Privacy policy

1. Who we are

PaidUp is a trading name of Juan Ignacio Nunez Palominos, a sole trader based at 49 Marlinstown Park, Mullingar, Co. Westmeath, N91 XR83, Ireland. In this policy “PaidUp”, “we” and “us” mean Juan Ignacio Nunez Palominos trading as PaidUp. You can reach us at [email protected] about anything in this policy, including requests to see or delete your data.

We play two roles under data protection law (the GDPR and, for UK customers, the UK GDPR):

• Controller for the data about you as our customer: your account, your login, your subscription and how you use PaidUp.
• Processor for the data you put into PaidUp about your own clients and suppliers, such as their names, email addresses and invoices. You decide what goes in and why; we process it only to provide the service to you, under the data processing terms in section 9 of our terms.

2. What we collect

About you and your team

• Business name, email address, the country your business is based in and your reply-to address.
• Your password, stored only as a one-way hash (bcrypt). We can never see it. Team members you invite have their own name, email address and hashed password.
• Your plan and subscription status. Card details are handled by Stripe and never reach us.
• If you connect Stripe: the signing secret for your webhook, stored encrypted, and the payment events Stripe sends us (amount, currency, the invoice reference and when it happened).
• If you send from your own domain: the domain, the address you send from and the DNS records needed to verify it.

About your clients and suppliers (you provide this)

• Invoices you send and bills you receive: names, email addresses, amounts, dates and invoice numbers.
• Invoice and bill PDFs you upload.
• The reminder messages sent for each invoice, and when they were sent.
• Replies your clients send to reminders: we forward each one to your inbox and keep the sender, subject, date and a short extract on the invoice. The full message and any attachments are not stored by PaidUp after forwarding (Resend, which receives them, keeps its own copy for a limited time).

Technical data

• Server logs kept by our hosting provider (such as IP addresses and the pages requested), used to keep the service running and secure.
• Login and signup attempts (the email address or IP address and the time), kept for 24 hours to block password guessing and automated signups.
• One cookie: a login session cookie that keeps you signed in. It is strictly necessary, so we don't ask for consent. We don't use advertising or tracking cookies.

3. Why we use it and our legal basis

We don't sell personal data, we don't use it for advertising, and we don't use your data or your clients' data to train AI models.

4. Reading invoice PDFs with AI

When you upload a PDF, PaidUp first reads its text on our own servers. Only when the layout is unusual is the PDF sent to Anthropic's Claude API to read the client, number, amount and dates. Anthropic processes it for us as a sub-processor and, under its commercial terms, doesn't use API data to train its models. You always check the result before anything is saved.

5. Who processes data for us

We use these providers (sub-processors) to run PaidUp:

When personal data goes outside the European Economic Area or the UK, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses. We will tell customers before adding or replacing a sub-processor.

6. How long we keep it

• Your account data, invoices and bills: for as long as your account is open, or until you delete them.
• You can delete your account at any time in Settings → Delete account; its data is deleted straight away. Encrypted backups are kept for 30 days and then deleted, so a copy may last up to 30 days longer in a backup.
• Billing records: as long as Irish tax law requires, usually six years.
• Server logs: for a short period set by our hosting provider.

7. How we protect it

• All connections use HTTPS. The database is only reachable from our app, over a private network.
• Passwords are hashed; stored secrets such as Stripe signing secrets are encrypted (AES-256-GCM).
• Daily backups are encrypted before they leave our servers and are stored in the EU.
• Team members can only see the account they belong to, and only the owner can change its settings.

If a personal data breach affects you or your clients, we will tell you without undue delay, and the regulator where the law requires it.

8. Your rights

You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw any consent you have given. You can delete your account yourself in Settings; for anything else, email [email protected] and we will answer within one month.

If your clients or suppliers ask about their data in PaidUp, we will pass the request to you, because you decide how their data is used, and help you answer it.

You can also complain to the Data Protection Commission in Ireland (dataprotection.ie) or, in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to sort things out first.

9. Children

PaidUp is a business tool for people aged 18 or over. We don't knowingly collect data about children.

10. Changes

If we change this policy in a way that matters, we will email account owners before it takes effect. The date at the top shows when it last changed.