What we collect, why, how long we keep it and what you can demand from us. Written to be read — the plain-language summary at the top of each section is part of the document, not marketing.
In plain English: DueBell is run by a UK company. If you have a privacy question, one named person reads it.
DueBell is operated by WEB ELEVATE LIMITED, a company registered in England and Wales. In this document “we”, “us” and “DueBell” mean that company, and “you” means the person or business using the service.
For anything covered here you can write to privacy@duebell.io. We answer privacy requests within thirty days and usually within three working days.
In plain English: your account details, the invoices and statement lines you upload, and a record of the reminders we sent. Nothing about your clients beyond a name and a way to reach them.
| Category | What it includes | Lawful basis |
|---|---|---|
| Account | Your name, email address, password hash, business name, plan | Contract |
| Invoices | Number, amount, currency, issue and due date, your notes, uploaded files | Contract |
| Client contacts | Client name and one contact channel — email, phone or both | Contract |
| Statement lines | Date, amount and description, exactly as they appeared in the file you uploaded | Contract |
| Message history | What was sent, when, on which channel, delivery status, replies received | Contract |
| Product usage | Anonymised feature events — no amounts, no client names | Legitimate interest |
| Billing | Invoices for your subscription. Card details never reach our servers | Legal obligation |
We do not ask for bank credentials, tax identification numbers, registered addresses of your clients, or access to your inbox. The full field-by-field breakdown, with what we deliberately refuse to collect, is on the security page.
In plain English: to run the service you signed up for, to bill you, and to fix things when they break. Not to profile you, not to train models, not to sell.
We do not use your data to train artificial intelligence models. AI is used in one place only: helping you draft reminder templates during setup, on text you provide. Your invoices, clients, statements and message history are never used as training data, by us or by anyone else.
In plain English: the companies that physically deliver your emails and texts, host the database and charge your card. Nobody else, and never for their own purposes.
Sending an email or an SMS means a third party carries it. Every such company is listed, with what it handles and where it operates, in our subprocessor table. That list is versioned: when a provider is added or replaced, the change is published before it takes effect.
We do not sell personal data, do not share it with advertisers, and do not permit our providers to use it for anything beyond the service they perform for us.
In plain English: in the EU, wherever you invoice from. When a message has to leave that area to be delivered, it travels under standard contractual clauses.
Account data is held in the European Union whether you operate from Manchester, Austin, Toronto or Auckland. Where delivery requires a transfer outside the EEA — an SMS to a US number, for instance — that transfer is covered by standard contractual clauses with the provider concerned.
Everything is encrypted in transit with TLS 1.3 and at rest with AES-256.
In plain English: while your account is open, plus thirty days in backups. Billing records stay as long as tax law requires. Nothing else survives deletion.
In plain English: you can see everything, correct it, take it with you and have it erased — mostly with a button rather than an email.
Depending on where you are, you have rights under the UK GDPR, the EU GDPR, PIPEDA in Canada, the CCPA and CPRA in California, and comparable regimes elsewhere. In practice they amount to the same list:
In plain English: the client details you upload stay yours. You decide what happens to them; we only act on your instructions.
For the data you upload about your clients you are the controller and we are the processor. We act on your instructions, do not contact your clients for our own purposes, and do not brand the messages we send on your behalf.
A data processing agreement is available on request and forms part of our terms for business customers. If one of your clients asks you to correct or erase their details, you can do it from your own account without involving us.
In plain English: the ones needed to keep you logged in, and privacy-friendly analytics that do not follow you anywhere else.
We use strictly necessary cookies for authentication and security, and a cookie-free analytics tool that does not build cross-site profiles. We do not run advertising trackers. The full breakdown, with names and lifetimes, is in the cookie policy.
In plain English: material changes are announced before they take effect, and old versions stay available.
When this policy changes in a way that affects you, we email account holders at least fourteen days before the new version takes effect, and publish the change in the changelog. Every previous version remains available in the archive linked at the top of this page.
Questions, requests and complaints: privacy@duebell.io, or by post to WEB ELEVATE LIMITED at the address given on our contact page.
Free for your first 5 invoices a month. No card, no bank connection, no accounting software.
Sign up free