Privacy Policy
Last updated: 20 September 2026
This policy explains how Paid30 collects, uses and protects personal data. It applies to anyone who uses our website, invoicing service or payment pages. For data-protection law, the controller is:
James Carr, trading as Paid30
107 Davies Avenue, Paignton, Devon, TQ4 7AW
Email: support@paid30.com
1. What we collect
We only collect the information needed to run the invoicing and payment service:
- Business details: your trading name, business address, VAT number (if provided), email address and phone number.
- Customer details: name, email address and phone number of the people you invoice.
- Invoice data: job descriptions, amounts, VAT, discounts, payment status and timestamps.
- Payment data: transaction IDs, amounts, fees and payout status. We do not store full card or bank numbers — Stripe handles those securely.
- Technical data: IP address, browser type, and cookies needed to keep you signed in and secure the service.
2. How we use your data
- To create and send invoices, payment links and receipts.
- To process payments and transfer money to your connected bank account.
- To send service emails, such as password resets, payment confirmations and invoice notifications.
- To keep accounts secure, prevent fraud and meet legal obligations.
- To calculate and report our platform fees and subscription billing.
3. Legal basis for processing
We process data under UK data-protection law because it is necessary to perform our contract with you, to comply with legal obligations (such as tax and anti-fraud rules), or because you have given your consent (for example, to marketing emails, which we only send when you opt in).
4. Who we share data with
We only share data with trusted service providers who help us deliver the service:
| Processor | What they do for us | Where data is processed |
|---|---|---|
| Stripe Payments Europe / Stripe Inc. | Processes card, Apple Pay, Google Pay and other supported payment methods, runs identity and anti-fraud checks, and pays out to your bank account. For payment data Stripe acts as an independent controller under its own privacy policy. | EU, UK and USA |
| Supabase (via Lovable Cloud) | Hosts and secures the database holding your account, customer and invoice records, and handles sign-in. | EU / UK region hosting |
| Resend (email delivery) | Delivers invoice, reminder and receipt emails from our verified sending domain notify.paid30.com. | EU and USA |
| Cloudflare | Serves and protects the website and payment pages, including basic abuse prevention. | Global edge network |
| Xero / Intuit QuickBooks | Only if you choose to connect your accounting software. We then send your invoice, credit note and fee records to the account you authorise. | UK, EU, Australia and USA |
This list is kept current. If we add or replace a processor we will update this page. You can ask us for a copy of the data-processing terms we have in place with any of them.
5. International transfers
Some of our providers may process data outside the UK. When this happens, we rely on approved safeguards such as UK adequacy decisions or standard contractual clauses to keep your data protected.
6. How long we keep your data
We keep your account and invoice data for as long as you have an active account, and for a reasonable period afterwards to meet legal, tax and accounting obligations. In practice that means:
- Invoices, credit notes, receipts, expenses and CIS records: six years after the end of the tax year they relate to, as UK tax law requires.
- Quotes that never became invoices, and messages we sent on your behalf: two years.
- Uploaded receipts and job paperwork: kept alongside the record they belong to, with a permanent copy in your archive so you can go back through your history.
- Account and sign-in records: while your account is open, then one year.
If you ask us to erase your data, we remove the personal detail we are not required to hold — contact details, uploaded photos of people, marketing preferences — and keep only the financial record UK tax law obliges us to retain. Once the six years have passed, that record is deleted too.
7. Your rights
Under UK data-protection law you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Ask us to delete your data in certain circumstances.
- Object to or restrict certain types of processing.
- Withdraw consent at any time.
- Complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would ask you to raise it with us first so we can put it right.
You can act on the first two rights yourself straight away: sign in and open Settings → Your data and privacy to download a full copy of your data, or to submit a deletion request. Note that where you have invoiced customers, you are the controller of their data and we act as your processor — pass any request from your own customers on to us and we will help you answer it.
For anything else, or to withdraw consent, email us at support@paid30.com.
8. Security
We use encryption, access controls, and secure hosting to protect your data. Payment details are never stored on our servers. You are responsible for keeping your password safe and for any activity that happens under your account.
9. Cookies
We use only strictly necessary cookies to keep you signed in and to protect the service. We do not use tracking, analytics or advertising cookies, which is why you are not shown a consent banner. Our cookie policy lists every cookie we set, what it does and how long it lasts.
10. Changes to this policy
We may update this policy from time to time. The latest version will always be available at this page, and we will update the date at the top when changes are made.
11. Contact us
If you have any questions about this privacy policy or how we handle your data, please contact us at support@paid30.com.