Privacy Policy

Reclaim Day is run by Northstar Infinity Works Ltd ("we", "us"), a company registered in England & Wales (company number 17326480), registered office Building 2, Building 2, Marlins Meadow, Watford, England, WD18 8YA. Faktury.co.uk and Reclaim Day are trading names of Northstar Infinity Works Ltd (company number 17326480). We are registered with the UK ICO under number ZC194241.

We are the controller of your account, billing, security and website data. For the invoices and documents you upload for your business (including your customers’ and suppliers’ details) we act as your processor, on your instructions — see the Terms, “Data processing”.

Questions or requests: help@reclaimday.com.

• Account data — name, e-mail, password (hash only), sign-in and 2FA methods, the brand you signed up through.
• Invoices & documents — the files you upload (PDFs, photos, e-mails sent to your inbox address) and the data read from them: supplier, customer, addresses, VAT numbers, amounts, dates, line items.
• Billing data — plan, subscription status and payment identifiers (we never store card details — Stripe handles them).
• Technical and security data — IP address, browser, sign-in events and lockouts.
• Correspondence — messages with your accounting firm and with our support.
• Consent record — which version of the terms and this policy you accepted, when, and from which IP address and browser.

• To provide the service — storing and reading your invoices, exports, account management. (Performance of a contract.)
• AI data extraction — uploaded documents are sent to Anthropic, which reads the data from them. (Contract.)
• Billing — subscriptions and payments. (Contract / legal obligation.)
• Security and fraud prevention — sign-in records, rate limits, lockouts; after you delete your account, for 12 months only a one-way fingerprint of your e-mail address (not the address), so that signing up again does not start a second free trial. (Legitimate interests.)
• Account e-mails — transactional notices; marketing only with consent and a one-click unsubscribe. (Contract / legitimate interests / consent.)
• Website statistics — our own, cookieless, with no identifier stored; Vercel Web Analytics and Speed Insights (cookieless, aggregated); Google Analytics only after you click “Accept”. (Legitimate interests / consent for Google Analytics.)
• Where our customers come from — when you sign up we record against your account how you reached us: the campaign tags in the page address (utm_*), an ad click id (e.g. gclid, fbclid), the site you came from (the domain only, never the page address) and the page you landed on. Never your IP address or browser details. Without your consent we only know the visit in which you create the account and store nothing in your browser; after you click “Accept” your browser remembers up to 20 earlier visits from the last 90 days. We use this to judge which channels and campaigns work. Ad platforms get one thing, and only after you click “Accept”: Google Ads receives the id of the click on its ad (gclid), the event (sign-up or first payment), its time and — for a payment — the amount; no e-mail, name or other data. You can withdraw at any time under “Cookie settings” in the footer (choose “Essential only”) — from then on your account is left out. After signing up you may also answer “How did you hear about us?” (optional). (Legitimate interests; browser storage and passing to Google Ads — consent.)
• Legal compliance — tax and accounting obligations. (Legal obligation.)
• Trial scan on the homepage (no account) — the file you choose is sent to Anthropic within a single request and is not stored on our servers. We show only the supplier, date, number, amounts and category. The file stays in your browser for up to 7 days so it can go into your account if you sign up. Two strictly necessary cookies limit free use: a signed counter of trial scans (up to 180 days) and a proof that the anti-bot check was passed (30 minutes); your IP address is used for a daily limit. (Legitimate interests.)

We do not sell your data. It goes only to:

• Your accounting firm — only if you switch sharing on; you can switch it off at any time.
• Apps you connect to your account yourself (e.g. MTD Polski) — they receive the invoice data you authorise.
• Service providers (processors) acting on our instructions — table below.
• Public authorities — where the law requires it.

Where a provider processes data outside the UK, the safeguard in the table applies. We will send you a copy of the safeguard (the clauses or addendum) on request to help@reclaimday.com.

Anthropic does not train its models on content sent through its commercial API (Anthropic Commercial Terms of Service) and deletes it within 30 days, unless the law requires longer or its usage policy was breached (then up to 2 years) — Anthropic Privacy Center, as of 1 July 2026.

Deleted data can survive briefly in our database provider’s rolling backups until those backups expire. Stripe keeps payment records for as long as the law requires of it.

Under the UK/EU GDPR you have the right to:

• access your data — the export in the app (Security → Privacy & data) contains your account profile, invoices, messages, support correspondence, consent record, 12 months of security history and the inbox log; the invoice files download there as ZIP files; ask for anything else at help@reclaimday.com;
• rectify inaccurate data;
• erasure — deleting your account in the app erases the account, invoices and files at once;
• restrict or object to processing;
• data portability;
• withdraw consent where processing relies on it.

Write to help@reclaimday.com. You may also complain to the UK Information Commissioner’s Office (ico.org.uk) or an EU supervisory authority.

Invoice files and sensitive fields are encrypted (AES-256-GCM, keys in AWS KMS in London), connections use TLS, and sign-in supports 2FA and passkeys. Our Security page describes the details and their limits.

• Security

• Strictly necessary: your login session, language and theme, an optional “trusted device” token (skipping 2FA), your cookie-banner choice, the trial-scan limits (section 3).
• Google Analytics: cookies _ga and _ga_<id> (up to 2 years) — only after you click “Accept”.
• Our own page statistics store nothing in your browser.
• Visit sources (fa_touches, localStorage) — only after you click “Accept”: up to 20 visits from the last 90 days (campaign tags, referring domain, landing page), handed over when you sign up and then removed from the browser. “Essential only” deletes the list.

The service is for businesses and self-employed people, not for anyone under 16; we do not knowingly collect their data.

We will tell you about material changes in the app or by e-mail before they take effect. The date above shows the current version.

Northstar Infinity Works Ltd · company no. 17326480 · Building 2, Building 2, Marlins Meadow, Watford, England, WD18 8YA · help@reclaimday.com