Privacy Policy

This policy explains how we collect, use and protect your personal data when you use LingvaBill. We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (data controller)

The data controller responsible for your personal data is:

• Prav Development Ltd, trading as LingvaBill
• Company number 17313021, registered in England & Wales
• Registered office: 124 City Road, London, United Kingdom, EC1V 2NX
• Contact: info@lingvabill.co.uk

2. What data we collect

We collect only what we need to provide the service:

• Account details - your name, email address, password (stored securely, never in plain text), and your business details (business name, address, VAT number where you provide it).
• Invoicing data - the invoices, quotes and clients you create, including your clients' names, addresses and contact details that you enter. If you choose to use the "Translate to English" feature, the line-item text you translate is processed by a third-party AI provider (see Sharing below); translation only ever happens when you tap the button - never automatically.
• Payment data - if you subscribe or accept card payments, payments are handled by Stripe. We do not see or store your card details; we hold only limited records such as your subscription status and Stripe identifiers.
• Technical data - basic information needed to run and secure the service, such as log data and your language preference.

For your clients' data that you enter, you are the data controller and LingvaBill is your processor: we process it only to provide the service to you, under our Data Processing Addendum.

3. How we use your data, and our lawful basis

• To provide the service (create your account, generate and send invoices) - lawful basis: performance of a contract with you.
• To take payment for your subscription - lawful basis: performance of a contract.
• To keep the service secure and working, and to meet our legal obligations (for example, records we're required to keep) - lawful basis: legitimate interests and legal obligation.
• To contact you about your account or important service changes - lawful basis: legitimate interests / contract.

We do not sell your personal data, and we do not use it for advertising.

4. Sharing your data

We share data only with service providers that help us run LingvaBill, under appropriate safeguards:

• Stripe (payments) - processes our subscription billing and, where you enable it, card payments on your own invoices. We never see or store card numbers.
• Hetzner (hosting, Germany/EU) - stores and runs the service, including each business's separate database.
• Brevo (email, EU) - sends platform emails such as verification, password reset, security codes and your invoice emails.
• Anthropic (AI translation, USA) - when you tap "Translate to English", only the line-item text (product/service descriptions) is sent for translation. It is not used to train AI models. It is not intended to contain personal data, though a description you write could incidentally include some; no client names, addresses or totals are sent as structured data. Translations are cached against your account (the cache key includes your business identifier, the text, your interface language and the AI model version) so repeated phrases are not re-processed. Cached translations are deleted when your account is erased.

We may also disclose data if required by law. We do not otherwise share your data with third parties.

5. Invoice verification pages

Invoice PDFs carry a QR code and short link so your client can check the invoice is genuine before paying. Anyone holding that link can see the verification page, which shows your business details, the invoice number, amount, status and the bank details you entered - that is its anti-fraud purpose. Each lookup is logged (the link used, IP address and time) to detect abuse. Verification pages are never indexed by search engines, and they are removed when the invoice or your account is deleted.

6. Where your data is stored

Your data is stored on secure servers, and each business's data is kept separated from every other. Where any provider processes data outside the UK/EU, we rely on appropriate safeguards as required by UK GDPR.

7. How long we keep it

We keep your data for as long as you have an account with us. What happens afterwards depends on which of two options you choose in My data:

• Closing your account makes it read-only: you can still sign in, view and download everything, but nothing can be added or changed. Your data is retained and you can reopen the account at any time. Your subscription is set not to renew - you keep access to what you have paid for until the period ends.
• Deleting your account locks it immediately and starts a 7-day grace period during which you can change your mind by signing in. After the grace period, we permanently delete your personal data.
• What we must keep: issued invoices and credit notes (including the client details shown on them) are business records the law requires to be retained - we keep them for 6 years from the end of the relevant accounting period, in line with HMRC record-keeping rules. During that time they are held "beyond use": locked away, not accessible to anyone, not used for anything - then permanently deleted.
• Your copy: before deletion you are prompted to download your data. Keeping your own business records (including for HMRC) is your responsibility - the export is how you take your copy with you.
• Backups are excluded from any restore once you delete, and backup copies are removed on erasure and on their normal rotation cycle.
• Cached translations are stored against your account and ARE deleted when your account is erased.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data (the "right to erasure");
• object to or restrict how we use your data;
• receive a copy of your data in a portable format.

Access and a portable copy are self-service: open My data in your account and download everything as CSV files. Account deletion (erasure) can be requested from the same place. Corrections are self-service too - you can edit your own invoices, clients and settings at any time. For restriction or objection requests, or anything the self-service tools do not cover, email info@lingvabill.co.uk. We respond within one month.

9. Cookies

We use essential cookies and similar storage needed to run the service - for example to keep you signed in and to remember your language choice. On our public website only, and only if you consent, we also use Google Analytics to understand how the site is used; these analytics cookies load only after you accept them, and never inside your logged-in account. We do not use advertising cookies. The public contact form uses Cloudflare Turnstile to block spam, which processes limited technical information from your browser for that purpose only. For full details, see our Cookie Policy.

10. Complaints

If you believe we have not handled your personal data properly, please contact us first at info@lingvabill.co.uk so we can put it right. You also have the right to lodge a complaint with the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

11. Changes to this policy

We may update this policy from time to time. When we make significant changes, we'll update the date at the top and, where appropriate, let you know.