Privacy Policy

This is a starting draft, not finished legal advice — see the note at the very bottom before you publish it. Chit ("we", "us") is operated by [Your name or registered business name], contactable at [your contact email]. This policy explains what personal data we collect through the Chit app, why, and what rights you have over it.

1. Two kinds of personal data Chit handles

Chit is a tool one business (yours) uses to invoice another set of people (your clients) — so there are two different relationships this policy needs to cover:

• Your account data.When you sign up, we're the data controller — we decide why and how it's processed, and this policy is our promise to you about that.
• Your clients' data.The names, addresses, phone numbers, and notes you store about your own clients belong to your business, not ours — you are the data controller for that information, and we're simply the processor storing it on your behalf, on your instructions. If one of your clients asks you what data you hold on them, that request is yours to answer, not ours.

2. What we collect about you

• Your email address and password (handled securely by our authentication provider, Supabase — we never see your password in plain text).
• Your business name, address, and VAT details, if you choose to add them.
• Billing information — handled entirely by Stripe. We never see or store your card details.
• Basic technical data (like log-in timestamps) needed to keep the service running securely.

3. What you store about your clients

Client names, addresses, phone numbers, and any notes you add are stored so you can generate invoices. We don't use this data for anything beyond providing the service to you, and we don't sell or share it.

4. Why we process this data

On the basis of our contract with you (providing the invoicing service you've signed up for), and, for the technical/security data, our legitimate interest in keeping Chit working and secure.

5. Who else sees it

We use a small number of specialist providers to run Chit — we don't sell data to anyone, and these providers can't use your data for their own purposes:

• Supabase — hosts our database and handles account log-in.
• Stripe — processes subscription payments.
• [Your hosting provider, e.g. Vercel] — hosts the application itself.

6. How long we keep it

We keep your data for as long as your account is active. If you delete your account, we delete your business and client data within [30 days — set your own number], except where we're required to keep billing records for tax purposes for longer.

7. Your rights

Under UK data protection law, you can ask us to:

• Give you a copy of the data we hold about you
• Correct anything inaccurate
• Delete your account and associated data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these, email [your contact email]. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've got something wrong.

8. Cookies

We only use strictly necessary cookies to keep you logged in securely. We don't use advertising or tracking cookies.

9. Changes to this policy

If we make significant changes, we'll let you know by email or an in-app notice before they take effect.

A note on using this draft

This was drafted to match what Chit actually does, but it isn't legal advice, and I'm not a lawyer — before you rely on this for a real, paying customer base, it's worth a cheap once-over from a solicitor or a reputable UK-specific template service (the ICO's own website has free guidance for small businesses too). At minimum, fill in every [bracketed placeholder] above with your real details before publishing.