Privacy policy
Last updated: 18 October 2026
This policy explains what personal information PaySorted collects, why, who we share it with and your rights. It's written to be read, not skimmed past — if anything isn't clear, email support@paysorted.uk.
1. Who we are
PaySorted is a trading name of Gary Callaway, a sole trader ("PaySorted", "we", "us"). Address (including for service of documents): 61 Harcourt Gardens, Bath, BA1 4DL, UK. Email: support@paysorted.uk. ICO registration number: ZC262506.
2. Two different roles
We are the controller for information about the people who use PaySorted (business owners, their staff and accountants), visitors to this website and anyone who contacts us. This policy covers that information.
We are a processor for the information our users add about their customers — names, contact details, addresses, quotes, invoices, payments, photos and messages. The business you deal with decides how that information is used and is the controller for it; we handle it only on their instructions, under the data processing terms in our terms of service. If you're a customer of a business that uses PaySorted, please see section 6 and contact that business about your information.
3. What we collect
- Account details: your name, business name, trade, email, mobile, business address, logo, and the legal, VAT, company and bank details you choose to show on your invoices. Your password is stored by our login provider in scrambled (hashed) form — we can't see it.
- Billing: your plan, subscription history and receipts. Card details go straight to Stripe — we never see or store them.
- What you put in the app: your customers, jobs, quotes, invoices, expenses, receipt photos, documents, price list, message wording and settings.
- Voice and photo features: if you speak an invoice or photograph a receipt, the recording or photo is sent to our AI provider to turn it into text and figures. You check the result before saving it.
- Accountants and staff: name, email, practice name, and which businesses they can see.
- Codes from links: a referral, partner or offer code if you sign up from a link that contains one.
- When you contact us: what you send through the contact form, call-back or set-up requests, and emails.
- Information from others: if a business invites you as staff or as its accountant, we get your name and email from them. Stripe tells us whether payments have succeeded, and accounting services you connect send us the data needed to keep them in step.
- Technical information: like any website, our hosting and server providers record your IP address, browser and the pages or functions you used, for security and to fix faults.
- Website visit counts: when you open a page on our public website (not the app, invoices or trader pages), we record which page it was, the website that sent you (for example Google), any campaign tag in the link (such as from one of our flyers) and whether you're on a phone, tablet or computer. To count how many different people visit without knowing who they are, your IP address and browser details are turned into a scrambled code using a secret that changes every day and is then deleted. Your IP address isn't stored, visits can't be linked from one day to the next, and nothing is stored on your device. We don't use advertising tracking.
4. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Running your account, and sending your quotes, invoices, reminders and receipts | Contract |
| Taking subscription payments and keeping billing records | Contract; legal obligation (tax records) |
| Service messages — trial ending, failed messages, security, your morning summary (you can switch the summary off) | Contract; legitimate interests |
| Turning voice notes and receipt photos into invoices and expenses, when you use those features | Contract |
| Giving your accountant access, once you've agreed | Contract; your consent to that access |
| Applying referral, partner and offer codes and giving rewards | Contract; legitimate interests |
| Answering enquiries and set-up requests | Legitimate interests; steps before a contract |
| Keeping PaySorted secure, preventing fraud and misuse, fixing faults | Legitimate interests |
| Counting visits to our public website so we can see which pages help people and how they find us | Legitimate interests |
| Meeting legal duties and dealing with legal claims | Legal obligation; legitimate interests |
Our legitimate interests are: running and improving PaySorted, keeping it secure and preventing fraud, responding to enquiries, running our referral scheme, and protecting our legal position. You can object to any use based on legitimate interests (see section 8).
You need to give us your name, email and business details to have an account — without them we can't provide PaySorted. Everything else is optional. Nothing is required by law.
Marketing: we don't send marketing emails at the moment. If we start, we'll only email you with your consent, or — for paying and trial users — where you were given the chance to say no when you signed up, with an unsubscribe link in every email.
We never sell personal information, and we never use your customers' details for our own marketing.
5. Who we share it with
Only the suppliers we need to run PaySorted. Where they handle information for us, they're bound by data processing terms and may use it only to provide their service to us. jsDelivr and the browser push services handle only technical data (such as IP addresses) under their own terms — notification content is encrypted on its way to your device, so push services can't read it.
| Supplier | What for | Where |
|---|---|---|
| Supabase | Database, file storage, logins and server functions | UK/EU |
| Cloudflare | Website and app hosting, DNS and security (it sees visitors' IP addresses, as any host does) | Global, incl. USA |
| Fasthosts | Our support email inbox | UK |
| jsDelivr | Delivers part of the app's code to your browser (it sees your IP address, as any website you load does) | Global network |
| Resend | Sending emails | USA |
| Twilio | Sending text messages | USA |
| Stripe | Subscription payments, and card and bank payments from your customers (Stripe also acts under its own privacy policy for payments) | UK/EU/USA |
| OpenAI | Reading voice notes and receipt photos, only when you use those features. OpenAI doesn't use this data to train its models. | USA |
| Apple, Google or Mozilla push services | Delivering app notifications, only if you turn them on | Global |
We also share information:
- with Xero, Intuit QuickBooks, FreeAgent, Sage or Zapier — only if you connect them, and only what's needed to sync your invoices and payments. They act under their own terms and privacy policies;
- with your accountant or bookkeeper — only once you've agreed to give them access;
- with professional advisers, or where the law requires it (for example HMRC, the police or a court); and
- with a buyer, if the business is ever sold, under the same protections.
Outside the UK: where a supplier handles information outside the UK, we rely on UK adequacy regulations (including the UK–US data bridge for certified US companies) or the ICO's International Data Transfer Agreement or Addendum, so it stays protected to UK standards. You can ask us for details or a copy of the safeguards we use.
6. If you're a customer of a business that uses PaySorted
The business that sent you a quote, invoice, reminder, text or service reminder is responsible for your information. We store and send it for them. Emails and texts come from the business through PaySorted. If you reply, tell them you've paid, ask a question, book through their web page or pay online, that goes to the business (payments are made through Stripe).
To access, correct or delete your information, or to stop messages, contact the business directly. If you contact us instead, we'll pass your request to them straight away. Every service reminder and review request includes a link to stop them.
7. How long we keep it
- Your account and records: while your account is open. If your trial or subscription ends, your account becomes read-only and is deleted 90 days later. You can delete your account at any time from More → Privacy & your data, which deletes your account data straight away (except billing records we must keep); backup copies are cleared within 30 days.
- Billing records: 6 years, because tax law requires it.
- Enquiries and support emails: up to 2 years after we last hear from you.
- Referral records: while the referral can earn a reward, then with your billing records.
- Technical logs: for the short period our providers keep them (usually days to weeks).
- Website visit counts: up to 13 months. The daily secret used to scramble visitor codes is deleted after one day.
8. Your rights
You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another service. You can download all your data at any time from More → Privacy & your data. Where we rely on consent, you can withdraw it at any time. We'll reply within one month. It's free unless a request is clearly unfounded or excessive.
If you're unhappy with how we've handled your information, please tell us first so we can put it right — we'll acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
9. Automated decisions
We don't make decisions about people that have legal or similarly significant effects using automated means alone. Reminders go out automatically, but only on the schedule and wording the business has chosen, and they stop when an invoice is paid. AI suggestions (from voice notes or receipt photos) are always shown to you to check before they're saved.
10. Cookies and storage on your device
We only store things on your device that are needed for PaySorted to work, or to remember a choice you've made — such as keeping you logged in or remembering light or dark mode. There are no advertising, analytics or tracking cookies, so we don't need to ask for cookie consent. We count visits to our public pages without using cookies or storing anything on your device (see section 3). See our cookie policy for the full list.
11. Security
Information is encrypted in transit and at rest. Each business can only see its own records, and accountants only see clients who've agreed. Customer links use long random codes, and shared files use links that expire. If something ever went wrong that put your information at risk, we'd tell you and, where required, the ICO.
12. Children
PaySorted is a business service for people aged 18 and over. We don't knowingly collect information about children.
13. Changes
If we make important changes we'll tell you by email or in the app before they take effect. The date at the top shows when this policy last changed.
Questions? Email support@paysorted.uk.