Privacy
Version 2026-08-09
Effective 9 August 2026 · Last updated 9 August 2026
1Who we are, and which hat we are wearing
Straightbill is operated by Phineworks Inc. Questions about anything on this page: support@straightbill.com.
Two roles, and the difference matters.
For your own account — your email, your business details, your billing — we are the controller. You exercise your rights against us, and this page tells you how.
For your customers' information — everything you enter about the people you bill — you are the controller and we are your service provider. You decide what goes in and why; we hold it and act on your instructions. Their rights are exercised against you, and we help you answer.
The commitments that make the second role binding — that we process it only to serve you, never sell it, never share it for advertising, and never combine it with anything else — are written into section 8 of the terms, not merely described here.
2What we collect
About you and your business
- Your email address and a hashed password. We never see the password itself.
- Business name, address, phone, licence number, tax rate, labour rate, payment terms and timezone — the things printed on your documents or used to calculate them.
- Which trade packs you have installed, and any prices you have changed.
- Which version of our terms you agreed to, and when.
About your customers, because you entered it
- Name, business name, email, phone and billing address.
- Service addresses, and any notes you add to them — gate codes, access instructions, whether there is a dog.
- Estimates, invoices, jobs, materials, hours and payments recorded against them.
Collected automatically
- Whether an estimate or invoice link has been opened, and when. You see this; it is the point of it.
- Ordinary server logs — IP address, browser, pages requested — kept short-term for security and for diagnosing faults.
We use no advertising or analytics trackers. The only cookies we set are the ones that keep you signed in. There is no cookie banner because there is nothing to consent to. We set no tracking cookies, so there is nothing for a Do Not Track signal to switch off.
What we never see
Card numbers and bank details. Payments are handled entirely by Stripe, on Stripe's own payment page. Those details never reach our servers. We store the amount, the method, and Stripe's reference for it — nothing more.
3Why we hold it
| What | Why |
|---|---|
| Your account details | To let you sign in, and to bill you for the subscription |
| Your business details | To print them on your estimates and invoices |
| Your customers' details | To produce and send the documents you tell us to |
| Payment records | So an invoice knows whether it has been paid, and so you have a record |
| Terms acceptance | So both of us can tell what was agreed, and when |
| Server logs | Security, and finding out what broke when something breaks |
4Who else touches it
These companies process data on our behalf, and this is all of them.
| Who | What for | What they see |
|---|---|---|
| Our database and sign-in provider | Storing your records; signing you in | Everything stored, encrypted at rest |
| Our hosting provider | Running the application | Requests in transit; server logs |
| Stripe | Taking payments | Card and bank details, payment amounts |
| Our email delivery provider | Sending your estimates and invoices | Recipient address, subject, the message and its PDF |
Stripe is named because you contract with them directly — your customers' payments land in a Stripe account in your name, under Stripe's own agreement with you. The others are described by what they do rather than by name, which is what data-protection law asks for and which avoids publishing a map of our systems. Ask and we will tell you exactly who they are; it is not a secret from you, only from everyone else.
Before we add another, we tell you. We will update this table and email you at least 30 days beforehand, so you have time to ask about it or to leave. If we ever have to move fast — a provider fails, or a security problem forces our hand — we will act and tell you straight afterwards.
Your data is stored in the United States. Some requests are handled by servers closer to whoever is making them, so data may pass through other countries in transit. If you use Straightbill from outside the United States, you understand it is processed here.
We hand data to law enforcement only where we are legally required to. We do not do it as a courtesy, and we will tell you when we are permitted to.
5Keeping it safe
Every business's data is separated at the database level, not merely by the application asking politely. The access rules live in the database, so one business cannot reach another's records by asking the wrong question of the software above it.
A small number of privileged database routines — the one that records a Stripe payment, for instance — necessarily run with those rules lifted, because they have to work when nobody is signed in. Each one checks for itself who is asking, each is deliberately narrow, and each is covered by automated cross-tenant tests. We treat that set as the part needing the most care, and we keep it as small as we can.
Everything travels over an encrypted connection and is encrypted at rest. Passwords are hashed and checked against known breach lists when you set them. Our tenant-isolation suite runs against a real database in continuous integration, and a change that lets one business reach another's data does not ship.
If something goes wrong, you hear it from us. If we find a security incident that has affected your data or your customers' data, we will tell you within 72 hours of confirming it — what we know, what we do not yet know, and what we are doing. We will tell you even where the law does not require it. We would rather tell you early and be incomplete than tell you late and be tidy, and we will keep you updated as we learn more.
6How long we keep it
- While your account is open: everything, for as long as you want it. Old estimates and invoices stay reachable on purpose — they are records.
- After you cancel: 90 days, so that coming back restores everything and tax season is not a crisis. Sooner if you ask — deletion on request does not wait out the window. Then we delete it from our live systems, and it falls out of our encrypted backups as those rotate — within a further 30 days at most. After that it is gone and we cannot get it back for you.
- Server logs: 30 days.
- Payment and tax records we are legally required to keep: as long as the law requires, and no longer.
7What you can ask for
Whatever your state or country entitles you to, and these regardless of where you live:
- A copy of your data, in a format you can actually use.
- To know what we hold, why, and who else has touched it.
- A correction, if something is wrong.
- Deletion. Ask, and we delete rather than deactivate. Two things we cannot delete: records we are legally required to keep, such as payment records for tax — and anything caught up in a live legal dispute, which we must preserve until it ends. We will tell you if either applies.
- An explanation of anything on this page, in plain terms, from a person.
Write to support@straightbill.com. We will not ask why — we will only check you are who you say you are, because handing your data to the wrong person would be worse than refusing you. Someone may make a request for you if you authorise them in writing. We aim to reply within a few days, and in any case within the time the law allows.
If we say no, you can appeal. Reply to our answer and a different person will look at it, and write back explaining the decision.
We will never treat you worse for asking. No price change, no reduced service, no penalty.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the past 12 months.
If one of your customers asks us directly about their information, we point them to you, because it is your record and not ours to hand over.
8If you were sent an estimate or an invoice
You are probably here because a trade business sent you a link, and at the bottom of that page it said we host it. This section is for you rather than for them.
- The business you are dealing with is the one who holds your details, not us. They entered them; they decide what happens to them. We store them and show them back to you on their behalf.
- We will never email you for our own reasons. The only messages you get through us are the estimates and invoices that business chose to send.
- We do not sell your information, we do not advertise to you, and we set no tracking cookies on the page you were sent.
- If you pay through the link, we never see your card. That goes to Stripe, and your payment goes to the business you are paying.
- We record that the link was opened, and when, and tell the business. That is how they know you saw it.
To see, correct or delete what is held about you, ask the business that sent it — it is their record. If you cannot reach them, write to support@straightbill.com and we will help you get to the right people. We cannot hand over or change their records for you without them.
9If the business changes hands
If Phineworks is ever bought, merges, or sells the Straightbill product, your data may move with the service to the new owner. We would email you before it happened, and the new owner would be bound by this policy until they gave you a new one and a fair chance to leave.
10Children
Straightbill is for businesses. It is not intended for anyone under 18, and we do not knowingly collect their information. If you think we have, tell us and we will delete it.
11Changes to this policy
If we change something that matters, we email you before it takes effect rather than quietly updating the date at the top of this page. Older versions stay readable at their own dated links.
12Getting hold of us
support@straightbill.com
Phineworks Inc.