anything you have typed could travel in, and the server refuses a report that carries anything else. We store none of it: the report goes to our error-tracking system and nowhere else.

Purchases. If you subscribe in the app, Apple takes the payment. We never see your card details or your Apple Account. Apple tells us that a subscription exists, which one it is and when it renews, and we record that against your business so the app knows you are subscribed.

What the app does not do. It carries no analytics or advertising kit, from us or anyone else, it has no advertising identifier, and it does not ask to track you. The counts in section 4 are worked out on our servers.

4. How we use your data

We use the data you provide to operate and improve Sendinvo, specifically to send invoices on your behalf, process payments, and communicate with you about your account. We also count what each business does in Sendinvo: whether it sent an invoice within a day of signing up, how many invoices, clients, and recurring schedules it has, how many of its invoices are paid, and when it last made one. Across every business together, we add up how much has been paid on invoices. These tell us how Sendinvo is used, and whether a change we make helps the people who sign up. Only we see them. We do not sell your data, we never use it for advertising, and neither our website nor the app carries anyone else’s analytics or advertising tags.

5. Who we share data with

We share data with the following sub-processors who act on our instructions:

Some of these companies, such as Stripe, Apple and Resend, handle data outside the UK and the European Economic Area, mainly in the United States. Where they do, the transfer is made under the safeguards UK data protection law requires, as set out in that company’s data processing terms.

Services you connect. These receive your business’s data because you asked us to send it to them, and hold it under your business’s own agreement with them. They aren’t our sub-processors and don’t act on our instructions.

6. Cookies and similar storage

We use no advertising or analytics cookies, and nothing from Google, Microsoft or any other analytics or advertising company runs on our website or in the app. So there is nothing to consent to and no cookie banner. What is left is below.

Essential. When you sign in we set a session cookie so the app knows it is you. It cannot be read by JavaScript and is required for the service to work. In the web app we also keep, in your browser: a flag recording that you are probably signed in, which stops the marketing page flashing up before the app loads; a copy of your recent invoices and your clients, so the lists open straight away, removed when you sign out; a document you are copying from one screen to another, until that screen opens; which app you last sent each client a message from, and the arrival time you last chose for On my way; and a note that stops a page reloading itself twice after we update the site. The demo keeps its made-up business in your browser, so it is still there when you come back. None of this leaves your browser except to do what you asked.

Our own analytics. We count page visits ourselves to see which pages people find useful. This sets no cookies and stores nothing in your browser. Visits are counted using a fingerprint that is re-salted every day, so we can tell how many people visited without ever storing your IP address and without following you from one day to the next. For each visit we keep the page’s address, the address of the page that linked to it, any campaign tags in the link, the description your browser gives of itself (its user agent), and that fingerprint. We don’t record who you are, even when you are signed in. We keep each visit for 24 months, so we can compare a month with the same month a year before, and then delete it. Nobody else sees the counts. We honour your browser’s “Do Not Track” and “Global Privacy Control” settings, and you can stop us counting your visits from this browser with the button below. It stores one flag in your browser so we remember; clearing your browser’s data for this site removes it.

You can clear or block cookies and site data in your browser settings. Blocking the session cookie will stop you signing in; clearing the rest loses nothing saved in Sendinvo.

The app. None of this applies to the iPhone app. It sets no cookies, loads no advertising tag and has no advertising identifier. It keeps its sign-in tokens in the iOS Keychain and your documents in a local database on the device, so the app still works when you have no signal.

7. Legal basis for processing

We process your data on the basis of contract (to deliver the Sendinvo service you have signed up for) and legitimate interests (security, fraud prevention, improving the service, answering the emails you send us, and giving free access to the businesses we choose).

8. Data retention

We keep your account and your business’s data for as long as the account exists, including after a trial or subscription ends, so you can still read and export it. Deleting your account deletes it: see section 9. Your business may have to keep its own records for several years for HMRC, so keep a copy with Export everything before you delete. Server logs are kept no more than 30 days, as section 2 says. The visits we count on our website are kept 24 months, as section 6 says.

An export. When you use Export everything, we keep the zip file for 7 days so the link we email you can download it, and delete it within the hour after the link stops working. A newer export replaces it, and the older file is deleted then.

9. Deleting your account

You can delete your account yourself, in the app and on the web: Profile, then Delete account. You are asked to type “delete” to confirm, because it cannot be undone.

What goes. Your account, every business you own, and everything in them: clients and the people and sites on them, invoices, quotes, credit notes, recurring schedules, jobs and their visits, photos, files and voice notes, payment records, saved items, activity, bank details, attachments, and any export. Your Sendinvo subscription is cancelled, any connected Stripe account is removed, and any connected accounting software is disconnected, which deletes nothing in it. Businesses you belong to but do not own are not touched: you are no longer a member of them.

Keeping a copy. Before you delete, you can use Export everything to keep a copy of a business’s records. While an export of a business you own is being prepared, the account can’t be deleted, and once it’s ready, deleting the account deletes that export too, so download it first.

One thing to do first. If you own a business that other people are on, transfer ownership to one of them before deleting. Otherwise deleting your account would take their access with it, so we stop and tell you rather than letting that happen.

A subscription bought through Apple is not cancelled by deleting your account, because only the person who bought it can cancel it. Cancel it in Settings on your iPhone, or from the link the app offers before you delete.

10. Your rights

Under UK GDPR you have the right to access, correct, or erase your personal data; to restrict or object to processing; and to data portability. An owner or admin can take a copy of a business’s data at any time with Export everything, under Subscription in your account on the web or in the app: one zip file with its clients, invoices, quotes, credit notes, payments, recurring schedules, and jobs as spreadsheets, every document it sent as a PDF, and every photo taken on its jobs and file kept on them, and every voice note recorded on them with its transcript. For anything else, or to exercise any of these rights, email privacy@sendinvo.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

11. Security

All data is transmitted over TLS. Passwords are hashed using Argon2. Database access is restricted to application servers. We conduct regular dependency and security reviews.

12. Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes by email at least 14 days before they take effect.

13. Contact

Questions about this policy: privacy@sendinvo.com