← Back to VanBill

Privacy Policy

Last updated: 13 September 2026

Who we are

VanBill is an invoicing service for UK trades and service businesses. The data controller for the personal data described below is VANBILL LTD, a company registered in England and Wales (company number 17455541), whose registered office is at 124-128 City Road, London, EC1V 2NX.

Questions about this policy, or to exercise any of your rights below: support@vanbill.co.uk.

What we collect and why

Account holders: your name, email and the business data you enter (clients, quotes, invoices, payments). Legal basis: performance of a contract. We process this data to provide the service you signed up for.

Your own business details: if you add your bank details (account name, sort code, account number and bank) and your VAT number in Settings, we store them for one purpose only: to print them on the invoices and quotes you generate. We do not use them for anything else.

CIS. Where you use the Construction Industry Scheme on an invoice, we record the labour and materials split and the deduction rate and amount on that invoice. We do not store subcontractor UTRs or National Insurance numbers.

Your clients' details: when you add a client, you are the data controller for that information and we process it on your behalf, only to provide the service.

Legal basis

UK GDPR asks us to name the lawful ground for each use of your data. In plain terms:

  • Contract. Running the service for you — your account, your data, and processing your clients' data on your instructions — is how we perform our contract with you.
  • Legitimate interests. Keeping the service secure, the one-way trial fingerprint that stops the same free trial being taken over and over, and Vercel's cookieless visitor counts.
  • Legal obligation. Keeping financial records for as long as UK law requires us to.
  • Consent. We currently rely on none — we set no non-essential cookies and send no marketing. If that ever changes, we will ask you first.

Where it lives

Data is stored with Supabase (Postgres) in the London (eu-west-2) region, encrypted in transit and at rest. Every business's data is isolated with database-level row security.

Four companies process data on our behalf, and no one else:

  • Supabase stores the database, files and login accounts. London region.
  • Vercel runs the website itself, so requests pass through it. Vercel also gives us basic visitor numbers — which pages were viewed and roughly where from. It sets no cookies and does not build a profile of you or follow you to other sites.
  • Stripe handles subscription payments. Card details go straight to Stripe and never reach us.
  • Resend delivers our email: sign-up confirmations, password resets, and any invoice you choose to send by email, which includes your client's name and address.

We do not sell personal data, share it for advertising, or pass it to anyone beyond those four.

Leaving the UK. Your database and files stay in London. Stripe, Resend and Vercel are US companies, so some processing happens outside the UK. That is covered by the UK International Data Transfer Addendum in our contracts with them, which is the safeguard UK law requires.

How long we keep it

While your account is open we keep your data so the service works. Delete your account and the business, its clients, quotes, invoices, payments and PDFs go immediately — there is no waiting period and no copy kept back.

Two exceptions, both deliberate. Our record of who changed what on a financial document is kept for 24 months and then deleted automatically. And the scrambled fingerprint described below is kept indefinitely, because it is the only thing stopping the same free trial being taken over and over.

Your rights

Under UK GDPR you can request access to, correction of, export of, or deletion of your personal data at any time. You don't have to ask us for either: export everything as CSV from Settings, and delete your account and all its data from the same page. If you would rather we did it, or you want something we don't offer self-serve, email us and we'll action it within 30 days.

One thing outlives deletion, and we'd rather say so plainly. To stop the same person taking an unlimited number of free trials, we keep a one-way scrambled fingerprint of the email address that used one. It can't be turned back into your address or used to contact you, and it's the only thing we keep. Everything else goes.

Children

VanBill is a tool for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

Cookies

We use only essential cookies needed to keep you signed in. No advertising or cross-site tracking cookies. Our visitor counts come from Vercel, which measures page views without setting a cookie, so there is no cookie banner to click through.

If you think we've got this wrong

Tell us first and we will try to put it right — support@vanbill.co.uk. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.