Privacy notice

Last updated 4 October 2026 (card payments and the demo added)

Before publishing Replace every [SQUARE BRACKET] below with your real details, and have this checked by someone qualified. It describes the system accurately as built, but accuracy is not the same as legal sufficiency.

This notice explains what happens to personal data in this invoicing application. It is written to be read, not to be survived.

Who is responsible

The application is operated by Vita Media Productions Ltd, company number 14892076, of [REGISTERED ADDRESS]. Questions, requests and complaints: info@odisal.com.

[If registered with the ICO: “We are registered with the Information Commissioner’s Office, registration number [ICO NUMBER].”]

Two different roles

This matters, because it decides who answers to whom:

For people who sign in — we decide how their account data is handled. We are the controller.
For the contents of invoices — the business using the application decides what to record about its own customers. That business is the controller; we only host it. We are the processor, and act on that business’s instructions.

What we hold, and why

Data	Where it comes from	Why
Name, email address, profile picture, Google account identifier	Google, when you sign in	To identify you and decide what you may see. There is no password to store.
Which businesses you may open, and your role in each	Set by an owner of that business	Access control
Invoices, quotes, client names, addresses, emails, amounts, payments, notes	Entered by users of the business	To produce and keep the business’s invoices
Card payments: that an invoice was paid by card, the amount and the date	Stripe, when a client pays an invoice by card	To mark the invoice paid. We never see or store card details.
A change history: who changed which record, when, and a copy of the record	Created automatically as records change	So a business can see what happened to its own invoices
If you try the demo: an anonymous account and your own copy of the sample business, with whatever you type into it	Created when you press Try the demo. No name, email or Google account is asked for	So you can try the app. Nobody else can see your copy
A session cookie	Set when you sign in	To keep you signed in. See the cookie notice.

Our lawful bases

Contract — account data, because you cannot be given access to a system without it.
Legitimate interests — the change history and security records, so a business can account for its own invoices and so access can be kept to the people who should have it.
The client business’s own basis — for invoice contents, which that business decides and we merely store.

What we do not do

These are facts about the system, not promises of intent:

No analytics, no tracking pixels, no advertising, no profiling.
No third-party scripts, fonts or embeds of any kind. Everything the page loads comes from this server.
No selling, sharing or renting of data to anyone.
No access by other clients. Each client’s data is in a separate database, chosen by the domain you visit, and a session issued on one client’s domain is refused on another’s.
No marketing email. The application sends no email at all.

Who else is involved

Who	What they see	Where
Google (sign-in)	That you signed in to this application, and your basic profile. We receive your name, email and picture; we discard the access tokens immediately.	Google Ireland / United States
Amazon Web Services (Lightsail)	Holds the server and its disks. Data is stored in London, eu-west-2.	United Kingdom
Amazon Web Services (S3)	Holds an encrypted, off-site copy of the nightly backups, in a separate account, so that losing the server cannot lose your data. Stored in Stockholm, eu-north-1.	Sweden (EU)
Stripe (card payments)	Only if a business takes card payments and its client chooses to pay by card. The client pays on Stripe’s own page, so Stripe receives the card details and the payment, and acts under its own privacy policy. We receive only that the invoice was paid, the amount and the date. The money goes to the business’s own Stripe account.	Ireland / United States
Exchange-rate provider (Frankfurter)	Nothing about you. Rates are fetched by our server, not by your browser, so only a currency pair and a date are sent. Your address is never disclosed to them.	—

Personal data may also be disclosed where the law requires it.

Check before publishing Your web server (Caddy) may keep access logs containing IP addresses. The application itself records none, but if the server does, say so here and give the retention period.

How long it is kept

What	How long
Invoices and clients	Until deleted by the business. Deleted invoices sit in a recycle bin until purged.
Nightly snapshots inside the database	90 days
Nightly file backups	The most recent 30
Off-site copies of those backups	90 days from when each is copied
Sign-in sessions	7 days, then expired and deleted
A demo copy and its anonymous account	One day, then deleted. Its session lasts the same day
Change history	For as long as the business keeps the record
User accounts	Until removed. [CONFIRM YOUR PERIOD.]

Because backups are taken nightly, deleted data can persist in a backup for up to 30 backup cycles before it ages out, and in the off-site copy of those backups for up to 90 days.

Your rights

You may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how it is used, or to receive it in a portable form. Write to info@odisal.com and we will respond within one month.

If the request concerns the contents of a business’s invoices, we will pass it to that business, because it is their decision, not ours.

You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first.

Security

All traffic is encrypted in transit (HTTPS).
Each client’s data is in a separate database file, selected by the domain in the request.
Access is by invitation. Signing in is not enough on its own: an address must be permitted for that client and given access to a specific business.
Sign-in is by Google. We never see or store a password.

No system is perfectly secure, and we do not claim otherwise.

Changes

If this notice changes materially, we will tell the businesses using the application. The date at the top always reflects the current version.