Privacy — Pocket Paperwork

1. Who this covers

You, if you ask for a preview, sign up, or message us.
Your customers, whose names, addresses and invoices you keep in the app. For that data you are the controller and we are your processor: we only do with it what the app needs to do, on your instructions.
Visitors to this website and to the one-page websites we host for our customers.

2. What we collect and why

What	Why	Legal basis
Your name, mobile number, trade, business name, area, and anything you type in the sign-up or preview form	To build your preview, set up your account and contact you about it	Taking steps before, and then performing, our contract with you
Where you came from (the referring website or campaign) before signing up	So we know which marketing works. Held in your own browser for 30 days, then sent with your sign-up. No cookies.	Our legitimate interest in understanding our marketing
Your login (mobile number and a PIN we store as a one-way hash) and when you last logged in	To keep your account secure	Performing our contract; our legitimate interest in security
Everything you put in the app: customers, quotes, invoices, payments, expenses, receipt photos, your logo and settings	To run the app for you	Performing our contract. For your customers' details you are the controller; we process on your instructions.
Billing details: plan, payment status, invoices from us to you	To charge you and keep our own accounts	Performing our contract; our legal duty to keep accounting records
WhatsApp messages between us	Support and account changes	Performing our contract
Server logs (IP address, page requested, time) for this site and hosted customer sites	Security, fault-finding and keeping the service up	Our legitimate interest in running a secure service

We don't use advertising cookies, analytics trackers or social media pixels on this site or on the sites we host. The only thing stored in your browser is a session cookie when you log in to the app and the 30-day "where you came from" note above.

3. Who sees it

Us. The small team at Pocket Paperwork Limited, only when needed to support you.
Hosting. The app, this site and your data run on Railway's cloud platform. Backups are taken automatically every night.
Card payments. When we take payment by card or direct debit it is handled by Stripe. We never see or store your full card or bank details; Stripe does, under its own privacy notice.
Receipt reading. If you photograph a receipt, the image is sent to Anthropic's AI service to read the amount, date and supplier, then returned to you to check. Anthropic does not use it to train its models.
Domains. If we register a web address for you, your business name and contact details go to the domain registrar, as the law on domain ownership requires.
Messaging. Support is on WhatsApp, which is run by Meta under its own terms.
Nobody else. We don't sell, rent or share your data with advertisers, data brokers or anyone else, and we only disclose it if the law requires it.

Where a provider above stores data outside the UK, it is covered by the UK's adequacy rules or standard contractual clauses.

4. How long we keep it

Preview and sign-up details for people who don't go on to join: 90 days, then deleted.
Your account and everything in it: while you're a customer, then 90 days after your account ends so you can download it, then deleted. Backups roll off 14 days after that.
Our own invoices to you and payment records: six years, because HMRC requires it.
Server logs: 30 days.

5. Your rights

Under UK GDPR you can ask us to:

tell you what we hold about you and give you a copy;
correct it, delete it, or stop using it in a particular way;
give you your data in a form you can take elsewhere. For app data, the spreadsheet export in the app does this instantly.

Message us on WhatsApp and we'll deal with it within a month, usually much faster. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk, but we'd rather you told us first.

Deleting your Pocket Paperwork account

You can delete your account yourself at any time:

Open the Pocket Paperwork app (or app.pocketpaperwork.com) and log in.
Go to Settings and scroll to Delete my account.
Enter your PIN and tap Delete my account twice to confirm.

Your account closes straight away and any subscription is cancelled. Your quotes, invoices, payments, receipts and customer records are then deleted as set out in section 4 above, and backups roll off 14 days after that. The only thing we keep is our own invoices to you and payment records, for six years, because HMRC requires it. If you can't log in, message us on WhatsApp from the number on your account and we'll delete it for you.

If you are one of our customers' customers and want your details changed or removed from their records, contact the business that invoiced you. If you can't reach them, message us and we'll help.

6. Security

Every connection is encrypted (HTTPS). PINs are stored as one-way hashes, never in plain text.
Each customer's data is kept in its own separate database. No customer can see another's.
Nightly automatic backups, kept for 14 days.
If we ever have a data breach that puts you at risk, we'll tell you and the ICO within 72 hours of finding out.

7. Changes

If we change this notice in a way that affects you, we'll tell you at least 30 days before. The date at the top always shows the current version.

Questions? Message us on WhatsApp.

Privacy, in plain English.