Privacy Policy

Last Updated: 6 October 2026

Introduction

This Privacy Policy explains how we (“Xero Invoice SaaS”, “we”, “us”, “our”) collect, use, store, and protect your personal data when you use our invoice processing service.

By using our service, you agree to the collection and use of information in accordance with this policy.

1. Data Controller

Drakon Systems Ltd
Email: support@drakonsystems.com
Data Protection Officer: support@drakonsystems.com

2. Data We Collect

2.1 Account Information

• Email address (for login and communication)
• Password (hashed using bcrypt)
• Full name (optional)
• Registration date and last login

2.2 Xero Integration Data

• Xero OAuth access tokens (encrypted at rest)
• Xero OAuth refresh tokens (encrypted at rest)
• Xero tenant/organization ID
• Company name, address, phone number, and VAT number (from your Xero organization)

2.3 Invoice Data

• Uploaded invoice PDFs
• Parsed invoice information (supplier names, invoice numbers, amounts, line items)
• Bank account numbers (if present on invoices)
• Processing metadata (status, timestamps, error messages)

3. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

1. Contract Performance (Article 6(1)(b) GDPR): Account creation, invoice processing, Xero integration, subscription management
2. Consent (Article 6(1)(a) GDPR): Email communications, Xero OAuth access
3. Legitimate Interests (Article 6(1)(f) GDPR): Fraud prevention, security, service improvement

4. How We Use Your Data

• Authenticate your account
• Connect to your Xero organization
• Parse uploaded invoices using AI (Claude by Anthropic)
• Match suppliers to Xero contacts (supplier and contact names are sent to Voyage AI)
• Create invoices in Xero and attach PDF receipts

5. Data Sharing & Third Parties

We share your data with the following third parties only:

5.1 Xero (Required for Service)

What: Invoice data, supplier information, OAuth tokens
Why: To post invoices to your Xero organization
Privacy Policy: https://www.xero.com/uk/about/privacy/

5.2 Anthropic (Claude AI)

What: Invoice PDFs and text for parsing
Why: To extract invoice details using AI
Data Retention: Anthropic does not train its models on data submitted through its commercial API. Invoice data sent for parsing is deleted by Anthropic within 30 days. Content flagged for a policy violation may be retained for longer under the Anthropic data retention policy.

5.3 Voyage AI (supplier matching)

What: Supplier and contact names
Why: To match invoices to Xero contacts
Data retention: Our Voyage AI account is opted out of model training. Voyage AI does not use this data to train models, and data sent for embeddings is deleted after processing.

5.4 Stripe (payments)

What: Email address, name, and payment information, if you subscribe or buy an invoice pack
Why: To process payments

5.5 Resend (email)

What: Your email address and name, and the content of the emails we send. Those emails can include supplier names, invoice numbers, and amounts. Remittance emails also include the supplier's email address.
Why: To send account, security, and invoice emails

5.6 Fly.io (hosting and storage)

What: The application database and uploaded invoice PDFs
Why: To host the service and store your data. Invoice PDFs are kept on an encrypted Fly.io volume.

5.7 QuickBooks (Intuit) — only if you connect QuickBooks

What: Invoice data and supplier information
Why: To post invoices to your QuickBooks organization

5.8 Google — only if you sign in with Google

What: Your Google sign-in token, which includes your email address and name
Why: To verify Google sign-in

5.9 Apple — only if you sign in with Apple

What: Apple handles sign-in on your device. If you choose to share them, Apple receives your email address and name.
Why: To let you sign in with Apple. We check the token Apple gives us on our servers.

5.10 Sentry (error monitoring)

What: Error reports. When invoice processing fails, the report includes a user id, an invoice id, and the text of the error. The website can also send error reports to Sentry.
Why: To find and fix failures

5.11 GitHub (encrypted backups)

What: An encrypted copy of the application database, which holds account, invoice, and Xero data. GitHub stores the encrypted file. We keep the encryption key.
Why: Off-site backup. Copies older than the retention window are removed (14 days unless that window is configured otherwise).

5.12 No other recipients

We share your data only with the sub-processors listed above, and only to provide the service. We never sell your data.

6. Data Storage & Security

6.1 Storage Location

• Database: Encrypted PostgreSQL on Fly.io
• PDFs: Encrypted volume storage
• Temp Files: Deleted immediately after processing

6.2 Encryption

• In Transit: All data transmitted over HTTPS (TLS 1.3)
• At Rest: Passwords hashed with bcrypt, Xero tokens encrypted with Fernet (AES-128)

7. Data Retention

• Active Accounts: Invoices retained until you delete them (default 7 years for UK tax compliance)
• Deleted Accounts: Immediate and permanent deletion of all data
• Failed Uploads: 30 days retention for troubleshooting

8. Your Rights (GDPR)

• Right to Access (Article 15): View all your data in the dashboard
• Right to Export (Article 20): Export all data as JSON from Settings
• Right to Erasure (Article 17): Delete your account anytime from Settings
• Right to Rectification (Article 16): Update your profile and supplier mappings
• Right to Lodge a Complaint: UK ICO (ico.org.uk)

9. Data Breach Notification

If we detect a data breach, we will:

1. Notify ICO (UK regulator) within 72 hours
2. Email affected users within 72 hours
3. Take immediate action to contain the breach

10. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children.

11. Cookies & Tracking

• JWT tokens: For authentication (stored in browser localStorage)
• No tracking cookies: We do not track you
• No third-party analytics: Google Analytics, Facebook Pixel, or third-party trackers are NOT used
• First-party usage analytics: We record basic, first-party product events (e.g. page views, button clicks, and milestones such as connecting an accounting system) using a random first-party identifier stored in your browser. This data stays with us, contains no invoice content or other personal financial data, is never sold or shared, and is used only to understand and improve how the product is used. It is not a cross-site tracker.

See our Cookie Policy for full details.

12. Contact Us

Email: support@drakonsystems.com
DPO: support@drakonsystems.com
Response Time: Within 30 days (GDPR requirement)

13. Summary (TL;DR)

• We collect: Email, invoices, Xero data (needed for service)
• We encrypt: Passwords, tokens, database, PDFs
• We share with: Xero, Anthropic (invoice parsing), Voyage AI (supplier and contact names), Stripe (payments), Resend (email), and Fly.io (hosting and storage). If you use them: QuickBooks, Google sign-in, or Apple sign-in. Also Sentry (error reports) and GitHub (encrypted database backups). We never sell your data.
• You can: Export all data, delete anytime
• We don't: Track you, sell data, use cookies
• GDPR compliant: All your rights protected