Privacy notice

1. Who this notice covers

Klamic is a UK-focused invoicing service for freelancers, sole traders and small businesses. For personal data used to run Klamic itself — such as account, subscription, security, support and marketing-preference information — the Klamic operator acts as controller.

When a Klamic user stores information about their own customers, contacts and invoice recipients in the service, the user normally decides why that information is used. For that processing, the user is normally the controller and Klamic acts as processor on the user's documented instructions.

2. Personal data Klamic may handle

• Account information, such as email address, authentication identifiers and account settings.
• Marketing preferences, including whether an account holder has opted in or out and when that preference changed.
• Business profile information, such as trading name, legal name, business address, telephone number, tax or company details and invoice branding.
• Subscription and billing records. Card details are handled by Stripe rather than stored directly by Klamic.
• Customer and invoice information entered by users, including names, addresses, email addresses, invoice line descriptions and payment-status information.
• Technical and security information needed to operate, protect and troubleshoot the service.
• Support correspondence and information a user chooses to provide when asking for help.

3. Why Klamic uses personal data

Klamic uses account and business information to create and operate accounts, provide the invoicing service, administer subscriptions, respond to support requests and protect the service from misuse.

The main lawful bases for Klamic's own controller processing are performance of a contract where information is needed to provide Klamic, compliance with legal obligations where applicable, and legitimate interests in keeping the service secure, reliable and supportable. Where a different lawful basis is required, Klamic will identify and apply it before carrying out that processing.

Klamic does not use invoice-recipient information supplied by users for independent advertising or unrelated marketing purposes.

4. Marketing communications

Klamic account holders may choose whether to receive optional marketing emails such as product news, useful business information and offers. The signup marketing option is optional and is not selected by default. Account holders can change this preference later in Klamic account settings.

Klamic keeps a record of marketing preference changes so that consent and withdrawals can be respected and audited. Every Klamic marketing email will provide an easy unsubscribe method. Marketing preferences do not prevent essential account, security, billing or service messages that are genuinely needed to operate the service.

Email addresses that a Klamic user stores for their own customers or invoice recipients are not added to Klamic's marketing audience.

5. Customer and invoice data

Users are responsible for having an appropriate lawful basis for personal data they place in Klamic and for giving any privacy information required to their own customers or contacts. Klamic processes that information to store invoice records, generate documents and provide user-requested invoicing features.

When you choose to share a generated invoice PDF, your browser or device may hand that file to an app or service you select. The onward sharing or delivery is then handled by that app or service rather than by Klamic.

More detail about Klamic's processor commitments is set out in the Data Processing Terms.

6. Service providers

Klamic uses specialist providers to operate the service. These may include Supabase for database, authentication and storage services; Vercel for application hosting and delivery; and Stripe for subscription billing.

Providers receive only the information reasonably needed for the service they perform and are subject to their own contractual and data-protection obligations.

7. International transfers

Some service providers may process information outside the UK. Where UK data-protection law requires safeguards for an international transfer, Klamic will rely on an applicable lawful transfer mechanism and the contractual safeguards made available for that processing.

8. How long information is kept

Account and service data is generally kept while an account remains active and for as long afterwards as reasonably required for legal, security, billing or support purposes. User-controlled customer and invoice data is kept for the life of the account unless the user removes it through available product controls or deletes the account, subject to limited backup, security and legal-retention requirements.

Marketing-preference and suppression information may be retained where reasonably necessary to demonstrate and respect a person's communication preference rather than accidentally adding them back to a marketing audience.

Klamic will not keep personal data indefinitely merely because it can be stored.

9. Cookies and local storage

Klamic uses technical storage that is necessary for functions such as authentication, session continuity and security. Klamic does not currently use behavioural advertising cookies in the authenticated product. If non-essential analytics, advertising or similar tracking is introduced later, this notice and any consent controls will be updated before that use.

10. Your rights

Depending on the circumstances and lawful basis, individuals may have rights including access, correction, erasure, restriction, data portability and objection. Where Klamic acts only as processor for a user's customer data, a request may need to be handled by that Klamic user as controller.

You may also complain to the UK Information Commissioner's Office. See the ICO complaints service.

11. Security

Klamic uses access controls, authenticated sessions, database permissions and service-provider security features intended to protect information against unauthorised access, alteration or loss. No internet service can promise absolute security, but security is treated as an ongoing operational requirement.

12. Changes to this notice

This notice may be updated when Klamic's features, providers or legal obligations change. The review date above will be updated when material changes are made.