Privacy Policy

Last updated: May 2026

2. Who We Are

Infyvy Billing is a billing, invoicing and accounting-related software service designed to help businesses create, manage and organise invoices, customer records, supplier records, VAT records and related financial information.

Where the service connects to HM Revenue & Customs (“HMRC”), the connection is used only for authorised functions such as viewing VAT information, retrieving VAT obligations and, where enabled by the user, submitting VAT returns through HMRC Making Tax Digital (“MTD”) APIs.

3. Scope of This Privacy Policy

This Privacy Policy applies to:

• visitors to our website;
• registered users of Infyvy Billing;
• businesses using our invoicing, accounting or VAT features;
• users who connect Infyvy Billing to HMRC;
• customers, suppliers or contacts whose details are entered into the service by a user;
• people who contact us for support, enquiries or service-related matters.

4. Our Role Under Data Protection Law

Depending on the context, we may act as a data controller or a data processor.

4.1 When We Act as Data Controller

We act as a data controller when we decide why and how personal data is processed, for example when we manage user accounts, security logs, support requests, billing records, service access, legal compliance, product improvements and communication with users.

4.2 When We Act as Data Processor

We may act as a data processor where a business user enters personal data relating to its own customers, suppliers, staff, contractors or business contacts into Infyvy Billing and we process that data only to provide the service.

5. Personal Data We May Collect

Depending on how you use the service, we may collect and process the following categories of data:

5.1 Account and Identity Data

• name;
• email address;
• phone number;
• username or account ID;
• password in encrypted/hashed form;
• business role or user permissions.

5.2 Business and Company Data

• company name;
• trading name;
• company registration number;
• VAT registration number;
• business address;
• billing address;
• business email and telephone number;
• tax identifiers and accounting references.

5.3 Invoice, Billing and Accounting Data

• invoice numbers;
• invoice dates and due dates;
• customer and supplier details;
• descriptions of goods or services;
• amounts, taxes, discounts and totals;
• VAT rates and VAT amounts;
• payment status and payment references;
• credit notes, adjustments and refunds;
• purchase records and sales records.

5.4 HMRC and Tax-Related Data

If you choose to connect Infyvy Billing with HMRC, we may process:

• VAT Registration Number (“VRN”);
• VAT obligations;
• VAT period keys;
• VAT return values;
• VAT submission confirmation data;
• HMRC form bundle numbers;
• HMRC charge reference numbers;
• HMRC payment indicators;
• OAuth authorisation codes, access tokens and refresh tokens;
• grant/authorisation expiry information;
• HMRC API request and response logs required for service operation, troubleshooting or compliance.

5.5 Technical and Security Data

• IP address;
• browser type and version;
• device information;
• operating system;
• login times and access logs;
• session identifiers;
• security events;
• error logs;
• fraud-prevention headers required or expected by HMRC APIs;
• cookie identifiers and similar technologies.

5.6 Support and Communication Data

• messages sent to us;
• support tickets;
• email correspondence;
• feedback and complaints;
• records of actions taken to resolve support issues.

6. How We Collect Data

We may collect data:

• directly from you when you create an account or use the service;
• when you enter invoice, customer, supplier or accounting information;
• when you connect your account to HMRC;
• when HMRC returns authorised information through its APIs;
• automatically through logs, cookies and security technologies;
• when you contact us for help, support or information.

7. Why We Use Your Data

We use data for the following purposes:

• to create and manage user accounts;
• to provide billing, invoicing and accounting software functionality;
• to store and display invoices, customers, suppliers and business records;
• to calculate VAT-related figures where enabled;
• to connect your account to HMRC when you authorise us to do so;
• to retrieve VAT obligations from HMRC;
• to submit VAT returns to HMRC when you instruct and authorise us to do so;
• to maintain audit trails and transaction records;
• to detect, prevent and investigate misuse, fraud, unauthorised access or security issues;
• to comply with legal, tax, accounting and regulatory obligations;
• to provide customer support;
• to improve the reliability, security and performance of the service;
• to communicate important service, security, compliance or legal notices.

8. Legal Bases for Processing

We process personal data only where we have a lawful basis to do so. Depending on the context, the legal bases may include:

8.1 Contract

We process data where necessary to provide the Infyvy Billing service to you, manage your account, provide support and deliver the features you request.

8.2 Legal Obligation

We may process and retain certain business, tax, accounting, security and transaction data where required by applicable law, including tax, accounting, audit and regulatory obligations.

8.3 Legitimate Interests

We may process data for legitimate business interests, including service security, fraud prevention, system maintenance, service improvement, troubleshooting, business administration and protection of our legal rights, provided those interests are not overridden by your rights and freedoms.

8.4 Consent

We rely on consent where required by law, for example for certain cookies, optional communications or where you explicitly authorise an HMRC OAuth connection. You may withdraw consent where consent is the applicable legal basis.

9. HMRC Integration and OAuth Authorisation

If you choose to connect Infyvy Billing with HMRC, you will be redirected to HMRC to sign in and authorise access. We do not collect or store your HMRC Government Gateway password.

After authorisation, HMRC may provide us with access tokens, refresh tokens and related information that allow Infyvy Billing to perform authorised VAT actions on your behalf, within the scope of the permissions you granted.

We use HMRC access only for the purposes of providing features you request, such as retrieving VAT obligations or submitting VAT returns. We do not sell HMRC data or use it for unrelated marketing.

You may revoke HMRC authorisation according to HMRC’s available processes or by contacting us for assistance. If authorisation is revoked, HMRC-connected features may stop working.

10. VAT Return Responsibility

Infyvy Billing may help prepare, calculate, organise or submit VAT-related information. However, you remain responsible for reviewing the accuracy and completeness of all VAT returns, tax data, invoices, accounting figures and submissions before they are sent to HMRC.

Unless we expressly agree otherwise in writing, Infyvy Billing does not provide tax, legal, accounting or financial advice. You should obtain professional advice where needed.

11. Data Sharing

We do not sell your personal data. We may share data only where necessary and appropriate, including:

• with HMRC, where you authorise API access or instruct us to submit information;
• with hosting and infrastructure providers;
• with database, backup and security service providers;
• with email and communication providers;
• with payment providers, where paid services are used;
• with professional advisers, such as accountants, legal advisers or auditors;
• with regulators, public authorities, law enforcement or courts where legally required;
• with another organisation in connection with a business transfer, restructuring, merger or sale.

12. International Transfers

We may process or store data using service providers located outside the United Kingdom or European Economic Area. Where this occurs, we aim to use appropriate safeguards, such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms.

13. Data Security

We use appropriate technical and organisational measures designed to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include:

• encrypted HTTPS connections;
• password hashing;
• access controls;
• database security controls;
• server security monitoring;
• restricted administrative access;
• backup procedures;
• security logging;
• token protection for HMRC API credentials.

No online service can be guaranteed to be completely secure. Users must also protect their own account credentials and notify us promptly of any suspected unauthorised access.

14. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the service, comply with legal obligations, resolve disputes, maintain audit trails and enforce agreements.

Accounting, invoice and tax-related records may need to be retained for statutory accounting, tax or audit periods. HMRC token data is retained only for as long as needed to maintain authorised API access or until authorisation is revoked, expires or is no longer required.

When data is no longer required, we will delete, anonymise or securely archive it where appropriate.

15. Cookies and Similar Technologies

We may use cookies and similar technologies to operate the website, maintain secure sessions, remember preferences, analyse usage and improve service performance.

Some cookies are necessary for the service to function. Optional cookies, such as analytics or marketing cookies, will be used only where permitted by law and, where required, with your consent.

16. Your Data Protection Rights

Depending on your location and the circumstances, you may have the following rights:

• the right to access your personal data;
• the right to correct inaccurate or incomplete data;
• the right to request deletion of your data;
• the right to restrict processing;
• the right to object to processing;
• the right to data portability;
• the right to withdraw consent where processing is based on consent;
• the right to complain to a data protection authority.

To exercise your rights, contact us at: contact@infyvy.uk.

17. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue.

If you are in the United Kingdom, you may also have the right to complain to the Information Commissioner’s Office (“ICO”). More information is available at: https://ico.org.uk/.

18. Accuracy of Information Entered by Users

Users are responsible for ensuring that information entered into Infyvy Billing is accurate, complete and lawful. This includes customer details, supplier details, invoices, VAT amounts, VAT rates, VAT registration numbers and VAT return figures.

19. Data About Third Parties

If you enter personal data about customers, suppliers, employees, contractors or other third parties, you must ensure that you have the right to provide that data to us and that those individuals have been given any privacy information required by law.

20. Children

Infyvy Billing is intended for business and professional use. It is not intended for children and should not be used by anyone under the age of 16.

21. Automated Decision-Making

We do not use personal data to make solely automated decisions that have legal or similarly significant effects on individuals, unless clearly stated and permitted by law.

22. Marketing Communications

We may send service-related communications that are necessary for the operation of your account. We may send marketing communications only where permitted by law. You can opt out of marketing communications at any time.

23. Service Providers

We may use third-party service providers to help operate Infyvy Billing. These providers may process data on our behalf and must use it only according to our instructions and applicable data protection requirements.

24. HMRC Fraud Prevention and Technical Headers

When communicating with HMRC APIs, we may send technical and fraud-prevention information required or expected by HMRC, such as connection method, public IP address, device identifiers, user agent, vendor version and related request information.

This information is used to support API security, fraud prevention, auditability and service integrity.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on this page with a revised “Last updated” date. Where changes are significant, we may notify users by email, account notice or another appropriate method.

26. Contact Us

For privacy questions, data protection requests or complaints, contact:

Email: contact@infyvy.uk
Website: https://infyvy.uk/
Company: GREEN POWER MANAGE SRL
Address: Str. Garii 31 Ap. 6, Baia Mare, Maramures, Romania, 430172

Read our Terms & Conditions.