Privacy policy
Last updated 23 October 2026
PaidUp helps businesses chase unpaid invoices and keep track of the bills they owe. This policy explains what personal data we keep, why, where it is stored and who else processes it.
1. Who we are
PaidUp is run from Mullingar, Co. Westmeath, Ireland. You can reach us at [email protected] about anything in this policy, including requests to see or delete your data.
We play two roles under data protection law (the GDPR and, for UK customers, the UK GDPR):
- Controller for the data about you as our customer: your account, your login, your subscription and how you use PaidUp.
- Processor for the data you put into PaidUp about your own clients and suppliers, such as their names, email addresses and invoices. You decide what goes in and why; we process it only to provide the service to you, under the data processing terms in section 9 of our terms.
2. What we collect
About you and your team
- Business name, email address, the country your business is based in and your reply-to address.
- Your password, stored only as a one-way hash (bcrypt). We can never see it. Team members you invite have their own name, email address and hashed password.
- Your plan and subscription status. Card details are handled by Lemon Squeezy and never reach us.
- If you connect Stripe: the signing secret for your webhook, stored encrypted, and the payment events Stripe sends us (amount, currency, the invoice reference and when it happened).
- If you send from your own domain: the domain, the address you send from and the DNS records needed to verify it.
About your clients and suppliers (you provide this)
- Invoices you send and bills you receive: names, email addresses, amounts, dates and invoice numbers.
- Invoice and bill PDFs you upload.
- The reminder messages sent for each invoice, and when they were sent.
Technical data
- Server logs kept by our hosting provider (such as IP addresses and the pages requested), used to keep the service running and secure.
- One cookie: a login session cookie that keeps you signed in. It is strictly necessary, so we don't ask for consent. We don't use advertising or tracking cookies.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing PaidUp: your account, reminders, bills, insights and payment detection | Performance of our contract with you |
| Emails about your account: invites, payment notices, bill reminders, failed backups | Performance of our contract with you |
| Billing your subscription and keeping accounting records | Contract and legal obligation |
| Security, preventing abuse, fixing faults and keeping backups | Our legitimate interest in running a safe, reliable service |
We don't sell personal data, we don't use it for advertising, and we don't use your data or your clients' data to train AI models.
4. Reading invoice PDFs with AI
When you upload a PDF, PaidUp first reads its text on our own servers. Only when the layout is unusual is the PDF sent to Anthropic's Claude API to read the client, number, amount and dates. Anthropic processes it for us as a sub-processor and, under its commercial terms, doesn't use API data to train its models. You always check the result before anything is saved.
5. Who processes data for us
We use these providers (sub-processors) to run PaidUp:
| Provider | What for | Where |
|---|---|---|
| Railway | Hosting the app and the database | EU (Amsterdam, Netherlands) |
| Cloudflare | Domain, secure connections, email forwarding and encrypted daily backups | Backups stored in the EU; network worldwide |
| Resend | Sending reminders and account emails | EU sending region (Ireland) |
| Anthropic | Reading invoice PDFs with unusual layouts | United States |
| Lemon Squeezy | Subscription payments, as merchant of record | United States |
| Stripe (only if you connect it) | Telling PaidUp when your clients pay through your own Stripe account | Your Stripe account |
When personal data goes outside the European Economic Area or the UK, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses. We will tell customers before adding or replacing a sub-processor.
6. How long we keep it
- Your account data, invoices and bills: for as long as your account is open, or until you delete them.
- You can delete your account at any time in Settings → Delete account; its data is deleted straight away. Encrypted backups are kept for 30 days and then deleted, so a copy may last up to 30 days longer in a backup.
- Billing records: as long as Irish tax law requires, usually six years.
- Server logs: for a short period set by our hosting provider.
7. How we protect it
- All connections use HTTPS. The database is only reachable from our app, over a private network.
- Passwords are hashed; stored secrets such as Stripe signing secrets are encrypted (AES-256-GCM).
- Daily backups are encrypted before they leave our servers and are stored in the EU.
- Team members can only see the account they belong to, and only the owner can change its settings.
If a personal data breach affects you or your clients, we will tell you without undue delay, and the regulator where the law requires it.
8. Your rights
You can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw any consent you have given. You can delete your account yourself in Settings; for anything else, email [email protected] and we will answer within one month.
If your clients or suppliers ask about their data in PaidUp, we will pass the request to you, because you decide how their data is used, and help you answer it.
You can also complain to the Data Protection Commission in Ireland (dataprotection.ie) or, in the UK, the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to sort things out first.
9. Children
PaidUp is a business tool for people aged 18 or over. We don't knowingly collect data about children.
10. Changes
If we change this policy in a way that matters, we will email account owners before it takes effect. The date at the top shows when it last changed.