Privacy Policy

1. Who we are

D20 Invoice AI ("D20", "we", "us") provides an AI-assisted invoice coding service for finance teams at d20invoice.com (the "Service"). For the personal data of our customers' users (names, work email addresses, log-in and usage data) we are the data controller. For the content of invoices our customers upload or forward (supplier details, amounts, contact names on invoices) we act as a data processor on our customer's instructions — see the Data Processing Agreement.

Questions about this policy: privacy@d20invoice.com.

2. What we collect

• Account data — name, work email address, hashed password, role, workspace name and plan.
• Invoice content — PDFs, images, email bodies and attachments you upload, photograph or forward to your D20 address, plus the fields D20 extracts from them (supplier, invoice number, dates, amounts, line items, VAT numbers).
• Accounting connection data — OAuth tokens (encrypted at rest), chart of accounts, contacts, bills and payment status read from or written to Xero, FreshBooks, Zoho Books or Sage Accounting when you connect them.
• Email connector data — if you connect Gmail, message metadata and invoice attachments from matching messages; we never read unrelated mail.
• Usage and security data — audit-trail entries (who approved or changed what), IP address, browser and device type, approximate location derived from IP for new-device sign-in alerts, and error logs.
• Billing data — plan, usage counts and Stripe customer identifiers. Card details are collected and stored by Stripe, never by D20.

3. Why we use it (lawful bases)

• To provide the Service you or your employer contracted for — performance of a contract.
• To extract and code invoices with AI, detect duplicates and sync to your accounting system — performance of a contract.
• To keep the Service secure (sign-in alerts, brute-force protection, audit trail) — our legitimate interests and legal obligations.
• To send service emails (approvals waiting, sync failures, close packs, password changes) — performance of a contract / legitimate interests. Marketing emails are only sent with consent and can be withdrawn at any time.
• To bill for the Service and keep accounting records — contract and legal obligation.

4. AI processing

Invoice documents are sent to a large-language-model provider (OpenAI, via our infrastructure partner Emergent) to extract fields and suggest ledger codes. Requests are processed under API terms that prohibit the provider from training on your data. We retain the extracted results in your workspace; the provider does not retain your documents beyond transient processing and abuse monitoring windows set out in its API terms.

5. Who we share data with

• Sub-processors listed in the DPA (hosting, database, AI extraction, email delivery, payments, accounting integrations you enable).
• Your accounting provider — only when you connect it and only the bills, contacts and payments needed to sync.
• Suppliers — only if you enable supplier status emails, in which case the supplier receives invoice status notices at the address you hold for them.
• Authorities or advisers where required by law, or to protect our rights.
• We never sell personal data.

6. International transfers

D20 is operated from the United Kingdom. Where a sub-processor is outside the UK/EEA (for example AI extraction in the United States) transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or an adequacy decision.

7. Retention

• Invoice content and audit trail: for the life of your workspace, because the audit trail is designed to be a permanent record. You can delete individual invoices at any time; admins can request deletion of a whole workspace.
• Account data: while your account is active and for up to 12 months after closure, then deleted or anonymised.
• Security logs (sign-ins, IPs): 12 months.
• Billing records: 6 years, as required by UK tax law.
• Backups: rolling 30 days.

8. Your rights

Under UK GDPR you can ask to access, correct, erase or export your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent. If you are a user of a customer workspace, we will usually route the request through your workspace admin as controller. You can also complain to the Information Commissioner's Office (ico.org.uk).

To exercise a right, email privacy@d20invoice.com. We respond within one month.

9. Children

The Service is for businesses and is not directed at anyone under 18.

10. Changes

We will post any changes here and update the date above. For material changes we will email workspace admins at least 14 days before they take effect.