1. Agreement
This Acceptable Use Policy ("AUP") forms part of your agreement with ENKKI LIMITED (trading as InvoFlow) when you access or use our service at invoflow.uk. By creating an account, accepting an invite, or using the platform, you confirm that you have read, understood, and agree to this AUP and our Privacy Policy.
If you use InvoFlow through an employer or client organisation, you must also follow their internal policies. Where those policies are stricter, the stricter rule applies.
2. Who this applies to
- Account holders and invited users
- Organisation administrators and finance approvers
- Anyone accessing the service under your credentials
You are responsible for activity under your account unless you promptly report unauthorised access to security@invoflow.uk.
3. Permitted use
InvoFlow is a business tool for legitimate expense and invoice workflows. You may use it to:
- Capture, upload, and store receipts and invoices for genuine business expenses
- Extract, review, and correct data from those documents
- Group expenses into claims and submit them for internal approval
- Review, approve, or reject claims where your role allows
- Export or hand off approved data to your organisation's finance processes
- Manage organisation settings, categories, and team membership as an administrator
Use must comply with applicable law, your organisation's policies, and the rights of third parties (including merchants and colleagues whose data may appear on receipts).
4. Prohibited use
You must not use InvoFlow to:
| Category | Examples |
|---|---|
| Fraudulent claims | Inflated amounts, duplicate claims for the same expense, personal spend misrepresented as business spend, forged or altered receipts |
| Unlawful content | Material that infringes copyright, contains malware, or depicts illegal activity |
| Privacy violations | Uploading unnecessary personal information about third parties; sensitive data on receipts without a lawful basis |
| Abuse | Harassment, threats, or abuse of other users or InvoFlow staff |
| Security testing | Probing, scanning, or testing vulnerabilities without prior written permission |
| Access circumvention | Bypassing security controls, impersonation, shared accounts, or accessing another organisation's data |
| Scraping and reverse engineering | Bulk harvesting or reverse engineering except as permitted by law and our written agreement |
| Service disruption | Denial-of-service attempts, excessive automated requests, or resource abuse |
| Unauthorized resale | Reselling or sublicensing the service, or building a competing product using unauthorised access |
5. Account and credential security
- Use a strong, unique password and keep it confidential
- Do not share login credentials; use invites for teammates
- Sign out on shared or public devices
- Notify us promptly if you suspect compromise
Organisation administrators must only invite people who are authorised to access that organisation's data and should revoke access promptly when someone leaves.
6. Organisation administrator responsibilities
If you administer an organisation on InvoFlow, you additionally agree to:
- Assign roles appropriately (least privilege)
- Ensure invitees are employees, contractors, or others permitted to see org data
- Maintain accurate organisation and category settings
- Investigate suspected misuse within your team and cooperate with us on abuse reports
- Act as data controller for expense content uploaded by your users. See our Privacy Policy
7. Content you upload
You retain ownership of receipts, invoices, and related content you upload. You grant InvoFlow a limited licence to host, process (including OCR), display, and transmit that content solely to provide the service to you and your organisation.
You represent that you have the right to upload the content and that doing so does not violate law or third-party rights. Do not upload content you are not authorised to share.
8. Accuracy of financial information
Extracted fields (amounts, dates, merchants, tax) may be incorrect. You and your approvers are responsible for reviewing data before submission and approval. InvoFlow does not guarantee OCR accuracy and is not a substitute for your organisation's finance controls or statutory record-keeping obligations.
9. Third-party services
The service relies on subprocessors (for example cloud hosting, database, OCR). Subscription billing uses GoCardless (Direct Debit). Team reimbursement payouts use TrueLayer (open banking). You must use those payment features only as intended and in compliance with their terms. See our Security page and Privacy Policy for more detail.
10. Monitoring and enforcement
We may investigate suspected violations, suspend or terminate access, remove content, or report activity to your organisation or authorities where required by law. We are not obliged to monitor all use but may do so to protect users, the platform, and legal compliance.
Violation of this AUP may result in immediate suspension without refund where applicable. Serious or repeated abuse may lead to permanent account termination.
11. Reporting abuse
Report suspected fraud, security issues, or AUP violations to security@invoflow.uk. Organisation admins should also use internal escalation paths for employee misconduct.
12. Changes to this policy
We may update this AUP as the product or legal requirements change. We will post the revised version on this page and update the "Last updated" date. Material changes may require you to accept the updated policy in-app before continuing to use the service.
13. Contact
Acceptable use and abuse: security@invoflow.uk
Privacy: privacy@invoflow.uk
Website: invoflow.uk
