Last updated: 24 September 2026
This Privacy Policy is a layered notice. The sections at the top summarize how we handle personal information in Invoice24 (i24) AKA i24. Additional region-specific rights information appears further below.
This policy covers the Invoice24 software and services (including web and mobile apps), and (where enabled) features that connect to third parties such as payment processors and UK HMRC integrations (including Making Tax Digital for Income Tax Self Assessment (MTD ITSA)).
Invoice24 (i24) is provided by i24 Limited. For the personal information described in this Privacy Policy, i24 Limited is generally the data controller (or equivalent) and is responsible for protecting that personal information. You can contact us using the details in the “How to Contact Us” section at the bottom of this page.
Depending on how you use the Services, we may process the following categories of personal information (some of which may relate to your customers, suppliers, or other third parties if you upload that data into the Services):
We use personal information to provide and operate the Services; process subscriptions and payments; secure accounts and prevent fraud/abuse; provide customer support; communicate service-related messages; improve and develop the Services; develop, train, test and improve artificial intelligence, machine-learning and other models and technologies; create de-identified and aggregated data; and provide personalised, customised and data-driven features, insights and services. Where required, we will obtain consent for specific processing (for example, certain marketing communications). See “Artificial intelligence, machine learning and de-identified data” below for more detail and for your choices.
Where UK GDPR/EEA GDPR apply, we process personal information only where we have a lawful basis. Depending on the context, this may include: (a) your consent, (b) performance of a contract with you / steps at your request, (c) compliance with a legal obligation, and/or (d) legitimate interests (for example, to keep the Services secure and prevent fraud), balanced against your rights.
The table below provides a practical mapping between common processing activities, the types of personal information involved, why we process it, and the lawful basis we rely on (where UK GDPR/EEA GDPR apply). The exact lawful basis can vary depending on your use of the Services and the specific context.
| Processing activity | Examples of data | Why we do it | Typical lawful basis |
|---|---|---|---|
| Create and manage your account | Account/profile data, authentication details, contact details | Provide the Services and enable access | Performance of a contract / steps at your request |
| Deliver core product features | Invoice and business records data, activity history | Generate and manage invoices and related records | Performance of a contract / steps at your request |
| Process subscriptions and payments | Billing/subscription data, transaction references | Bill for the Services, manage subscriptions, prevent payment fraud | Performance of a contract; legitimate interests; legal obligation (where applicable) |
| Customer support and communications | Communications and support data, account identifiers | Respond to queries, troubleshoot issues, communicate service messages | Performance of a contract; legitimate interests |
| Security, fraud prevention, and abuse detection | Device/usage/log data, security events, IP address, timestamps | Keep the Services safe, detect and prevent fraud, enforce policies | Legitimate interests; legal obligation (where applicable) |
| Improve and develop the Services | Usage data, diagnostic logs, feedback (where provided), invoice and business records data, communications and support data | Fix bugs, improve reliability and features, understand how the Services are used, and develop new products, features and services | Legitimate interests; consent (where required) |
| Develop, train and improve AI and machine-learning models | Invoice and business records data, communications and support data, usage data, feedback and documents you upload (de-identified or aggregated where reasonably practicable) | Build, train, fine-tune, test and improve models and features such as document extraction and categorisation, forecasting, fraud detection, assistants and automation, and develop new products and services | Legitimate interests; consent (where required). You can object – see “Artificial intelligence, machine learning and de-identified data” below |
| Personalised and data-driven services | Invoice and business records data, usage data, account/profile data | Provide insights, recommendations, benchmarks, forecasts, payment and risk indicators and other personalised or customised features | Performance of a contract; legitimate interests |
| Create de-identified and aggregated data | Any of the categories above, once direct identifiers have been removed | Produce statistics, trends, benchmarks, research, training data and insights that no longer identify any individual, which we may use and share for any purpose | Legitimate interests (the resulting data is no longer personal information) |
| Marketing communications (where enabled) | Contact details, marketing preferences | Send product updates and offers (you can opt out) | Consent (where required); legitimate interests (where permitted) |
| Comply with legal/regulatory requirements | Billing records, audit/security logs, account identifiers | Meet legal obligations, respond to lawful requests, maintain required records | Legal obligation |
| HMRC-connected features (UK), where you choose to use them | Data you instruct us to submit, submission metadata/status, HMRC-required audit data | Enable HMRC integration and transmit/receive information with HMRC | Performance of a contract / steps at your request; legal obligation (where applicable); legitimate interests (security) |
We use the information described in this Privacy Policy, including invoice and business records data and the documents you upload, to develop, train, fine-tune, test, evaluate and improve artificial intelligence, machine-learning, statistical and other models and technologies. These models power features such as document extraction and categorisation, forecasting, fraud and error detection, assistants and automation, and help us build new products and services. Models may be developed by us, by our affiliates, or by third-party providers acting on our behalf.
De-identification and safeguards. Where reasonably practicable, we remove or replace direct identifiers (such as names, email addresses, phone numbers, addresses and account identifiers) or aggregate information before using it to train models. We do not use full payment card numbers, passwords or HMRC sign-in credentials to train models. Access to training data is limited to trained personnel and providers bound by confidentiality obligations, and samples may be reviewed by people to improve quality and safety.
Derived data and models are retained. Trained models, and de-identified, aggregated or statistical data derived from your information (“Derived Data”), do not identify you and are not personal information. We own Derived Data and may use, retain, disclose, license and otherwise exploit it for any purpose, including sharing it publicly and with partners. Deleting your account or information does not require us to delete or retrain models, or to delete Derived Data, that already exist.
Your choices. You can object to the use of your identifiable personal information to train models at any time, either through the relevant setting in the Services where available or by emailing hello@i24app.com. Objecting does not affect models already trained or Derived Data already created, and does not stop us using your information to provide, secure and support the Services, to comply with law, to review content flagged for safety, fraud or abuse, or to use feedback you give us. If you upload information about other people (for example, your customers or employees), you are responsible for telling them how their information will be used and for obtaining any consents required by law.
We may share personal information with:
We do not sell personal information that directly identifies you (such as your name or email address) to third parties for money. Where the law where you live treats other kinds of sharing as a “sale” or “sharing” of personal information, you can opt out by contacting us using the details in “How to Contact Us”.
Our website and apps use cookies and similar technologies (such as local storage, software development kits (SDKs) and device identifiers) to operate the Services, remember your preferences and understand how the Services are used. The “Cookie use” link in our apps points to this section.
| Type | Examples | Purpose | Duration |
|---|---|---|---|
| Strictly necessary | Sign-in and session cookies (for example, Supabase authentication tokens) | Keep you signed in, secure your account and route requests correctly | Session, or until you sign out |
| Functional | A “country” cookie | Remember the country or region you chose so we show the right content and formats | 180 days |
| Analytics | Google Analytics cookies (for example, _ga and _ga_*) | Measure page views and usage so we can improve the Services; we configure Google Analytics not to send sensitive data | Up to 2 years |
| Mobile app identifiers and SDKs | Device and installation identifiers used by SDKs for analytics, crash and performance reporting, push notifications, and payment processing (for example, Stripe) | Operate the apps, diagnose faults, deliver notifications and prevent fraud | Varies by SDK; typically until you reinstall the app or reset the identifier |
We do not use cookies or identifiers for interest-based advertising, and we do not allow third parties to place advertising cookies through the Services.
Your controls. You can delete or block cookies through your browser settings; blocking strictly necessary cookies will stop parts of the website working. To limit Google Analytics you can install Google’s browser opt-out add-on. On iOS you can manage tracking permissions and identifiers under Settings › Privacy & Security › Tracking, and on Android under Settings › Privacy › Ads, where you can also reset or delete the advertising ID. Where the law where you live requires consent for non-essential cookies or identifiers, you may withdraw any consent you have given at any time using these controls or by contacting us.
We may process or store personal information in countries other than the country where you live. Where required, we use appropriate safeguards for international transfers (for example, contractual protections and security measures) and limit access on a need-to-know basis.
We implement reasonable administrative, technical, and organizational security measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. As the controller (or equivalent) for personal information we handle as described in this Privacy Policy, we are responsible for implementing appropriate measures to protect that information. However, no method of transmission or storage is completely secure.
If you believe you have found a security vulnerability, suspect unauthorised access to an Invoice24 account, or believe Invoice24 data may have been exposed, please report it as soon as possible by emailing hello@i24app.com with the subject line “Security Incident”. Please include sufficient detail to help us investigate (for example, the affected account email, relevant dates/times, and a description of what you observed).
Where we become aware of any issue concerning the security of personal or customer data in connection with HMRC integrations (including Making Tax Digital for Income Tax Self Assessment (MTD ITSA)), we will report it to HMRC within 72 hours by contacting SDSTeam@hmrc.gov.uk, and will provide a breach contact name and telephone number.
Where a personal data breach is reportable under applicable data protection law (including UK GDPR), we will notify the UK Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to individuals’ rights and freedoms, we will also notify affected individuals without undue delay.
If you use features that connect Invoice24 to HMRC (including features designed to support Making Tax Digital for Income Tax Self Assessment (MTD ITSA)), we will process additional data to enable those features.
Authorisation and HMRC sign-in details: HMRC authorisation is designed so that you authenticate directly with HMRC and grant authority for specific scopes. We do not need you to provide your HMRC username and password to us in order to use HMRC-connected features.
Data you ask us to send to HMRC: This may include information you provide or generate in the Services that you instruct us to transmit to HMRC (for example, summaries, updates, and submission metadata/status information returned by HMRC).
Fraud prevention and audit data: When using certain HMRC APIs (including MTD-related APIs), HMRC requires software providers to submit specific user audit data (fraud prevention header data). To provide these HMRC-connected features, Invoice24 may collect and transmit to HMRC certain technical and contextual information (for example, device/app/browser details, timestamps, network and connection information, identifiers, and similar audit data required by HMRC specifications).
This data is used for transaction monitoring and fraud prevention and may be legally required for certain HMRC API requests. Missing or incorrect data may cause HMRC-connected features to fail.
We keep personal information for as long as needed to provide the Services, comply with legal or regulatory obligations, resolve disputes, enforce agreements, and protect the security and integrity of the Services. Retention periods vary depending on the type of data, how it is used, and applicable legal requirements.
If you request deletion (or delete information within the Services where available), we will take reasonable steps to delete personal information within a reasonable time, subject to required or permitted retention (for example, billing records, fraud prevention, security logs, and legally required recordkeeping). Derived Data and trained models, which do not identify you, are retained and are not deleted or retrained when your information is deleted (see “Artificial intelligence, machine learning and de-identified data”).
If you have concerns about how we use personal information, you can contact us using the details below. Depending on where you live, you may also have the right to lodge a complaint with a relevant data protection supervisory authority.
When it comes to controlling the privacy of your personal information, you have options.
If you are a resident of Brazil, you may have the following rights:
To exercise any of your rights, please contact us at the link provided below in the "How to Contact Us" section for Brazil.
When it comes to managing the privacy of your personal information, you have options.
While we take precautions to secure your personal information, it may be revealed in response to valid demands or requests from governments, regulators, courts, and law enforcement officials in those other territories or nations.
If you are a resident of Canada, you may have the following rights:
When it comes to managing the privacy of your personal information, you have options.
Where Indian individuals' data is involved, you hereby agree that "reasonable security practises and procedures" under section 43A Explanation (ii) of the Information Technology Act, 2000 means this i24's Privacy Statement and such data security procedures as i24 may implement from time to time and as i24 may inform you of from time to time.
When it comes to managing the privacy of your personal information, you have options.
If you are a resident of Mexico, you may have the following rights known as “ARCO rights”:
When it comes to managing the privacy of your personal information and exercising your ARCO rights, you have options. Please keep in mind that we must validate your request before executing your rights. After we receive a request, we will respond with whether the request for access, rectification, cancellation, or opposition is appropriate, and if so, we will make a determination within 15 business days after that date. The deadlines may be extended in accordance with the conditions of the applicable laws.
If you are a Mexican resident, you may also limit the use or disclosure of your personal information by contacting us via the link provided in the "How to Contact Us" section for Mexico, below.
If you are a Mexican resident and we process your personal information on the basis of your consent, you may withdraw that consent at any time by contacting us via the link provided in the "How to Contact Us" section for Mexico, below. Withdrawal does not affect processing carried out before you withdrew.
i24 Limited, a company established in the United Kingdom, is the controller of your personal information. Contact information for i24 Limited can be found in the "How to Contact Us" section below.
The type of personal information and the exact context in which we acquire it will determine our legal justification for collecting and processing the personal information detailed in this Privacy Statement. However, we will generally process your personal information when:
If you are a resident of the UK or EEA, you may have the following rights:
When it comes to managing the privacy of your personal information, you have options.
If you have any questions or concerns concerning this Privacy Statement or our practises, please write to i24 Limited,
20 Bankside, Station Approach, Kidlington, OX5 1JE, UK.
Alternatively, you can contact us by email at hello@i24app.com.