Privacy notice

The controller of personal data about Fisqoo accounts, billing, support and the public website is MAMO LABS LTD, a private limited company registered in Scotland (company number SC903926). Registered office: Office 695, 18 Young St, Unit Lge, Edinburgh, Scotland, EH2 4JB, United Kingdom. Fisqoo is its product. The company was incorporated on 25 September 2026. Privacy questions: support@fisqoo.com.

We have not appointed a data protection officer. The law does not require one for this processing. Where the UK data protection fee is due, we pay it to the Information Commissioner’s Office. The registration number will be added to this notice when it is issued. Until then this notice does not show an ICO number, because none has been issued.

Our representative in the European Union, under Article 27 of the EU GDPR, is Luigi Mondelli, a natural person, Via Sandro Pertini 27, 20041 Bussero (MI), Italy, rappresentante@fisqoo.com. He is the contact for people in the Union and for EU supervisory authorities, in addition to us. He does not run Fisqoo and he is not the controller. The written mandate is signed. A copy can be asked for at support@fisqoo.com.

UK GDPR and the Data Protection Act 2018 apply because we are established in the United Kingdom. Where we offer Fisqoo to people in Italy or Spain, the EU GDPR also applies to that offering. This notice is written for both. If the English text and a translation diverge, the English text prevails, except where a mandatory rule says otherwise.

• Controller: MAMO LABS LTD, support@fisqoo.com.
• EU representative: Luigi Mondelli, rappresentante@fisqoo.com. Mandate signed.
• No data protection officer.
• ICO registration number: added here only when the Office issues it.

We are the controller for personal data about you as our customer. That covers the account, the subscription, payment status for our own invoices to you, support messages, security logs, and the public website including the cookie choice. We decide the purposes and means of that processing. The lawful bases are in section 4.

We are the processor, under Article 28 UK GDPR and Article 28 EU GDPR, for personal data you put into Fisqoo about your own clients, suppliers and staff. That includes names, emails, addresses, tax identifiers, invoice lines, expenses and files. You decide why that data is there. You must have your own lawful basis before you upload it. We do not use your clients’ data to advertise our own products. The processing clauses in the terms are the Article 28 contract. The settings you use in the product, and these terms, are your documented instructions.

• We follow those instructions, and we tell you if an instruction would break the law.
• People who handle your content are under a duty of confidence.
• We use the sub-processors named in section 6. You authorise them in general. A material change is made by updating this notice.
• We help you answer a request from your own client, taking into account the nature of the processing. We do not decide that request for you.
• We help with a legally required impact assessment where information we hold is relevant.
• We tell you without undue delay after we become aware of a personal-data breach that affects your content.
• At the end of the service we delete or return your content, subject to section 8. Backups follow the backup cycle and are not a way back into a deleted account.
• We make available the information reasonably needed to show compliance with Article 28. An audit is a written request to support@fisqoo.com, not a right to walk into a data centre.

If you are not sure which role applies, ask us which data you mean. Account and billing data about you is controller processing. Client and invoice content you typed in is processor processing.

We process the categories below. The source is you, unless the line says otherwise. A field is mandatory when the product refuses to create the account, take payment, or run the feature without it. Optional fields can be left empty. We do not buy personal data about you from brokers.

• Identity and contact, from you: name, email, password hash, business name, address, company number, VAT or tax identifiers you type. Email and a password are mandatory to open an account. Tax identifiers are mandatory only for a feature that needs them, such as an invoice or a lookup.
• Billing, from you and from Stripe: plan, currency, payment status, and the invoices we issue to you. We do not store the full card number. Stripe does.
• Content you enter: clients, projects, time, invoices, expenses, files, notes and messages. You are the source. It is mandatory only for the feature you choose to use.
• Optional connections, only if you or we switch them on: Google Calendar or Drive, WhatsApp, inbound invoice email, and electronic invoicing. The source is you and the provider you connect.
• Technical data, from your browser and our systems: IP address, browser type, session events, and error reports. Payment data and similar high-risk values are redacted in the error tool.
• Public site: pages viewed and, if you allow analytics, the events described in the cookie notice. Source: your browser.
• Support and the contact form: whatever you write. Source: you. A message is optional. If you want an answer, an email we can reply to is needed.

Do not upload special-category data (health, biometrics, religion, and similar) unless you have a lawful reason and you accept that Fisqoo is not designed as a clinical or HR-sensitive archive. We do not ask for it. If it appears on a document you submit for extraction, it is processed only to extract the fields the feature asks for.

We do not knowingly offer accounts to children. You must be at least 18 to create an account. If we learn that an account belongs to a child, we will close it and delete the content, subject to the billing retention in section 8.

Each purpose below has one lawful basis for data we control. Where we are only your processor, your basis is the one you have chosen. We do not add a second, hidden purpose. You can object to legitimate-interest processing as described in section 10. Consent, where we use it, can be withdrawn without affecting processing that already happened lawfully.

• To create and run the account and the features you subscribe to, including hosting your content and sending service messages about the account, invoices and security. Lawful basis: contract.
• To take payment and keep our own tax and company records, and to answer a lawful request from a tax authority or a court. Lawful basis: legal obligation.
• To keep the service secure, limit abuse, and keep security logs. Lawful basis: legitimate interests. The interest is protecting the service and other customers. It does not override your clients’ rights, because we do not mine their invoices for advertising.
• To measure the public site, only if you allow analytics. Lawful basis: consent, stored in fisqoo_consent.
• To send marketing about other products. Lawful basis: consent, or the PECR soft opt-in where that law allows it. Every marketing message has an unsubscribe. Service messages are not marketing.
• Lookups you start, such as a UK VAT check or a company-number check, are part of the feature you asked for. Lawful basis: contract. We send the number you typed. We do not keep a private copy of the official register.

Some features send text to an AI provider so the feature can draft an answer. Invoice and expense reading can also send an image or a PDF. Production text features use Groq, Inc. in the United States. Anthropic, PBC or xAI Corp. receive the same kind of content only if that provider is switched on for the tier you are using. Help chat can include what you type. Invoice extraction can include whatever is printed on the document, including bank details if they are on the page. Aggregated insights send totals, not invoice line rows. We do not send a document to an AI provider that is not named here.

The output is a draft for you to check. It is not a decision about you, and it does not by itself produce a legal or similarly significant effect. You decide whether to keep, edit or send it. A rejected e-invoice or a tax figure you did not check stays your responsibility, as the terms say.

Those US AI providers are not relied on as certified under the UK Extension to the EU-US Data Privacy Framework. The transfer uses the provider’s data-processing terms, which include the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can avoid the transfer by not using the AI feature. The rest of the account still works.

Recipients are listed with their role and country. A name is used only for a feature that is on, or that you connect. Sub-processors act on our instructions. Authorities receive data only for the lookup or the legal duty named in the line.

• Vercel Inc., United States, as processor for application hosting. The application runs in London, United Kingdom.
• Neon, Inc., through Vercel Postgres, as processor for the account database. The database is in London, United Kingdom. Neon is a United States company. The data at rest stays in London.
• Cloudflare, Inc., as processor for file storage in the EEA (R2) and for Turnstile bot checks.
• Stripe, Inc., United States, as processor for subscription payments, and as an independent controller for the parts of checkout Stripe decides itself.
• Resend, United States, as processor for transactional email, and for inbound invoice email if that feature is enabled.
• Functional Software, Inc. (Sentry), EU region, as processor for error monitoring.
• Groq, Inc., United States, as processor for AI text features in production. Anthropic, PBC or xAI Corp., United States, only if that provider is switched on for a tier.
• Google, only after you connect Calendar or Drive. Google is then a separate controller or processor under Google’s terms for the data you send there.
• Meta, only after you connect a WhatsApp number. Meta is then a separate controller or processor under Meta’s terms.
• Invoicetronic, Italy, as processor for electronic invoicing, only when SDI sending or receiving is enabled for your account.
• HM Revenue & Customs, United Kingdom, only when a UK VAT number is checked. We send that number to the Check a UK VAT number service and receive the registered name and address.
• Companies House, United Kingdom, only when you run a company-number lookup.
• Plausible Insights, EEA, as processor for public-site analytics, only if that tool is switched on and you have allowed analytics. It sets no cookie.

We may also disclose data if the law requires it, or to advisers who are bound to keep it confidential, or to a buyer of the business if the same safeguards continue and we tell you when the law requires notice. We do not sell personal data. We do not share it with data brokers.

The United Kingdom treats the EEA as adequate, and the EEA treats the United Kingdom as adequate for the transfers this product makes. Storage and processing in London or in the EEA, including Cloudflare R2, Sentry in the EU, Invoicetronic in Italy and Plausible in the EEA, does not need a separate transfer tool for that hop.

A transfer to the United States uses the UK Extension to the EU-US Data Privacy Framework only where that recipient is certified and we rely on the certification. We do not rely on that framework for the AI providers in section 5, nor as the safeguard we describe for Groq. For those providers the safeguard is the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in the provider’s terms. The same IDTA or UK Addendum applies to other US processors in section 6 where we do not rely on a certification. You can ask support@fisqoo.com which safeguard applies to a named provider.

We keep account content while the account is open. If you ask us to delete the account, deletion is scheduled after the grace period that applies to that account. The usual period is 14 days. A different period can be set for a business. You can cancel the request in that window. We then delete the account content. Export the content before that date if you need a copy. Fisqoo does not provide conservazione sostitutiva and is not your statutory invoice archive.

• Account and content you entered: for the life of the account, then deletion after the grace period above.
• Our invoices to you, payment records and company records: up to 6 years, because UK tax rules require us to keep them. This is our sale to you, not a copy of your clients’ invoices kept as your archive.
• Security events (login, password changes, exports, admin credential changes): kept in the London database with no automatic expiry. They stay for the life of that record. When the account is deleted, the event remains and the link to the account is removed. They are not used for marketing.
• AI usage counters: deleted after 180 days. AI usage alerts: deleted after 2 years. Weekly AI recaps: deleted after 400 days. Rate-limit counters: deleted when their time window ends.
• Cookie choice: about 180 days, then the banner can ask again.
• Backups: overwritten on the backup cycle. A backup is not a way to restore a deleted account after the grace period.
• AI prompts: kept by us only as part of the feature log or the document you saved. The provider’s retention is in that provider’s terms, under the contract in section 5.

If your local law requires you to keep invoices for a set number of years, that duty is yours. Download or export them. We do not extend retention of your content to meet your filing duty.

Access to production systems is limited to people who need it. Session cookies are signed and stay on the host that set them. Banking details stored for your profile are encrypted. Traffic to the site uses HTTPS. Error reports redact payment data and similar high-risk values. Sub-processors are bound by contract to protect the data they receive.

No method of transmission or storage is perfectly secure. You must keep your password and any second factor safe, and you must tell us promptly at support@fisqoo.com if you suspect misuse. We will tell you and, where the law requires it, the relevant authority about a personal-data breach that creates a risk to you.

For personal data we control, you can exercise the rights below by emailing support@fisqoo.com. Say which right you want to use and which data you mean. We may ask for information to confirm it is you. We reply within one month of a complete request. If the request is complex or numerous, we will tell you within that month why we need up to two further months. There is no fee unless the request is manifestly unfounded or excessive, in which case the law allows a reasonable fee or a refusal, and we will explain that.

• Access: a copy of the personal data we control about you, and the information this notice already sets out.
• Correction: fixing data that is inaccurate. You can also edit most account fields yourself.
• Erasure: deletion, where the law requires it. Billing records we must keep for tax are an exception, limited to those records.
• Restriction: pausing use while accuracy or an objection is checked, where the law requires the pause.
• Portability: a copy, in a structured machine-readable form, of data you provided and that we process by contract or consent. The product also has an export.
• Objection: to processing based on legitimate interests. We stop unless we show compelling grounds that override your interests, or we need the data for a legal claim.
• Withdraw consent: where we rely on consent, including analytics. Withdrawal does not undo processing that was already lawful. Use the cookie control or email us.
• No automated decision with legal effect: we do not make a decision based solely on automated processing that produces a legal effect, or a similarly significant effect, about you. AI output is a draft you review.

If we process data only as your processor, send the request to us and we will help you answer your own client. We do not decide that request. These rights are yours. They are not for sale, and we do not sell the underlying data. A person under 18 should not open an account. If you act for a company, you may write on its behalf if you have authority.

You can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom, ico.org.uk, or by phone on 0303 123 1113. That is the UK supervisory authority for this controller.

If you are in Italy you may also complain to the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it. If you are in Spain you may also complain to the Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also contact Luigi Mondelli at rappresentante@fisqoo.com. Please write to support@fisqoo.com first so we can fix the issue. Writing to us first does not remove the right to complain.

We will update this notice when the processors, the transfers or the purposes change in a way that matters, and we will change the date at the top. If a change affects a purpose you were told about in a way the law says needs a fresh consent or a fresh notice, we will not rely on the old notice for that new purpose.

The cookie notice describes storage on the device and the shared choice on fisqoo.com and app.fisqoo.com. The terms describe the contract, the processor clauses, and the liability cap. This notice does not change those terms.

We do not sell personal data. We do not use advertising cookies. A minor change of wording that does not change a purpose or a recipient does not by itself restart a retention period or a consent.