Privacy policy

Quill(“Quill”, “we”, “us”) provides invoicing and estimates software for UK tradespeople. This policy explains what personal data we collect, why we collect it, and your rights under UK GDPR and the Data Protection Act 2018.

Who we are

Quill is invoicing software operated from the United Kingdom. For data protection enquiries, contact us at support@quillinvoices.co.uk.

Data we collect

When you use Quill, we may process the following categories of data:

• Account data— name, email address, business name, password (stored hashed), billing address and subscription status
• Invoice and estimate data— customer names and addresses, line items, VAT details, payment terms, PDFs you generate, and send history
• Bank feed data (read-only)— if you connect a business bank account, we receive read-only transaction data via our open-banking partner to match incoming payments to invoices. We do not store your online banking credentials and cannot initiate payments from your account
• Payment processing— if you enable Stripe payment links, payment card details are handled directly by Stripe; we receive confirmation and metadata (amount, status, customer reference) only
• Usage and technical data— device type, browser, IP address, pages visited, and error logs to keep the service secure and reliable

How we use your data

We use your data to:

• Provide, maintain and improve the Quill invoicing service
• Generate invoices, estimates and VAT summaries you request
• Match bank transactions to invoices when you enable bank feed
• Process subscriptions and send service-related communications
• Comply with legal obligations (e.g. tax record-keeping where applicable)
• Detect fraud, abuse and security incidents

Our lawful bases under UK GDPR include contract performance (providing the service you signed up for), legitimate interests (security, product improvement), and consent where required (e.g. non-essential cookies).

Data sharing

We do not sell your personal data. We share data only with processors that help us run Quill, including hosting providers, Stripe (payments), open-banking partners (read-only bank feeds), and email delivery services. All processors are bound by data processing agreements and UK GDPR requirements.

Data retention

We retain account and invoice data for as long as your subscription is active. After cancellation, we keep data for up to 90 days so you can export records, then delete or anonymise it unless we are required to retain it longer for legal, tax or dispute-resolution purposes. Backup copies may persist for a further 30 days before being overwritten.

Cookies

We use essential cookies to keep you signed in and remember your preferences. We may use analytics cookies to understand how the product is used; where required, we ask for consent before setting non-essential cookies. You can manage cookie preferences in your browser settings.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Restrict or object to certain processing
• Data portability for data you provided to us
• Withdraw consent where processing is consent-based
• Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise any of these rights, email support@quillinvoices.co.uk. We respond within one month.

International transfers

Where data is processed outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy decisions or Standard Contractual Clauses) in line with UK GDPR requirements.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice. Continued use of Quill after changes take effect constitutes acceptance of the updated policy.

Contact

Questions about this privacy policy: support@quillinvoices.co.uk.