Draft, not legal advice. Product-specific wording to merge into the FSB member templates before launch (see README.md). Last updated: 20 October 2026 (draft)

PaidStraight privacy policy

This policy explains how [OPERATOR LEGAL NAME] ("we", "us") uses personal data in PaidStraight. It covers:

• people who visit our website;
• people who sign up for and use PaidStraight ("users"); and
• people who receive reminders sent through PaidStraight by one of our users (see section 9).

1. Who we are

[OPERATOR LEGAL NAME], [REGISTERED ADDRESS]. Email: [CONTACT EMAIL]. We are registered with the Information Commissioner's Office (ICO), registration number [ICO REGISTRATION NUMBER].

We have not appointed a data protection officer because the law does not require one for a business of our size and type. Please send any privacy question to [CONTACT EMAIL].

2. Our two roles

Controller. We decide how and why we use personal data about our users, our website visitors and anyone we market to. For that data we are the controller and this policy applies in full.

Processor. When you use PaidStraight, you add details of your own clients: names, email addresses, postal addresses, phone numbers, invoices and the emails sent to them. You decide how that data is used. You are the controller and we are your processor. We only use it to run PaidStraight for you, under our data processing agreement (dpa.md). Section 9 below explains this for the people your reminders go to.

3. What we collect about users

Data	Where it comes from
Name, business name, email address, password (stored as a one-way hash)	You, when you sign up
Business address, phone, payment details you want shown on reminders, signature, working hours, time zone, jurisdiction	You, in settings
Names and emails of team members you invite	You or the team member
Subscription status, plan, renewal date, Paddle customer and subscription IDs, country and postcode if Paddle passes them on	Paddle, our reseller
Sign-in times, IP address, browser type, security events, error reports	Our systems, automatically
Messages you send us	You
[If Google sign-in is switched on: your Google account name and email address]	Google, when you choose to sign in with Google

We do not receive or store your full card details. Paddle handles payment.

4. Why we use it, and our lawful basis

Purpose	Lawful basis (UK GDPR Art 6)
Creating and running your account, sending reminders you have set up, keeping your data safe	Contract
Service emails to you: confirm email, password reset, trial ending, trial ended, payment failed, letter before action ready, changes to terms	Contract; legitimate interests in running the service
Billing records and tax	Legal obligation; contract
Security, fraud and abuse prevention, including checking complaints about messages sent from an account	Legitimate interests in keeping PaidStraight safe and lawful
Fixing errors and improving the service	Legitimate interests
Marketing emails about PaidStraight (news, tips, offers)	Your consent, or for existing customers the "soft opt-in" with an unsubscribe link in every email. See section 7.
Dealing with legal claims	Legitimate interests

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details.

5. How long we keep it

Data	How long
Account and business data, and your clients' data held for you	While your account is active. After your trial ends or your subscription ends, 90 days. Then deleted.
Database backups	Up to 8 weeks after the data is deleted from the live system, then overwritten
Billing records	6 years from the end of the tax year they relate to [Solicitor to confirm: period, and whether Paddle's records mean we need less]
Error reports (Sentry)	Up to 30 days
Server logs	[OWNER TO CONFIRM: retention period set in DigitalOcean], then deleted
Marketing preferences and unsubscribe records	Kept so we can respect your choice, for as long as needed

You can export a CSV of your data at any time. You can ask us to delete your account sooner.

6. Who we share it with

We use these sub-processors to run PaidStraight. Each has a contract with us that protects your data.

Provider	What they do	Where data is stored
DigitalOcean, LLC	Hosting and database	London, UK (LON1)
Amazon Web Services (Amazon SES)	Sending email	London, UK (eu-west-2)
Functional Software, Inc. (Sentry), only if switched on	Error reports	EU (Frankfurt, Germany)
Raintank, Inc. (Grafana Labs)	Service monitoring and uptime checks: performance and usage counts, server logs. No client names, emails or amounts are sent; logs carry account and organisation IDs, never names, emails or IP addresses (see docs/LOGGING.md)	London, UK (AWS eu-west-2)
Umami Software, Inc. (Umami Cloud), only if switched on	Cookie-free visitor counts on the public website only, not inside the app	EU [OWNER TO CONFIRM when account is created]
[Google LLC, only if Google sign-in is enabled]	Sign-in	[Global]

Paddle. Paddle.com Market Limited sells PaidStraight to you as merchant of record. Paddle is a separate controller for the payment and tax data it collects at checkout. Its own privacy notice applies ([PADDLE PRIVACY NOTICE URL], linked from paddle.com/legal). We share your email address and organisation ID with Paddle to open checkout, and Paddle tells us your subscription status.

We may also share data:

• with professional advisers, such as our accountant or solicitor;
• with the police, a court or a regulator where the law requires it;
• with a buyer if we sell the PaidStraight business, who must use it in line with this policy.

We do not sell personal data. We do not share it with advertisers.

7. Marketing

Some emails are part of the service and you will get them while you have an account: trial reminders, billing problems, security messages and important changes. These do not promote anything.

Marketing emails are different. We only send them if you agreed, or if you are a customer and we tell you about similar PaidStraight features (the "soft opt-in"). Every marketing email has an unsubscribe link. You can also opt out in settings or by emailing [CONTACT EMAIL]. Opting out of marketing does not affect service emails.

8. International transfers

We keep PaidStraight's main data in the UK. Some providers are owned by US companies, or have support staff or sub-processors outside the UK. Where personal data is sent outside the UK, we rely on one of these:

• UK adequacy regulations (for example, for the EU, or for US companies certified to the UK Extension to the EU-US Data Privacy Framework);
• the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment.

Sentry stores error reports in the EU, which the UK treats as adequate. Paddle may transfer data outside the UK under its own safeguards, described in its privacy notice.

[OWNER TO CONFIRM for each provider: current Data Privacy Framework status (dataprivacyframework.gov), and which safeguard their DPA uses. Solicitor to confirm the wording.]

9. If you received a reminder sent through PaidStraight

A business you deal with used PaidStraight to send you a reminder about an invoice. That business is the controller of your data. It decided to send the reminder and wrote or chose the wording. We send the email for them as their processor.

The business gave us your name and contact details and the invoice details. We store them, encrypted, in the UK, and use them only to send that business's reminders.

If you reply to a reminder, your reply comes to us first. We read it automatically to see whether you say it's paid, promise a date, or disagree with the invoice, so the business's reminders stop or wait. We forward your reply to the business unchanged, and keep it, encrypted, with the invoice. Nobody at PaidStraight reads it unless the business asks us for help.

If you're a company, the business may also have asked us to check public information about you at Companies House and in The Gazette.

If you have a question about the invoice, or want to use your data protection rights, contact the business that sent the reminder. If you contact us, we will pass your request to that business and help it respond. If you think the business has broken the law, you can complain to the ICO.

PaidStraight does not collect money, is not a debt collector, and is not acting for anyone in court.

10. Your rights

You have the right to:

• ask for a copy of your personal data;
• ask us to correct it;
• ask us to delete it;
• ask us to restrict how we use it;
• object to how we use it, including for marketing (always), and where we rely on legitimate interests;
• ask us to send it to you or another organisation in a machine-readable form, in some cases;
• withdraw consent at any time, where we rely on consent.

Email [CONTACT EMAIL]. We will reply within one month. We may need to check your identity. Some rights have limits, for example if we must keep billing records by law.

11. Complaints

Please tell us first if you are unhappy with how we use your data. Email [CONTACT EMAIL] or use the complaint form on our website at /contact. We will acknowledge your complaint within 30 days and tell you the outcome.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

12. Security

We protect personal data with:

• encryption in transit (TLS) for all connections;
• field-level encryption of your clients' names, emails, addresses and phone numbers in our database;
• encrypted managed database storage and backups;
• passwords stored as salted hashes;
• access limited to the people who need it, with strong authentication.

No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.

13. Cookies

We use only cookies that are strictly necessary to run the site and keep you signed in. Paddle sets its own cookies on the billing page. See our cookie notice (cookies.md).

14. Changes

We will update this policy when how we use data changes. We will email users about important changes. The date at the top shows the current version.