Your privacy,
in plain English.

Who we are

Sundays Tools Ltd is a company registered in England and Wales. We run two products: Sundays Nudge (SMS appointment confirmations) and Sundays Invoices (invoice creation and chasing). One person operates the company day to day: Matt Geppert.

For your account information we are the data controller. For the customer and client data you upload, you are the controller and we are the processor acting on your instructions.

Any questions about your data, email [email protected].

What we collect

We try to collect only what we need to run the service. In practice that is:

• Account information. Your name and email when you sign up. A mobile number if you give us one for SMS reply forwarding.
• Business details. Trading name, address, VAT number, company registration number and bank details where you choose to put them on invoices.
• Payment information. Card details are handled by Stripe, never by us. We hold a Stripe customer ID and a record of which subscription you are on.
• Client and customer data you upload. Names, mobile numbers, email addresses, appointment times, invoice amounts and due dates that arrive through Phorest, Xero, QuickBooks, or that you enter directly into the dashboard.
• Usage data. Basic server logs of which pages were requested and when, so we can debug problems and keep the service running.
• Cookies. One signed session cookie that keeps you logged in. Nothing else at launch. See the section on cookies below.

Why we collect it

4 reasons, in order of how often they come up:

• To deliver the service. We cannot send an SMS or chase an invoice without the relevant client data. We cannot keep you logged in without a session cookie.
• To bill you. Stripe needs an identifier and an amount.
• To support you. When you email us with a problem, we need to be able to find your account.
• To comply with the law. HMRC requires us to keep records of who we have invoiced and for how much.

The legal basis under UK GDPR

For your account and billing information we rely on contract. You have asked us to provide the service and we cannot provide it without these details.

For your customer and client data we rely on our legitimate interests in operating a functioning service for you, and on your own legitimate interests as a business managing bookings or unpaid invoices. You are responsible for having a lawful basis to message your own clients in the first place.

If we ever add anything that needs consent (for example, analytics cookies), we will ask you first and you can say no.

Who else handles your data

We use a small number of trusted suppliers to run the service. Each one only sees the data they need:

We do not sell your data. We do not share it with anyone outside this list for marketing or any other purpose.

International transfers

Most of the suppliers above are based in the United States. Where data leaves the UK, it is transferred under the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, both of which the ICO recognises as a valid safeguard under UK GDPR.

How long we keep it

While your account is active, we keep your data so the service works. When you close your account, here is what happens:

• Account credentials, integration tokens and uploaded client data are deleted within 30 days of cancellation.
• Invoice and billing records are kept for 7 years from the end of the relevant tax year. This is a legal requirement under UK tax law.
• Anonymised usage logs may be kept longer for security and debugging.

You can ask us to delete your data earlier and we will, except where we are legally required to keep it.

Your rights

Under UK GDPR you have the right to:

• Access. Ask for a copy of the data we hold about you.
• Rectification. Ask us to correct anything that is wrong.
• Erasure. Ask us to delete your data.
• Portability. Ask for your data in a machine-readable format you can take elsewhere.
• Objection. Object to how we are using your data, including for our legitimate interests.
• Restriction. Ask us to stop using your data while we work something out.
• Complaint. If you are not happy with how we have handled your data, you can complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint.

Email [email protected] and we will respond within 5 working days.

Cookies

At launch we use 1 cookie: a signed session token that keeps you logged in. No analytics, no advertising, no tracking pixels.

If we add analytics in future, we will ask for your consent before setting any non-essential cookie. Until then, the full detail is on the cookies page.

Children

Sundays is a business service. It is not designed for, marketed to, or intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has signed up, email [email protected] and we will delete the account.

Changes to this policy

If we make a material change to how we handle data, we will email you at least 30 days before it takes effect. Minor wording fixes will just show up with a fresh "last updated" date at the top.

Contact

Sundays Tools Ltd, registered in England and Wales.

Email [email protected] for anything privacy related.

These terms reflect our current practice and will evolve as the product grows. We will notify you of material changes 30 days in advance by email.