Privacy Policy
Last updated: 18 August 2026
What we collect
About you, when you sign up:
- Your name, business name and email address
- A one-way hash of your password — we never store the password itself
- Your Stripe connected account ID (an identifier, not your bank details)
- If you connect PayPal, your API credentials, encrypted at rest
About your invoices, when you create them:
- Client names, email addresses, amounts, dates and line-item descriptions
- Payment records: amount, provider, reference and status
What we never see
Card numbers and bank details are entered on Stripe's own pages and never reach our servers. Your customers' identity documents, submitted during Stripe onboarding, go directly to Stripe.
Why we hold it
To run the service you asked for: showing your invoices, sending reminders you configure, and marking invoices paid when a provider confirms a payment. We do not sell your data, and we do not use it for advertising.
Who else processes it
- Stripe — payment processing and account verification
- PayPal — only if you connect it
- Resend — sending email on your behalf
- Amazon Web Services — hosting
Your customers' information
When you invoice someone, you decide what to collect and why; we process it on your instructions. If one of your customers asks about their data, contact us and we will help you respond.
How long we keep it
Until you delete it. Deleting your account from Settings permanently removes your profile, invoices and payment records from PayUp. Stripe keeps its own transaction records independently, as it is legally required to, and we cannot delete those for you.
Your rights
You can access, correct, export or delete your data. Most of it is editable directly in the app, and account deletion is in Settings. For anything else, email us. If you are in the UK or EU, you also have the right to complain to your data protection authority.
Security
Traffic is encrypted in transit with HTTPS. Passwords are hashed, and stored provider credentials are encrypted at rest. No system is perfectly secure, but we do not store the categories of data that would be most damaging to lose — card numbers and bank details never reach us.