⚠️ DRAFT — Review with a qualified UK solicitor before publishing. Placeholders in {{ }} must be completed.

Privacy Policy

Last updated: · Applies to autochase.app

This Privacy Policy explains how AutoChase ("we", "us", "our") collects, uses, stores, and protects personal data when you use AutoChase at autochase.app. We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

Privacy contact: privacy@autochase.app

1. Data We Collect

1.1 Account Information

Name and email address (required to create an account)
Password (stored as a cryptographic hash — never in plaintext)
Google account ID and profile photo (if you sign in with Google)
Subscription status and plan (Free or Pro)

1.2 Invoice and Client Data

Invoice details: number, amount, due date, description, status
Client contact information: name, company, email address, bank details you enter
Reminder history: which emails were sent, when, and their status

1.3 Billing Data

Payment processing is handled by Paddle.com Market Ltd as the Merchant of Record. We do not store full card numbers or payment credentials. We receive from Paddle: subscription status, subscription ID, customer ID, and transaction references. Paddle's own privacy policy governs how Paddle handles your payment data: paddle.com/legal/privacy.

1.4 Usage and Technical Data

IP address, browser type, operating system (in server logs)
Pages visited and features used
Error reports (see Sentry, below)
Cookies (session and authentication — see Section 9)

2. Legal Basis for Processing

Purpose	Legal basis
Providing the Service (account, invoices, reminders)	Performance of a contract (Art. 6(1)(b) UK GDPR)
Processing subscription payments via Paddle	Performance of a contract
Security, fraud prevention, error monitoring	Legitimate interests (Art. 6(1)(f))
Product analytics and service improvement	Legitimate interests
Marketing communications (if you opt in)	Consent (Art. 6(1)(a))
Legal and regulatory compliance	Legal obligation (Art. 6(1)(c))

3. How We Use Your Data

To create and manage your account
To send invoice reminder emails to your clients on your behalf
To process your Pro subscription via Paddle
To send transactional emails (e.g. account verification, password reset, billing notifications)
To monitor service health and diagnose errors
To comply with our legal obligations

4. Sub-processors and Third Parties

We share data with the following sub-processors only to the extent necessary to provide the Service:

Processor	Purpose	Location
Coolify (self-hosted)	Application hosting and infrastructure	confirm server region with us
Supabase	Database hosting (PostgreSQL)	AWS ap-southeast-1 (Singapore) — confirm with us if EU residency is required
Resend	Transactional email delivery	USA (SCCs apply)
Paddle.com Market Ltd	Payment processing and subscription billing (Merchant of Record)	United Kingdom
Sentry (Functional Software Inc.)	Error monitoring (PII scrubbing enabled — no invoice amounts, client emails, or card data transmitted)	USA (SCCs apply)
Google	OAuth sign-in (if you choose "Continue with Google")	USA (SCCs apply)

We do not sell personal data to third parties. We do not use personal data for advertising.

5. International Transfers

Some of our sub-processors are located outside the UK/EEA. Where this is the case, we rely on Standard Contractual Clauses (SCCs) approved by the ICO/European Commission, or the UK International Data Transfer Agreement (IDTA), to ensure an adequate level of protection for your data.

6. Data Retention

Account data: retained while your account is active and for up to 90 days after deletion (to allow recovery), then permanently deleted.
Invoice and client data: retained for as long as your account is active. You can delete individual records at any time.
Billing records: retained for 7 years to comply with UK tax and accounting obligations.
Server logs: retained for up to 30 days.
Error reports (Sentry): retained for 90 days.

7. Your Rights Under UK GDPR

You have the right to:

Access — request a copy of the personal data we hold about you
Rectification — correct inaccurate data
Erasure ("right to be forgotten") — request deletion of your data (subject to legal retention requirements)
Restriction — ask us to limit how we process your data
Portability — receive your data in a machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@autochase.app. We will respond within 30 days. We may need to verify your identity before processing your request.

8. Security

All data is transmitted over TLS (HTTPS)
Passwords are stored as cryptographic hashes (Django's PBKDF2-SHA256)
Database access is restricted to application servers only
Error monitoring has PII scrubbing enabled — no financial data reaches Sentry
We perform regular security reviews

9. Cookies

We use the following cookies:

sessionid — HTTP-only session cookie, required for authentication. Expires when you close your browser or after 2 weeks.
csrftoken — CSRF protection cookie, required for form submissions.

We do not use advertising, tracking, or analytics cookies. No third-party marketing scripts are loaded on authenticated pages.

10. Children's Data

The Service is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact us at privacy@autochase.app and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 14 days before they take effect. The "last updated" date at the top of this page indicates when changes were last made.

12. Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the UK:
ico.org.uk/make-a-complaint · 0303 123 1113

13. Contact

For any privacy questions or data subject requests:
Email: privacy@autochase.app