Privacy notice

• Account data: your email address, password hash, business name, VAT number, email domains, settings.
• Invoice data: documents emailed or forwarded to your ingestion address, the fields we parse from them, contacts, invoices receivable and payable, payments and chase history.
• Usage data: activity log, sign-in and verification events, IP address and timestamps for abuse prevention.
• Billing data: plan, subscription status and payment records. Card details are held by Stripe, never by us.

The optional browser companion runs in your browser on Gmail and Outlook on the web. It reads only the sender's email address of the message you have open, and uses it to look that contact up in your own Execore account. It never reads, stores or transmits the rest of your mailbox, never accesses your mail through Google or Microsoft APIs, and never sends email. Uninstall it at any time from your browser's extensions page.

• Contract — to run the service you signed up for: ingesting documents, preparing chases, tracking payables and billing you.
• Legitimate interests — security, abuse prevention, fraud checks and improving the product.
• Legal obligation — keeping billing and tax records.
• Consent — product tips and marketing emails only. You can withdraw this at any time in Settings without affecting anything else.

• Account and invoice data: for as long as your account is open.
• Unverified sign-ups: deleted after 7 days.
• On deletion: everything is permanently removed immediately — invoices, contacts, documents, chase history and the ingestion address.
• Retained after deletion: billing and tax records only, for six years, as HMRC requires. Nothing else is kept.
• Data exports: the download link and the generated zip expire after 7 days.

• Postmark (and our managed email provider) — sending account emails such as verification, password reset and export links.
• Stripe — subscription payments and receipts.
• Supabase — database, authentication and document storage, hosted in the EU/UK region.
• Google (Gemini) — document parsing: reading the invoice fields out of the files you send in.
• Cloudflare — hosting, inbound email routing and abuse protection.
• Mailchimp and HubSpot — only if you opted into marketing, and only your email address and plan.

• We never connect to, read or send from your mailbox. Chases open as a draft in your own webmail.
• We never move money. Payment files are exported for you to upload to your own bank.
• We never sell your data or share it for advertising.

Under UK GDPR you can ask for access, portability, rectification, erasure, restriction, or object to processing. Most of this is self-service:

• Access and portability — Settings → Account and data → Export my data. You get a zip with JSON, a CSV per table and your original documents.
• Rectification — edit business details, contacts and invoices directly in the app, or email us.
• Erasure — Settings → Account and data → Delete my account. This is a hard delete and cannot be undone.
• Anything else — email info@execore.co.uk and we will respond within one month.

If you are unhappy with how we handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

We use only what the service needs: a session cookie so you stay signed in, and local storage for your session token. No advertising or third-party tracking cookies.