Privacy policy

1. Who is responsible for your data

ENA DIGITAL AI LTD is the controller for the data about you as a PaidKind user: your account, your business profile and how you use the service.

For the details you enter about your own customers (names, email addresses, phone numbers, addresses, tax numbers and invoice contents), you are the controller and we process that data on your behalf, only to provide the service to you. If you are one of our users’ customers, please contact the business that invoiced you first; we will help them respond.

2. What we collect

• Account data: your name, email address and sign-in details (passwords and sign-in codes are handled by our identity provider; we never see your password).
• Business data: business name, country, currency, address, tax and company numbers, logo, payment instructions, reminder settings and invoice design.
• Customer and invoice data you enter: customer contact details, invoices, line items, payments you record, reminder messages and notes.
• Activity on invoices: when an invoice is sent, when its online link is viewed, when the PDF is downloaded and when a reminder is sent. Invoice emails contain a small image that may report when the email is opened.
• Technical data: IP address, browser or device type and request logs, used for security, rate limiting, abuse prevention and troubleshooting. The mobile apps may send crash reports with personal data removed.
• Support messages you send us.

3. How we use it and our legal bases

We do not sell personal data, use it for advertising or share it with data brokers. We do not use your invoices or customer data to train artificial intelligence models.

• To provide the service you sign up for: creating, sending and storing invoices, sending reminders and showing your dashboard (performance of our contract with you).
• To keep PaidKind secure and reliable: preventing spam and abuse, enforcing sending limits, diagnosing errors (our legitimate interests).
• To send you service messages about your account, security or changes to these terms (contract and legitimate interests). We do not send marketing email without your consent.
• To meet legal obligations, such as keeping records or responding to lawful requests (legal obligation).

4. Service providers we use

We use a small number of providers who process data for us under contracts that require them to protect it and use it only on our instructions:

• Microsoft Azure (UK South region): hosting, database, file storage, logs and backups for the PaidKind website, apps and API.
• Azure Communication Services (Microsoft): delivers invoice and reminder emails on your behalf.
• Clerk: account sign-in and session management. Clerk may process sign-in data in the United States.
• Crash reporting for the mobile apps, when enabled: error reports with personal data scrubbed.

5. WhatsApp and other sharing

When you share an invoice or reminder on WhatsApp or through your device’s share sheet, PaidKind prepares the message and opens the app; you choose the recipient and send it yourself. The message and invoice link are then handled by WhatsApp (Meta) or the app you choose, under their own privacy terms. PaidKind does not connect to your WhatsApp account or read your chats.

6. International transfers

Our main infrastructure is in the United Kingdom. Where a provider processes data outside the UK or the European Economic Area, we rely on adequacy decisions or approved safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

7. How long we keep data

• Account, business, customer and invoice data: for as long as your account exists, so your records stay available to you.
• When you delete your account and you are the only member of your business: the business and all its data, including invoices already sent, are deleted permanently and immediately from the live database, and invoice links stop working. Download your export first; tax law may require you to keep copies of your invoices.
• When you delete your account but other members share the business: only your access and personal account are removed. The business, its customers, invoices and invoice links stay for the remaining members.
• Encrypted database backups roll off within 7 days of any deletion.
• Application and security logs: up to 30 days.
• Support emails: up to 2 years after the conversation ends, unless we need them longer for a legal claim.
• Emails and PDFs already delivered to your customers stay with them; we cannot recall them.

8. Your rights and choices

Depending on where you live, you have rights to access, correct, export, delete or restrict the use of your personal data, and to object to some processing. You can download your data and delete your account yourself in Settings; see the account deletion page for the steps. For anything else, email us and we will respond within one month.

You also have the right to complain to a data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to help first.

9. Cookies

PaidKind uses only cookies that are strictly necessary to sign you in, keep your session secure and protect against abuse. We do not use advertising or cross-site tracking cookies.

10. Security

Data is encrypted in transit (HTTPS) and at rest. Access to production systems is restricted and logged, every request is scoped to the business you belong to, and invoice links use long, unguessable tokens. No system is perfectly secure; if we become aware of a breach affecting your data we will tell you and the relevant authorities as the law requires.

11. Children

PaidKind is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

12. Changes to this policy

We will post any changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

13. Contact

Questions or requests: support@paidkind.com. ENA DIGITAL AI LTD, registered in England and Wales.