Privacy policy
Last updated: 13 October 2026
Who we are
BillMyWeek (billmyweek.com) is run by Kriss Bailey, trading as BillMyWeek, who is the data controller for the personal data described here. Contact: baileykrissf@gmail.com.
What data we hold
- Account data: your email address, a securely hashed password (never stored in plain text), and if you use Google sign-in, your Google account ID and name.
- Business details you enter: name, address, phone, email, bank account number and sort code, rates, invoice settings, logo and appearance choices.
- Client data you enter: client names, addresses and email addresses.
- Invoice data: dates, days, hours, locations, amounts, notes and status.
- Messages you send us through the contact form.
- Technical data: IP address and request logs kept briefly for security and to prevent abuse (for example, rate limiting).
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Providing your account and creating, storing and emailing your invoices | Contract – needed to provide the service you asked for |
| Security, preventing fraud and abuse, keeping the service running | Legitimate interests |
| Replying to messages and sending password-reset emails | Contract / legitimate interests |
| Keeping records where the law requires it | Legal obligation |
Your clients' details are entered by you. For that data you are the controller and we process it on your behalf to provide the service.
Who we share it with
We do not sell your data. It is stored on our server provider's infrastructure, and emails are sent through our email provider. If you sign in with Google, Google processes that sign-in under its own privacy policy. When you email an invoice, it is sent to the address you choose.
How long we keep it
- Account, business, client and invoice data: for as long as your account is open. You can delete your account at any time under Account, which deletes this data straight away.
- Backups: up to 14 days after deletion, after which they are overwritten.
- Security logs and rate-limit records: up to 24 hours (server logs up to 30 days).
- Contact messages: up to 12 months.
Cookies
We use only essential cookies: a session cookie that keeps you logged in and protects your account. We also store your cookie-notice choice in your browser. We don't use analytics or advertising cookies. If that changes, we'll ask for your consent first.
Your rights
Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to its use, and to data portability. You can export all your data (JSON and PDFs) and delete your account yourself from the Account page. For anything else, email baileykrissf@gmail.com. We'll reply within one month.
Complaints
If you're unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, phone 0303 123 1113.
Changes
We'll update this page if anything changes and show the date it was last updated.