Privacy policy

Two kinds of data

We hold subscriber data about the businesses who pay for InWriting - name, email, business details and billing records - as data controller. We also process client data that subscribers enter about their own customers. For that information the subscriber is the controller and we act only as their processor.

What we collect

• Account details: name, email address, business details.
• Billing information processed by our payment provider; we do not store card numbers.
• Content you create: clients, projects, quotes, invoices and notes.
• Approval records: the quote version approved, the name entered by the approver, the timestamp and limited technical metadata kept for security and audit purposes.
• Email delivery records for messages sent on your behalf.

Why we process it

To provide and secure the service, to take payment, to send transactional email such as quotes, invoices and reminders, and to meet our legal and accounting obligations.

Link opening and approvals

When a quote or invoice link is first opened we record that it was opened. Email providers and security scanners sometimes open links automatically, so this is not treated as proof that a named person read the document. Only a completed approval action, with the approver's entered name and confirmation, is recorded as an approval.

Processors we use

• Supabase (via Lovable Cloud) - database, authentication and file storage hosting, EU region.
• Lovable - application hosting and deployment, served through Cloudflare's network.
• Stripe Payments Europe - subscription billing and card processing. Stripe holds card details; we never see or store them.
• Resend - delivery of the quotes, invoices, reminders and notifications sent from InWriting.

Each provider processes data only on our instructions under a data processing agreement, with appropriate safeguards for any transfer outside the UK or EEA. We do not sell personal data and we do not use advertising or tracking cookies.

Retention

Account and document data is kept while your subscription is active and for a limited period after cancellation so it can be restored or exported. Financial records are kept for the period required by UK tax law. After that, data is deleted.

Your rights

You may request access to, correction of, export of or deletion of your personal data, and you may object to certain processing. If your data was entered by a business using InWriting, contact that business first - we will forward requests where appropriate. You may also complain to the Information Commissioner's Office.

Contact

Account holders can make privacy requests from the support page inside their account. Written requests can be sent to Tuohy Labs LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.