Policies

1. Who we are

VigilPay is an independent data controller under the UK GDPR for all personal data it processes, including account information for our users and details about the clients that our users record for invoicing. A VigilPay user is also a controller in their own right for the business records they keep. Section 4A explains what this means if you are the client of one of our users.

KTE Ventures Limited is registered in England and Wales under company number 17412131. Our registered office is 184 Shepherds Bush Road, London, England, W6 7NL. We trade as VigilPay, and Kate Lewis is our sole director.

We are registered with the UK Information Commissioner's Office under registration number ZC238453. You can verify this on the ICO's public register at ico.org.uk.

For any question about your personal data, email hello@vigilpay.co.uk.

2. What personal data we collect

• Account information: your name, email address and password hash.
• Business information: your business name, currency preference, optional VAT number and optional payment URL.
• Invoice data: client names, email addresses and addresses, invoice line items, amounts and dates, including anything you upload as a PDF or image.
• Payment information: Stripe handles your card details. We never see full card numbers. Through Stripe's API, we may receive the last 4 digits and expiry date.
• Technical information: your IP address, browser type, device type and session timestamps.
• Communications: email delivery status, opens and clicks provided by Resend.
• Analytics: aggregated page views through Plausible. Plausible is cookieless and does not collect personal data.

3. Legal basis for processing

We process personal data under Article 6 of the UK GDPR on these bases:

• Contract performance: to provide the invoice-chasing service.
• Legitimate interests: to prevent fraud, including referral checks, and improve the service.
• Legal obligation: to keep tax records and meet statutory retention duties.
• Consent: to send marketing emails when you opt in. You can opt out at any time.

4. How we use AI

When you choose automatic invoice reading, uploaded PDFs and images are sent to Anthropic's Claude API. Claude extracts details such as the client, amount and due date.

• Anthropic contractually does not use API traffic to train its models.
• You always review and confirm the extracted information before it is saved.
• You can enter invoices manually if you do not want to use AI parsing.

4.1 Files you upload

We ask Claude for a fixed, narrow set of details only: client name, client email, client company, invoice number, amount, currency, issue date and due date. We instruct it not to extract payment details, and we also filter anything outside that list on our own servers before it reaches you. We do not store bank account numbers, sort codes, IBANs, SWIFT or BIC codes, or card details from your uploads.

We keep the original file exactly as you uploaded it while the invoice is active, because we attach it to your reminder emails so your client can see the invoice and pay it. We delete the file 10 days after you mark the invoice as paid, written off or settled outside VigilPay. If an invoice is left untouched for 90 days, with no reminders sent, no status changes and no views, we delete the file then instead. Drafts that are never sent are cleaned up 30 days after upload. You can delete an uploaded file yourself at any time from the invoice.

4A. If you are the client of a VigilPay user

If you have received an invoice or a reminder email from a VigilPay user and you are not our customer, this section explains your rights.

Both the VigilPay user who chased you and VigilPay ourselves act as independent data controllers of your personal data. The user chose to record your details in order to invoice you. VigilPay processes those details on our own account so we can send the reminders our user schedules, keep the service secure and reliable, and meet our own legal obligations. Our legal basis is our legitimate interest, and the user's legitimate interest, in the lawful recovery of a debt owed to their business.

Under the UK GDPR, you have the right to access, correct, restrict, object to or erase your personal data. You can raise any of these directly with the VigilPay user who chased you, whose details are in the reminder email, or with us at hello@vigilpay.co.uk. We will act on your request within 30 days regardless of whether the user responds. If your request is complex we may extend this to a further 2 months and we will let you know within the first month. We will normally inform the user of your request so they can update their own records, but this will never delay us acting on it beyond the 30 day commitment.

You can also complain to the Information Commissioner's Office at ico.org.uk.

5. Subprocessors

Some providers use strictly necessary technologies described in our Cookie policy.

6. International data transfers

Anthropic, Resend and some Stripe processing take place in the USA. Transfers are protected by Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. EU-hosted services do not involve international transfers.

7. Data retention

• Active accounts: retained while your account is active.
• Deleted accounts: soft-deleted immediately and hard-deleted 30 days later. During those 30 days, ask hello@vigilpay.co.uk to restore your account.
• Financial records: invoices sent and subscription payments are retained for 6 years after account deletion to meet HMRC record-keeping requirements.
• Marketing consent: retained while consent remains valid, plus 2 years as evidence of consent.
• Backups: standard rolling backups may retain data for up to 35 days after deletion.

8. Your rights under UK GDPR

• Access your data through a subject access request.
• Correct inaccurate or incomplete data.
• Ask us to erase data, sometimes called the right to be forgotten.
• Restrict how we process your data.
• Receive portable data in a commonly used format.
• Object to processing based on legitimate interests.
• Withdraw marketing consent at any time.
• Complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Email hello@vigilpay.co.uk to exercise any of these rights.

9. Security

We use encryption at rest and in transit, password hashing, available 2-factor authentication, least-privilege internal access and an incident response process. As a startup, we are not currently ISO 27001 or SOC 2 certified. We will not suggest otherwise.

10. Cookies and similar technologies

See the Cookie policy below for the strictly necessary technologies used by VigilPay.

11. Changes to this policy

We will tell you about material changes by email. For minor changes, we will update the date at the top of this page.

12. Contact

Email hello@vigilpay.co.uk with any privacy question. You also have the right to complain to the Information Commissioner's Office.

Use of the Service is also governed by the Terms of service.

1. About these terms

These terms are between you and KTE Ventures Limited, company number 17412131, trading as VigilPay. Our registered office is 184 Shepherds Bush Road, London, England, W6 7NL.

2. Definitions

• Service: the VigilPay website, software and invoice-chasing tools.
• User: the individual or business using the Service.
• Client: the person or business the User is chasing for payment.
• Subscription: paid monthly access to the Service.
• Trial: the initial 30-day free period before the first Subscription charge.

3. Eligibility

You must be at least 18, act for a UK business or as a UK sole trader or freelancer, and have the legal right to chase every debt you record.

4. Account registration

You must provide accurate information, keep it current, not share your login credentials and take responsibility for activity under your account.

5. The Service

• Automated invoice reminders and escalation emails.
• Statutory interest calculations under the Late Payment of Commercial Debts (Interest) Act 1998.
• AI-assisted invoice parsing, with human review.
• A referral programme, subject to separate terms.
• An analytics dashboard.

6. Trial and subscription

The Trial lasts 30 days and requires a valid payment card. After it ends, your Subscription is charged monthly unless cancelled. Cancellation through account settings takes effect at the end of the current billing period.

Pricing and plans:

• Essential: £10 a month, for up to 30 invoices in each billing period.
• Pro: £25 a month, with no invoice limit.
• Both plans include every feature. Unless you choose Pro, your Subscription starts on Essential when the Trial ends.
• An invoice counts once when it is created in the Service, however many reminders it triggers. Sample data does not count. The count resets on your billing period start date each month.
• After 30 invoices on Essential, you must upgrade to Pro or wait until the next billing period before adding another invoice. Existing invoices and reminders keep working.
• You can upgrade or downgrade at any time from Settings > Billing. Stripe prorates changes across your current billing period.

7. Fees and refunds

• We do not offer refunds for partial months or unused parts of a Subscription.
• The statutory 14-day cooling-off period applies to your first paid Subscription only under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. Request a refund from hello@vigilpay.co.uk within 14 days of the first charge.
• No cooling-off period applies to later renewals.
• VAT is included where applicable.

8. User responsibilities

• Make sure you have the legal right to invoice every amount you record.
• Only chase debts owed to your own business.
• Do not use the Service to harass, threaten or send unlawful communications.
• Make sure client email addresses are accurate and legitimately obtained.
• Comply with the UK GDPR and Consumer Rights Act where they apply to your clients.

9. Acceptable use

• Do not bulk-upload fake invoices.
• Do not use AI parsing on documents you do not own or have permission to process.
• Do not reverse-engineer, scrape or use automated access against the Service.
• Do not introduce malware or interfere with the Service.

We may suspend an account for breach, giving notice where reasonably possible.

10. AI content

AI-generated invoice data can be wrong and requires your review. You are responsible for confirming parsed values before sending reminders. We are not liable for reminder emails based on incorrect information that you confirmed.

11. Intellectual property

We own the Service, its code, brand and design. You own the data you upload and grant us a licence to process it only as needed to provide the Service.

12. Liability limitations

Nothing excludes liability for death or personal injury caused by negligence, fraud, or anything else that cannot lawfully be limited. Otherwise, our total liability is capped at the Subscription fees you paid in the 12 months before the event giving rise to the claim.

We are not liable for indirect or consequential losses, lost profits or lost data. Keep your own backups of critical invoices.

13. Referral programme

Separate referral programme terms apply and are available on the Refer page or from hello@vigilpay.co.uk.

14. Termination

You can cancel at any time through account settings. We may terminate for breach, with notice where reasonably possible. A 30-day data retention grace period then applies as explained in our Privacy policy.

15. Changes to the terms

We will notify you by email at least 30 days before a material change takes effect.

16. Governing law and jurisdiction

These terms are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

17. Contact

Email hello@vigilpay.co.uk for legal, support or service questions.

VigilPay only uses cookies and similar technologies that are strictly necessary. We do not need a cookie consent banner because they fall under the PECR Regulation 6(4) exemption.

• Plausible Analytics: cookieless and does not set any cookies.
• Cloudflare Turnstile: may set a cf_challenge cookie during bot verification on signup. It is strictly necessary for security, expires after verification and cannot be disabled.
• Sentry: may set a short-lived session identifier for error correlation. It is strictly necessary for the app to function correctly.
• Supabase Auth: sets an authentication session cookie so you stay logged in. It is strictly necessary.
• Stripe: sets cookies during checkout for fraud prevention. They are strictly necessary and are only set while you are on the checkout page.

We do not use tracking cookies, marketing cookies or third-party advertising cookies.

Questions can be sent to hello@vigilpay.co.uk. Read the wider Privacy policy for how we handle personal data.