Privacy notice
Last updated Nov 4, 2026
How MinsoBill collects and uses personal data, and your rights. It covers the UK GDPR, the EU GDPR and US state privacy laws. In short: we use your data to run MinsoBill for you, we never sell it, and there is no advertising or tracking.
Who we are
Contact us at support@minsobill.com.
For your account and business details, MinsoBill is the controller. For the details of your clients that you put into MinsoBill, you are the controller and we process them for you, as set out in our data processing agreement. If you are a client who received an invoice through MinsoBill, the business that sent it is responsible for your data; contact them first, and we will help them.
What we collect, why, and our lawful basis
| Data | What it includes | Why | Lawful basis |
|---|---|---|---|
| Your account | Your name, email address and password (stored only as a secure hash by our sign-in provider). | To create your account and sign you in. | Contract |
| Sign-in and security records | When you sign in, your IP address and browser details, and the time. Failed password checks on sensitive changes. If you turn on two-step sign-in, the name you give each authenticator app and its secret key, kept by our sign-in provider. | To keep your account secure and spot misuse. | Legitimate interests (security) |
| Your business | Business name, address, country, tax and company numbers, logo, and the payment details you choose to show (for example bank details). | To put them on your invoices and pay pages. | Contract |
| Your clients, products, invoices and quotes | What you enter: client names, email addresses, phone numbers and addresses, items, prices, payments and notes. | To create, send and track your documents. We handle this for you, as your processor (see our DPA). | Contract (and your instructions under the DPA) |
| Emails we send for you | The recipient's address, the email, and delivery events from our email provider (delivered, bounced, complained). | To send your invoices, quotes and reminders, and show you honestly whether they arrived. | Contract |
| Your clients' visits to invoice links | That a link was opened and when; a payment report or quote answer if the client sends one (the name they type, date, amount, note). Their IP address is turned into a one-way keyed hash and never stored as is. | To show you "Link opened", pass on what the client tells you, and limit abuse of public links. | Contract with you; legitimate interests (preventing abuse) |
| AI quick-create usage | How many AI drafts were made, their size in tokens and whether they worked. Not the text you typed. | To apply the plan's allowance and keep costs in check. | Contract; legitimate interests |
| Stripe connection | If you connect your own Stripe account: its account ID and whether it can take payments. | To offer card payments to your clients through your own Stripe account. | Contract |
| Support messages | What you send to support and our replies. | To answer you and fix problems. | Legitimate interests |
| Server logs | Requests to the app, with IP address and browser details, kept by our hosting provider. | To run the service, fix faults and protect it from attack. | Legitimate interests (security and reliability) |
"Contract" means we need the data to provide the service you signed up for (UK and EU GDPR Article 6(1)(b)). "Legitimate interests" means we need it to run MinsoBill safely, and this does not override your rights (Article 6(1)(f)). We do not use your data for advertising, we do not sell or rent it, and we do not use analytics or tracking tools.
AI quick-create
AI quick-create turns a short typed description into a draft invoice for you to review. It is optional: you can make every invoice without it, and it is only used when you choose to.
- When you use it, we send Anthropic (the AI provider) only the text you typed, today's date, your base currency and your business locale. Nothing else from your account is sent.
- We do not store or log the text you type. It is kept in your browser only while you review the draft. We record only how many drafts were made and their size, for your plan's allowance.
- Anthropic processes the text under its data processing addendum and its commercial terms, which do not allow it to train its models on what we send.
- The AI never calculates amounts and never sends anything. You check every field before a draft is created.
Avoid typing personal details the draft does not need.
Who we share it with
We use a small number of providers (sub-processors) to run MinsoBill, such as our hosting, database and email providers. Each one is listed, with what it does, where, and its DPA, on the sub-processors page. We give 30 days' notice there before adding a new one.
We also share data when the law requires it, for example a valid court order, and only as much as it requires.
Where your data is stored
Your data is hosted in the United States: the database, sign-in and file storage with Supabase (AWS us-east-1, Virginia) and the app with Vercel (iad1, Washington, D.C. area). Emails are sent through Resend from Ireland.
When data about people in the UK or the EU is transferred to the United States, we rely on the EU–US Data Privacy Framework and its UK Extension where the provider is certified under them. Where a provider is not certified, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum or the UK International Data Transfer Agreement (IDTA) for UK data. The basis for each provider is on the sub-processors page.
How long we keep it
- Account, business and invoice data: for as long as you have an account. You can download everything at any time in Settings, Your data & plan.
- After you cancel a paid plan, you keep read-only access for at least 12 months (our Plan Promise). We never delete an account for inactivity without 3 emailed warnings first.
- When you ask us to delete your account, we delete its data from the live service. Copies in our backups expire on their own: daily copies within 35 days and monthly copies within 13 months.
- Hashed IP addresses used to limit abuse of invoice links: 1 day.
- Support emails: as long as we need them to deal with your request and any follow-up. Server logs are kept for the hosting provider's standard period.
You decide how long to keep your own invoices. Tax rules often require businesses to keep them for several years; export them before you delete your account.
Your rights
Under the UK GDPR and the EU GDPR you have the right to:
- get a copy of your personal data (access), and receive it in a portable format;
- have it corrected if it is wrong;
- have it deleted;
- restrict or object to how we use it, including where we rely on legitimate interests;
- withdraw consent, where we rely on it.
No decision with legal or similarly significant effects is made about you by automated means alone. To use any right, email support@minsobill.com from the address you sign in with. We reply within one month. Much of it you can do yourself: edit your details in Settings, and download all your data in Settings, Your data & plan.
Complaints
Please contact us first and we will try to put it right. You also have the right to complain to a data protection authority:
- in the UK, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint;
- in the EU, the supervisory authority in the country where you live or work, or where you think the problem happened: list of EU authorities.
US state privacy rights
If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Utah, Texas or Oregon), you have the right to know what personal information we hold about you, to get a copy, to have it corrected or deleted, and not to be treated differently for using these rights.
- The categories we collect are listed in the table above: identifiers (name, email, IP address), commercial information (invoices and payments you record), and internet activity (sign-in and server logs). We collect them from you, from your clients' visits to your invoice links, and from our providers.
- We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling. Your password is used only to sign you in.
- To make a request, email support@minsobill.com. An authorized agent may act for you with your written permission. If we refuse a request, you can appeal by replying to our answer, and we will review it again.
Children
MinsoBill is a tool for businesses and is not meant for anyone under 18.
Changes to this notice
We update the date at the top whenever this notice changes, and list important changes in the changelog. If a change affects how we use your data, we email you before it takes effect.