1. Who we are
InvoFlow ("InvoFlow", "we", "us", "our") is operated by ENKKI LIMITED (trading as InvoFlow). We provide an online service for capturing receipts and invoices, extracting data, grouping claims, and routing them for finance approval. Our website is invoflow.uk.
Data controller: ENKKI LIMITED (trading as InvoFlow). Company number 17428543. Registered office: 321-323 High Road, Romford, RM6 6AX, United Kingdom. For data protection enquiries contact privacy@invoflow.uk.
If you are using InvoFlow through your employer or another organisation, that organisation is usually the data controller for expense content (receipts, amounts, approval decisions). We process that content on their instructions as a processor (see section 3).
2. Who this policy applies to
- Visitors to our marketing website
- Users who create an account or are invited to an organisation
- Organisation administrators who manage teams and settings
- Finance users who review and approve claims
Use of the platform is also governed by our Terms of Service and Acceptable Use Policy, which you must accept when registering or when we publish material updates.
This policy does not apply to third-party websites or services linked from InvoFlow (for example your bank during open-banking reimbursement or GoCardless Direct Debit setup).
3. Roles: controller and processor
When we are the data controller for account registration, authentication, service operation, subscription billing, reimbursement payment status, product communications, and security logging related to your use of the platform.
When we are the data processor for receipt images, extracted invoice fields, claim content, and approval records created within a customer organisation's workspace. The customer organisation (your employer) determines why that data is processed and is responsible for informing their staff. We process it only to provide the service under our agreement with that customer.
4. Information we collect
4.1 Account and profile
- Name and email address (required at signup)
- Authentication credentials (password stored hashed by our auth provider; we do not store plain-text passwords)
- Organisation name and your role within that organisation
4.2 Receipt and claim content
- Images or files you upload (receipts, invoices, PDFs)
- Fields extracted or entered on review screens, for example vendor name, amounts, tax/VAT, currency, date, category, and internal reference numbers we assign to invoice lines
- Claim names, status, submission and approval history
- Notes attached to approval decisions (approve, reject, request more information)
4.3 Payout bank details (team reimbursements)
If your organisation uses reimbursement payouts, you may enter your own bank account name, sort code, and account number in Payout details on your account page. We encrypt these fields at rest. Finance administrators see only a masked account reference and verification status, not your full account number. These details are erased when you leave the organisation or when we fulfil a valid erasure request; payment audit records may retain a last-four-digits snapshot where law requires (see section 9).
4.4 Technical and usage data
- Session cookies and similar tokens needed to keep you signed in
- Standard server and application logs (IP address, browser type, timestamps, error diagnostics) for security and reliability
4.5 What we do not collect
- Payment card numbers: InvoFlow does not process card payments. Subscription billing uses UK Direct Debit via GoCardless. Team reimbursements use open-banking bank transfer initiation via TrueLayer. Neither flow uses card data.
- Bank login passwords: authentication with your bank stays between you and your bank during TrueLayer payment initiation
4.6 Information you must not submit
Please do not upload unnecessary special category data (for example health information on receipts) unless your organisation has a lawful basis and policy allowing it. Receipts should contain only what is needed for expense or invoice processing.
5. How we use your information
- Provide, maintain, and improve the InvoFlow service
- Authenticate users and enforce organisation-level access controls
- Run OCR extraction on uploaded documents (via our subprocessors)
- Route claims through approval workflows and maintain an audit trail
- Operate subscription billing (GoCardless) and, on team plans, reimbursement payment initiation and status (TrueLayer)
- Respond to support requests and security incidents
- Comply with legal obligations
- Send service-related emails (for example account verification, when enabled)
We do not sell your personal data.
6. Legal bases (UK GDPR)
We rely on different bases depending on context:
| Legal basis | When we use it |
|---|---|
| Contract | Processing needed to provide the service you or your organisation signed up for |
| Legitimate interests | Security, fraud prevention, service improvement, and internal analytics, balanced against your rights |
| Legal obligation | Where law requires retention or disclosure |
| Consent | Where required for optional features (we will ask separately when those launch) |
Organisations using InvoFlow for employee expenses are responsible for identifying and documenting their own legal basis for processing staff expense data.
7. How we share information
We share data only as needed to run the service:
| Subprocessor | Purpose | Typical location |
|---|---|---|
| Supabase | Database, authentication, private file storage | EU / UK (project region dependent) |
| Amazon Web Services (Textract) | OCR extraction from receipt images | Typically EU (e.g. eu-west-1), configured per deployment |
| Vercel (when deployed) | Application hosting | Global edge; primary app region configurable |
| GoCardless (GoCardless Ltd) | Direct Debit subscription billing for InvoFlow plans | United Kingdom |
| TrueLayer (TrueLayer Ireland Limited or TrueLayer Limited) | Open-banking payment initiation for employee reimbursements (team plans) | United Kingdom / European Economic Area |
| Xero | Accounting sync — pushes your claim/expense data to your organisation's own connected Xero account, if your organisation chooses to enable this integration | New Zealand / global (Xero-operated) |
| Sentry | Error monitoring and diagnostics | United States / European Union (region-dependent) |
We may add further subprocessors (for example email delivery) as features launch. We will update this policy when vendors change materially.
We may disclose information if required by law, court order, or to protect rights, safety, and security.
If InvoFlow is involved in a merger or acquisition, data may transfer subject to continued protection consistent with this policy.
8. International transfers
Some subprocessors may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations, Standard Contractual Clauses, or equivalent mechanisms provided by those vendors.
9. Retention
We keep data only as long as needed for the service, your organisation's expense workflows, and applicable UK law. The summary below reflects our current policy (version 2026-08-13). Your organisation, as data controller for expense content, may require longer retention under its own policies or contracts.
| Data type | Retention approach |
|---|---|
| Active accounts | Retained while your organisation uses the service and as needed for the workflows you run |
| Receipts, claims, and approval records | Typically retained for up to six years after the relevant accounting period, in line with common UK tax and record-keeping practice; your organisation may export data at any time (PDF/CSV export is available for Individual plans; team export features may expand over time) |
| Live payout bank details | Kept while you are a member of the organisation and needed for reimbursement; erased when you leave or on a valid erasure request (encrypted fields and account name are removed; an erasure timestamp is recorded) |
| Payment audit records | For team reimbursement payouts, records that a payment was made (amount, date, reference, masked account last four digits) are retained for approximately six years where required by law, even after live bank details are erased |
| After organisation termination | We offer export where practicable, then delete or anonymise workspace data within approximately 90 days, unless a longer period is required by law or an active investigation |
| Security and operational logs | Typically up to 90 days, unless needed for a security investigation or dispute |
| Data lifecycle audit log | Append-only records of erasure and retention actions (for example payee detail erasure) are kept to demonstrate compliance with this policy, typically aligned with the retention period of the underlying records |
To exercise erasure or access rights, see section 12. Employees submitting expenses through an employer should usually contact that organisation first for claim content.
10. Security
We use organisational and technical measures including encryption in transit (HTTPS), row-level access controls in the database, private storage for receipt files, and role-based permissions. Details are in our Security page.
No method of transmission or storage is 100% secure. Report concerns to security@invoflow.uk.
11. Cookies and similar technologies
We use strictly necessary cookies to maintain your login session (via our authentication provider). We do not use advertising or cross-site tracking cookies on the application today.
Optional analytics (Meta Pixel on public pages) load only if you accept cookies — see the Cookie Policy. You can accept or reject optional cookies via our site banner or Cookie Policy page. Essential cookies still apply when you reject optional cookies.
12. Your rights
Under UK data protection law you may have the right to access, rectify, erase, restrict processing, object, data portability, and withdraw consent (where processing is consent-based).
Employees using InvoFlow through an employer: contact your organisation first for expense-related data. They control that content. You may also contact us at privacy@invoflow.uk and we will assist or redirect as appropriate.
You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. We encourage you to contact us first so we can try to resolve your concern.
13. Children
InvoFlow is a business service not directed at children under 18. We do not knowingly collect data from children.
14. Changes to this policy
We may update this policy as the product, subprocessors, or law change. We will post the new version on this page and update the "Last updated" date. Material changes may be notified by email or in-app notice where appropriate.
15. Contact
Privacy: privacy@invoflow.uk
Security: security@invoflow.uk
Website: invoflow.uk
