Privacy Policy

Avriloq provides invoicing, payment tracking, collections and business-administration software. For privacy questions or requests, contact hello@billflowinvoicing.com.

Avriloq can have different roles for different processing. Avriloq generally acts as controller for its own account administration, subscription billing, security, support, product operations, lawful business-to-business marketing and legal obligations. When a business uses Avriloq to process information about that business's customers or contacts on its instructions, that business generally determines the purpose and Avriloq generally acts as processor. The exact role depends on the activity and the terms of any connected third-party service.

Depending on how Avriloq is used, personal data may include:

• Account and identity data: name, work email, account identifiers, authentication and authorised-user information;
• Business profile data: business name, contact information, website, industry, team size, country and onboarding preferences;
• Customer Content: customer/contact details, invoices, jobs or bookings, descriptions, payment status, accounting and collections information entered, generated or synchronised by an authorised business;
• Billing and payment data: subscription plan/status, connected-payment-account identifiers, transaction references and payment status. Raw card numbers and card security codes are handled by the relevant payment provider and are not designed to be stored by Avriloq;
• Integration data: provider account identifiers, authorised scopes, synchronisation status and data imported from a system you connect;
• Communications: transactional email, reminders, customer replies, support messages and related delivery metadata;
• Automation and audit data: settings, actions, approvals, tasks, conversations and audit events; and
• Technical and security data: session, device, request, diagnostic and security information needed to authenticate users, detect abuse and operate the service.

We may receive information directly from you, from authorised users in your organisation, from Customer Content placed in a workspace, from payment/email/accounting/CRM services you choose to connect, from service and security activity, and from public business sources where reasonably necessary for lawful business-to-business prospecting or verification.

Where Avriloq acts as controller, typical purposes and lawful bases include:

• Contract: creating and administering accounts, delivering purchased services, subscriptions, support and requested integrations;
• Legitimate interests: securing and improving service operations, preventing misuse and fraud, resolving disputes, maintaining records and conducting proportionate business-to-business marketing where those interests are not overridden by individual rights;
• Legal obligation: retaining, using or disclosing information where applicable law requires it; and
• Consent: where a particular activity legally requires consent, including any future non-essential tracking or marketing where consent is the appropriate basis.

Where Avriloq acts as processor for Customer Content, Avriloq processes that data to provide the configured service on the business customer's documented instructions under the Data Processing Addendum. The business customer remains responsible for its own lawful basis and privacy information for the people whose data it places in Avriloq.

A customer may authorise Avriloq to connect to services such as QuickBooks Online, Xero, Salesforce or Stripe/payment services. Avriloq requests and uses only the provider access reasonably needed for the configured integration. Provider terms and privacy roles also apply and can vary by service; these providers are not all treated as Avriloq subprocessors. See Service providers & integrations for the current role summary.

QuickBooks and Xero API data is used only to provide the authorised integration and related Avriloq functionality. Avriloq does not use QuickBooks or Xero API data to train or fine-tune general-purpose AI or machine-learning models. Disconnecting an integration prevents new authorised access once provider/local credentials are revoked, subject to lawful retention of information already imported into Avriloq.

Where a business enables AI or automation features, relevant workspace information may be used to classify information, prepare configured communications, recommend actions, create tasks and support invoicing or collections workflows. Avriloq uses controls such as enablement settings, approval requirements, blocked actions and audit records where implemented.

Avriloq does not currently use Customer Content to make solely automated decisions intended to produce legal or similarly significant effects on an individual. Customer text alone is not treated as proof that an invoice has been paid.

Avriloq uses transactional email infrastructure, including Resend where configured, to send invoice and reminder communications on an authorised business customer's instructions. Recipient addresses, message content and delivery metadata may be processed for that purpose. The business customer determines the content, recipients and lawful basis for customer communications it instructs Avriloq to send.

Avriloq may contact relevant businesses about the service using proportionate business contact information where lawful. We identify the sender and provide a practical way to opt out. If a person objects to direct marketing, we stop using their personal data for that purpose and may retain a minimal suppression record so the objection continues to be honoured.

Electronic-marketing rules can differ depending on whether the recipient is a corporate subscriber or an individual subscriber such as a sole trader. Avriloq applies consent and other requirements where applicable rather than assuming every business contact can be marketed to in the same way.

Avriloq uses specialist providers to operate the service, including application/database/authentication infrastructure and transactional email. Customer-authorised integrations may separately process data under their own service terms. The current operational list and role summary is available at Service providers & integrations.

Personal data may also be disclosed where required by law, to protect legal rights or service security, or in connection with a legitimate corporate transaction subject to appropriate safeguards. Avriloq does not sell Customer Personal Data.

Some providers may process personal data outside the UK. Where UK rules treat that processing as a restricted transfer, Avriloq assesses the relevant provider terms and transfer mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another recognised safeguard. The exact mechanism depends on the provider and processing relationship.

Avriloq keeps personal data only for as long as reasonably necessary for the purpose for which it is processed. Retention depends on the active customer relationship, record type, deletion instructions, backup cycles, security/fraud needs, unresolved disputes and legal or accounting obligations. Billing and tax records may be retained for applicable statutory periods. Minimal direct-marketing suppression records may be retained for as long as reasonably necessary to honour an opt-out.

Customer Content is deleted or returned at the end of processor services as described in the DPA, subject to legal retention and protected backup cycles. We do not publish artificial deletion periods that the underlying implementation cannot reliably meet.

Depending on the circumstances, UK data-protection law may give individuals rights of access, correction, erasure, restriction, objection and portability, rights concerning consent, and rights concerning certain automated decisions. These rights are not absolute and depend on the lawful basis and context.

You have an absolute right to object to the use of your personal data for direct marketing. If your information is held in Avriloq by one of our business customers, that business is normally the best first contact because it controls why the information is in its workspace. Avriloq will assist that customer where required.

Contact hello@billflowinvoicing.com for a Avriloq-controlled request. You also have the right to complain to the UK Information Commissioner's Office; complaint information is available at ico.org.uk.

Avriloq uses technical and organisational measures intended to protect personal data, including authenticated access, tenant-scoped database controls, server-side secret handling and encrypted storage of supported integration credentials. No internet service can guarantee absolute security. More detail is available in the Trust Centre.

Avriloq is a business service and is not directed at children. It is not intended to be a general repository for special-category data, criminal-offence data, health records, government identifiers or other sensitive information that is unnecessary for invoicing and business administration. Customers should avoid importing such information merely because it exists in a connected system.

We may update this notice as Avriloq, its integrations or legal obligations develop. The current version and update date will be published here, and material changes will be communicated where appropriate.