Privacy Policy

1. Introduction

This Privacy Policy explains how Qazua Ltd ("Qazua", "we", "us", or "our") collects, uses, stores, and protects your personal information when you use our invoicing software at qazua.com.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have questions about how we handle your data, contact us at support@qazua.com.

2. Who We Are

The data controller responsible for your personal data is:

Qazua Ltd is registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number will be published here upon completion of registration.

3. Information We Collect

Account Information

When you register with email and password, we collect your name, email address, and a secure hash of your password (we never store your password in plain text). When you register using Sign in with Google, we receive your name, email address, profile picture URL, and a unique Google account identifier from Google. We never receive your Google password.

Business and Invoice Data

We store the business information, client details, invoices, expenses, and HMRC submission records that you create within Qazua. This data belongs to you and is used solely to provide the service.

Payment Information

Subscription payments are processed by Stripe. We do not collect or store your payment card details — these are handled directly and securely by Stripe. We retain a record of your subscription status and payment history.

Technical and Usage Data

We collect anonymised usage information through Google Analytics, including pages visited, features used, and general interactions. We also collect device and browser signals via Google reCAPTCHA Enterprise on protected forms. IP addresses collected by Google Analytics are anonymised. None of this data identifies you personally.

4. How We Use Your Information

• To create and manage your account and verify your identity
• To provide invoicing, expense tracking, and HMRC Making Tax Digital submission features
• To send transactional emails (account verification, invoice notifications, password reset)
• To process subscription payments and manage your billing
• To protect the service against bots and fraudulent activity via reCAPTCHA
• To understand how the product is used and improve it over time
• To comply with UK tax, accounting, and data protection law

5. Legal Basis for Processing

Under UK GDPR Article 6, we rely on the following lawful bases for specific processing activities:

6. Google Services

Qazua's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide and improve user-facing features within Qazua. It is not used for advertising, credit assessment, or to train AI or machine learning models. Qazua staff do not read Google user data except when required to provide support you have explicitly requested, for security investigations, to comply with legal obligations, or for aggregated internal operations — all consistent with Google's permitted purposes.

Sign in with Google

You may choose to create an account or sign in using your Google account. When you do, Google shares the following with Qazua:

• Your name
• Your email address
• Your Google profile picture URL
• A unique Google account identifier

This data is used solely to create and authenticate your Qazua account. We do not share it with third parties except as described in this policy. You can revoke Qazua's access at any time via your Google Account permissions page.

Google reCAPTCHA Enterprise

We use Google reCAPTCHA Enterprise on our login and registration forms to protect against bots and automated abuse. reCAPTCHA collects hardware and software information (such as device data and interaction patterns) and sends it to Google for risk analysis. Qazua receives only the resulting risk token — we do not receive or store the underlying signals. See Google's Privacy Policy for details.

Google Analytics (GA4)

We use Google Analytics 4 to collect anonymised usage data, including pages visited, features used, and general engagement. Google Analytics assigns a client identifier cookie (_ga) to measure sessions. IP addresses are anonymised by Google before storage. This data does not identify you personally and is not shared with third parties outside of Google's analytics platform.

7. Third-Party Services

We use the following trusted third-party services to operate Qazua. Each acts as a data processor on our behalf and is bound by a data processing agreement:

8. International Data Transfers

Some of our third-party service providers are based in the United States. This means that when we share your data with them, it is transferred outside the United Kingdom. We ensure appropriate safeguards are in place for all such transfers:

• Google (Analytics, reCAPTCHA, Sign in with Google, Cloud) — participates in the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), providing an adequacy-equivalent transfer mechanism.
• Stripe — transfers are covered by the UK Addendum to the EU Standard Contractual Clauses (SCCs) and Stripe's participation in the UK-US Data Bridge.
• Twilio SendGrid — transfers are covered by the UK Addendum to the EU Standard Contractual Clauses (SCCs).

You can request details of the specific transfer safeguards in place by contacting us at support@qazua.com.

9. Automated Decision-Making

Qazua uses Google reCAPTCHA Enterprise to make an automated assessment of whether a form submission originates from a human user or an automated bot. This assessment may result in a login or registration attempt being blocked if the risk score is too low.

This processing is carried out on the basis of our legitimate interests in protecting the service from fraud and abuse. If you believe you have been incorrectly blocked, you can contact us at support@qazua.com to request human review.

10. Data Storage & Security

Your data is stored on servers located in the United Kingdom. We use industry-standard security measures including:

• Encryption in transit (HTTPS/TLS) for all data exchanges
• Encrypted storage for sensitive data at rest
• Secure password hashing (we never store plaintext passwords)
• Access controls limiting who within Qazua can access production data

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.

11. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specific retention periods:

• Account and business data is retained for the life of your account, plus up to 7 years to comply with UK tax record-keeping requirements (HMRC).
• Google Sign-In profile data (name, email, profile picture URL) is retained as part of your account record and deleted when you delete your account.
• Google Analytics data is retained for 14 months within Google's platform.
• reCAPTCHA risk tokens are discarded immediately after server-side verification and are never stored.

To request deletion of your account and associated data, email support@qazua.com. We will process deletion requests within 30 days, subject to any legal retention obligations.

12. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention obligations.
• Right to restriction — request that we limit processing of your data in certain circumstances.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Rights related to automated decisions — request human review of any automated decision that significantly affects you.

To exercise any of these rights, contact us at support@qazua.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly:

13. Cookies

Qazua uses the following cookies:

• Authentication — a session token to keep you signed in. Strictly necessary for the service to function.
• Google Analytics (_ga) — a client identifier to measure sessions and usage patterns. Set by Google Analytics.
• reCAPTCHA — cookies set by Google to assess bot risk on protected forms.

You can control or disable non-essential cookies through your browser settings. Disabling cookies may affect the functionality of certain parts of the service.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email or via an in-app notice. Continued use of Qazua after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.