Privacy
What the app keeps, why, and for how long.
About you, the business owner
Your name, email, phone, business details, bank details for your invoices, and what you do in the app. Kept while you rent the app and for 90 days after, then deleted — all of it, invoices and payments included (the weekly backups that hold it expire 91 days after they are written).
HMRC requires YOU to keep your invoices and payment records for six years after the tax year they belong to. They are yours, not ours: export them before you go, from the same button you can use any day. We do not keep a copy for you afterwards.
When you sign up
The business name, trade, web address and email you type, the version of these terms you agreed to, and a scrambled form of the internet address the form came from, used only to stop the form being abused. That record is deleted 30 days after you sign up, whether or not you finish; a business you make keeps its own note of the terms you agreed to.
The sign-up form runs Cloudflare Turnstile, a check that a person is filling it in. It runs in a frame from Cloudflare, under Cloudflare's own privacy terms.
If you choose Continue with Google, Google tells the app the email address on your Google account, whether Google has checked it, and a number that stands for your Google account. The app asks Google for nothing else. While you choose your account, a cookie on this site holds your sign-up for at most 15 minutes. Google knows you signed up here, under Google's own privacy terms.
About your customers
What you type about them and what they send through your forms. You decide what is kept; you are the controller and we process it for you under the data processing agreement. Anyone can ask you to see, correct or erase what you hold, and the app has a button for each.
Sign-in
No passwords are stored. A business made with its emailed link signs in with a one-time code by email each time, and Cloudflare Access issues the session. A business made with Google has the app's own sign-in: first Google or a one-time code by email, then a passkey or an authenticator app, with the sign-in kept in cookies on the business's app address. For a passkey the app keeps only its public half; an authenticator app's secret is kept sealed. When you sign in with Google, the app keeps the number Google gives your account so it knows you next time, and Unlink Google in Settings removes it. A customer opening their portal gets a one-time link by email, and a cookie that lives on their own site only.
Where it lives
Cloudflare (hosting, database, files, sign-in, and the sign-up form's check), Resend (email, EU region), Stripe (payments, only if you turn card payments on). No advertising, no analytics that follow people around, no selling of anything to anyone.
Your rights
See, correct, export or delete what we hold about you. Write to support@xyzapp.co.uk, or reply to any email from the app. You can complain to the ICO at ico.org.uk.
Who we are
XYZ app is run by one person, a sole trader in Herefordshire, United Kingdom, and he is the controller for the data about you on this page. For the data about YOUR customers you are the controller and the app is your processor — the data processing agreement covers that.
Last changed 4 November 2026.