Last updated 1 October 2026
Who we are
Subbie Invoice is run by Urban Code Studios ("we"). We are the data controller for the personal data described here. ICO registration: pending. Contact: paul@urbancodestudios.com.
What we collect
- Account: your email address, used to sign you in.
- Your invoice details: name or trading name, address, phone, email, UTR, VAT number (if any), CIS rate, and bank account name, sort code and account number.
- Your work records: the contractors you add (name, address, email, site), hours you log, invoices you create, payment status and expenses you record.
- Technical: a sign-in cookie that keeps you logged in, and standard server logs (such as IP address and time of request) kept by our hosting providers for security.
We do not collect National Insurance numbers. We do not use advertising or tracking cookies, and we never sell your data.
Why we use it
To provide the service you signed up for: creating, storing and sharing your invoices, logging hours and expenses, and producing summaries for your accountant. Our lawful basis is performance of a contract with you. We use your email to send sign-in links and essential service messages only.
Who processes it for us
- Supabase: database and sign-in.
- Vercel: hosting the app.
- Resend: sending sign-in emails.
These providers act on our instructions under data processing agreements. Some may process data outside the UK; where they do, it is protected by approved safeguards such as UK adequacy regulations or the International Data Transfer Addendum.
When you share an invoice, it goes through the app you choose (for example WhatsApp or Gmail) and that app's own privacy policy applies.
How we protect it
Data is sent over encrypted connections (HTTPS). Each account can only access its own records. Sort codes and account numbers are additionally encrypted before they are stored, with a key kept separately from the database.
How long we keep it
For as long as your account is open. When you use Me → Delete my account, your account and all associated records are deleted immediately from our live database; copies in our providers' backups are removed as those backups expire. You should keep your own copies of invoices for HMRC (normally at least 5 years after the 31 January filing deadline). Use Export for your accountant before deleting.
Your rights
You can access, correct, export or delete your data at any time in the app, or by emailing us. You also have rights to restrict or object to processing. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it applies.