1. Introduction and Who We Are

This Privacy Policy describes how Smoothbalance Ltd ("Smoothbalance", "we", "our", or "us"), a company registered in England and Wales, collects, uses, stores, shares, and protects your personal data when you interact with any of our Services.

We are committed to protecting your privacy in accordance with all applicable data protection laws, including the UK GDPR, the EU GDPR 2016/679, the Data Protection Act 2018, the CCPA as amended by the CPRA, and CalOPPA.

If you do not agree with this policy, you must not use any of our Services.

2. Nature of Our Service — Business-to-Business Software

While some data may incidentally relate to an identifiable individual (for example, a sole trader operating under their own name, or a named contact within a business), the primary purpose of data collection is to facilitate business operations and financial management, not to identify or profile individuals.

Where personal data of individuals is processed as part of business records, we apply the same data protection standards and safeguards as outlined in this policy. Users are also responsible for ensuring their own compliance with applicable data protection laws in relation to any personal data of their clients or contacts stored within our Services.

3. Platforms and Products Covered

Product / Platform	Type	Description
smoothbalance.com	Web	Public marketing and information website
smoothbalancegroup.com	Web App	Cloud-based financial management platform
Smooth Expense	iOSAndroid	Business expense recording and management
Invoice Book	iOSAndroid	Professional invoice creation and management
Quotation Book	iOSAndroid	Quotation and estimate creation
Smoothbalance App	iOSAndroid	All-in-one financial management app

All of the above are collectively referred to as the "Services".

4. Data Controller Information

5. Regulatory Framework and Legal Compliance

5.1 Lawful Bases for Processing (GDPR)

• Contract — processing is necessary to deliver our Services
• Legal obligation — processing is required by law
• Legitimate interests — processing serves our business interests, balanced against your rights
• Consent — where you have given clear consent, e.g. for marketing

5.2 California Residents (CCPA / CPRA)

• Right to know what we collect, use, disclose, and sell
• Right to delete personal information we have collected
• Right to correct inaccurate personal information
• Right to opt-out of sale — we do not sell your data
• Right to limit use of sensitive personal information
• Right to non-discrimination for exercising your rights

5.3 CalOPPA Commitments

• Users can visit our website and apps without disclosing personal information where possible
• This Privacy Policy is linked from our homepage and within all our apps
• We notify users of material changes to this policy
• We honour Do Not Track (DNT) signals where technically feasible

6. Personal Data We Collect

6.1 Data You Provide Directly

• Identity data — full name, business name
• Contact data — email address, phone number, postal address
• Account credentials — username and encrypted password
• Financial and business data — invoices, quotations, expenses, and client records
• Client data — contact details of your clients stored within our apps
• Payment and banking data — see Section 9 for full details
• Communications — support requests, enquiries, and correspondence

6.2 Data Collected Automatically

• Device data — device type, operating system, unique device identifiers
• Usage data — features used, session duration, in-app actions, crash reports
• Network data — IP address, browser type and version, referring URLs
• Location data — approximate location derived from IP address
• Cookies and tracking data — see Section 11 (Cookies)

6.3 Data from Third Parties

• Payment processors — transaction status and confirmation
• Apple App Store and Google Play Store — download and purchase data
• Analytics providers — aggregated and anonymised usage statistics

7. How We Use Your Personal Data

7.1 Provision of Services (Lawful basis: Contract)

• Creating and managing your account
• Delivering the features of our website, web app, and mobile apps
• Processing payments and managing subscriptions
• Providing customer support

7.2 Legal and Compliance (Lawful basis: Legal Obligation)

• Maintaining financial and transaction records as required by law
• Responding to lawful requests from regulatory or law enforcement authorities
• Fulfilling obligations under data protection law

7.3 Legitimate Interests (Lawful basis: Legitimate Interests)

• Detecting, preventing, and investigating fraud and security incidents
• Improving and developing our Services
• Analysing usage patterns to optimise performance and user experience

7.4 Marketing (Lawful basis: Consent)

• Sending promotional emails or in-app notifications where you have opted in
• You may withdraw consent at any time

8. Security and reCAPTCHA

8.1 Invisible reCAPTCHA

Our website and web app use Google's Invisible reCAPTCHA v3 to protect forms against spam and automated abuse. It operates silently in the background, collecting hardware and software information sent to Google for risk analysis.

9. Payment Processing

We do not store your full payment card details on our servers. All payment data is processed securely by our authorised payment partners in accordance with PCI-DSS standards.

While we retain banking details solely for invoice reference generation as described above, Smoothbalance does not process, transmit, or have any visibility or control over the actual transfer of funds between an invoice sender and an invoice recipient. Bank transfers are conducted directly between the parties' respective banks, entirely outside of Smoothbalance's systems.

Accordingly, Smoothbalance accepts no liability for payments that are delayed, misdirected, duplicated, rejected, or otherwise not received, regardless of cause. This includes, without limitation, errors in banking details, fraud, bank processing delays, or failures of any third-party payment gateway.

It is the sole responsibility of the invoice sender and invoice recipient to independently verify the accuracy of banking details before initiating or accepting any transfer, and to confirm that funds have been correctly sent and received. Smoothbalance is not a party to, and assumes no responsibility for, the underlying financial transaction between users.

For bank transfer payments, we retain the following business banking details solely to generate payment references on invoices, enabling invoice recipients to make payment:

• Account number and sort code
• IBAN and BIC/SWIFT code
• Payment gateway identifiers (e.g. PayPal ID or equivalent)

These details are stored as part of the invoicing workflow and included on invoices sent to your clients. They are not used for any purpose other than facilitating invoice-based payments.

9.1 Apple App Store In-App Payments

App subscriptions and in-app purchases for Smooth Expense, Invoice Book, Quotation Book, and the Smoothbalance App on iOS are processed directly by Apple Inc. via the App Store. Smoothbalance Ltd does not handle or store any card or payment credentials for these transactions. Apple's privacy practices →

9.2 Stripe

Online payments and subscriptions for the web app at smoothbalancegroup.com are processed by Stripe, Inc. Stripe is PCI-DSS Level 1 certified. Smoothbalance Ltd does not store card details — all payment data is handled entirely within Stripe's secure environment. Stripe's privacy policy →

9.3 Bank Transfer

We accept direct bank transfers for certain subscription plans. Transaction records are retained for 7 years in accordance with UK financial regulations.

9.4 Please Read: Important Security Notice Regarding Bank Transfers

Invoice and bank transfer fraud is a common and evolving threat. Fraudsters frequently intercept email correspondence, create look-alike domains or spoofed email addresses, or impersonate a legitimate business to trick recipients into sending funds to a fraudulent account, often by claiming that "updated" banking details should be used instead of the ones previously provided. Smoothbalance has no ability to detect, prevent, or reverse this type of fraud once it occurs, as we do not process or have visibility over the transfer of funds between parties. Invoice recipients are strongly encouraged to remain vigilant and take the following precautions before making any payment.

Confirm with a known contact, not the invoice itself. Call or message the invoice sender using a phone number or email address you already have on file, not one listed only on the invoice, to verbally confirm the account number, sort code, or IBAN before transferring funds. This guards against invoice fraud where account details have been altered.

Use Confirmation of Payee (UK) where available. Most UK banks now check that the account name matches the name and account number/sort code entered. Don't override or ignore a "no match" or "close match" warning without contacting the payee directly first.

Send a small test payment first for large or first-time transfers. A nominal amount (e.g. £1) confirms the account is valid and active before committing the full sum.

Check IBAN/BIC formatting. Use an IBAN validator to confirm the check digits are valid and the country/bank codes correspond to the expected institution, a single transposed digit can send funds to the wrong account.

Be wary of last-minute changes. Fraudsters often intercept invoices and request updated bank details shortly before payment is due. Treat any change to previously used banking details as a red flag requiring separate verification.

Keep a record. Retain confirmation screenshots, emails, or call notes verifying the details, in case a dispute arises later.

Report suspected fraud immediately. If you suspect banking details have been tampered with, contact your bank immediately, many banks can recall a payment within a short window and notify the invoice sender through a verified channel.

10. Analytics and Tracking Tools

10.1 Google Analytics

Used on smoothbalance.com and smoothbalancegroup.com to track traffic, session data, device type, and approximate location. Opt out → | Google Privacy Policy →

10.2 Firebase (Google)

Used for analytics, crash reporting, and performance monitoring across all mobile apps (Smooth Expense, Invoice Book, Quotation Book, Smoothbalance App) on iOS and Android. Google Privacy Policy →

10.3 Microsoft Clarity

Microsoft Clarity is used across our website, web app, iOS apps, and Android apps to analyse user behaviour and improve the user experience.

On smoothbalance.com and smoothbalancegroup.com, Clarity records anonymised user interaction data including mouse movements, clicks, scroll behaviour, heatmaps, and session replays. On our iOS and Android apps, Clarity captures anonymised in-app interaction data to help us understand how users navigate and use app features.

Microsoft Clarity does not capture personally identifiable information.

11. Cookies

• Essential cookies — strictly necessary for Services to function; cannot be disabled
• Analytics cookies — Google Analytics and Microsoft Clarity
• Security cookies — Google reCAPTCHA fraud protection
• Preference cookies — to remember your language and display settings

Manage cookies through your browser settings. More information: allaboutcookies.org

12. Data Sharing and Disclosure

We do not sell your personal information. We do not share your data for cross-context behavioural advertising. We may share your data with:

• Payment processors — Apple Inc., Stripe, Inc.
• Analytics providers — Google LLC, Microsoft Corporation
• Cloud hosting and infrastructure providers — bound by data processing agreements
• Professional advisers — lawyers, accountants, auditors bound by confidentiality
• Regulatory and law enforcement authorities — where required by law
• Successors — in the event of a merger, acquisition, or sale of assets

13. International Data Transfers

Where we transfer personal data outside the UK and EEA, we rely on Standard Contractual Clauses (SCCs) approved by the UK ICO or European Commission, adequacy decisions, or Binding Corporate Rules where applicable.

14. Data Retention

• Account data — retained for account duration and up to 7 years after closure
• Financial and transaction records — 7 years per UK HMRC requirements
• Banking details on invoices — retained as part of invoice records for 7 years
• Communication records — up to 3 years
• Analytics data — retained in aggregated or anonymised form
• Marketing consent records — while subscribed, plus 3 years

15. Data Security

• Encryption of data in transit using TLS/HTTPS
• Encryption of sensitive data at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Staff training on data protection obligations

16. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If we become aware of such data, we will delete it immediately.

17. Your Rights

17.1 Rights under UK GDPR and EU GDPR

• Right of access (Art. 15) — obtain a copy of your personal data
• Right to rectification (Art. 16) — request correction of inaccurate data
• Right to erasure (Art. 17) — request deletion where data is no longer necessary
• Right to restriction (Art. 18) — request limits on how we use your data
• Right to data portability (Art. 20) — receive data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Rights re. automated decisions (Art. 22)
• Right to withdraw consent — at any time where processing is consent-based

17.2 Rights under CCPA / CPRA (California Residents)

• Right to know what personal information we collect, use, share, and sell
• Right to delete personal information we have collected
• Right to correct inaccurate personal information
• Right to opt-out of sale — we do not sell your personal information
• Right to limit sensitive personal information use
• Right to non-discrimination for exercising these rights

We respond within 30 days (GDPR) or 45 days (CCPA).

18. Changes to This Privacy Policy

When we make material changes, we will post the updated policy on our website and apps, update the "Last Updated" date, and notify you by email where required by law.

19. Contact Us

We aim to respond within 30 days. If unsatisfied, you may lodge a complaint with the ICO (UK) or your local EU supervisory authority.