Privacy Policy

Involiqo is operated by Key Pillar AI Ltd, company number 16172894, registered in England and Wales. For the processing described in this notice, Key Pillar AI Ltd is the controller of your personal information.

You can contact us through the Contact page. Our registered office is 25 Edmund Road, Southsea, England, PO4 0LL.

Depending on how you interact with Involiqo, we may collect:

• Demo and enquiry information: your name, work email, business name, industry, number of locations, invoice volume, areas of interest, message and consent choices.
• Website and security information: request time, page, browser and device information, network address and identifiers used to prevent spam, fraud and abuse. If you allow analytics, this also includes page views, performance measurements, selected conversion events and allowlisted campaign labels. Sanitized technical-error reports may include the error type, page path and release identifier, but not the error message, stack trace, form contents or query string.
• Product account information: identity and authentication details, business membership, role and account preferences.
• Business records you provide: supplier, invoice, line-item, transaction, liability, budget and related operational information. These records may include personal information about business contacts.
• Support and correspondence: messages, feedback and records of our communications with you.

Please do not include unnecessary sensitive personal information in free-text fields or uploaded business records.

• To respond to enquiries, arrange demonstrations and take steps you request before entering a contract.
• To provide, support and administer the product under our contract with the customer organisation.
• To protect the service, prevent abuse, troubleshoot problems and improve reliability in our legitimate interests and those of our customers.
• To measure public-website use and performance where you have allowed analytics.
• To comply with legal, regulatory, tax, accounting and law-enforcement obligations.
• To send optional marketing communications where you have given consent.

Where we rely on legitimate interests, those interests are operating a secure, useful business service, responding to business enquiries and preventing misuse. We consider the impact on individuals before using this basis.

Marketing updates are optional and the demo form does not select them for you. You can withdraw consent at any time by using the unsubscribe option in a message or contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal.

Vercel Web Analytics and Speed Insights load only if you allow analytics through the website privacy control. They help us understand page use, conversion stages, article engagement and technical performance without sending demo-form contents. Vercel describes Web Analytics as cookie-free and uses privacy-focused measurement methods. You can withdraw permission through Privacy settings in the footer.

We share information only where needed with categories of recipients such as:

• cloud hosting, website analytics, performance, database, storage, authentication and security providers;
• email delivery and customer-enquiry providers;
• AI processing providers when a customer chooses an invoice-extraction workflow, with human review before extracted data is accepted;
• professional advisers, auditors, insurers and authorities where required; and
• a buyer or successor if the business is reorganised, sold or transferred.

Service providers act under contract and may use information only to provide their services to us, subject to their legal obligations. We do not sell personal information.

Some suppliers may process information outside the UK. Where UK data-protection law requires safeguards, we use an applicable adequacy regulation or contractual safeguards and supplementary measures. You can contact us to ask for more information about the safeguard relevant to your information.

We keep information only for as long as needed for the purpose for which it was collected:

• enquiry records are retained while we handle the enquiry and for a reasonable period for follow-up, recordkeeping and legal claims;
• marketing records are retained until consent is withdrawn or the contact is no longer active;
• customer account and business records are retained for the customer relationship and any period required for contractual, tax, accounting, security or legal obligations; and
• short-lived anti-abuse signals are kept only as needed to enforce submission limits and investigate misuse.

We consider the amount, sensitivity, legal requirements, risk and operational need when setting a retention period. Information is deleted, anonymised or securely isolated when it is no longer required.

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, object to its use, and receive certain information in a portable format. You may also withdraw consent where processing relies on consent.

You have the right to object to processing based on legitimate interests and to direct marketing. We will stop direct marketing when you object.

Contact us to exercise a right. We may need to verify your identity and will respond within the period required by law. Some rights are subject to exemptions.

Involiqo may use automated tools to extract proposed data from invoices or identify operational patterns. Extracted invoice fields are presented for human review. We do not use the processing described here to make solely automated decisions about individuals that have legal or similarly significant effects.

We use technical and organisational measures designed to protect information, including access controls, private file handling, audit events and security checks for uploaded invoice files. No internet service can promise absolute security. Read more on our Security page.

Please contact us first if you have a privacy question or concern so we can investigate it. You also have the right to complain to the UK Information Commissioner's Office.

Visit the ICO data-protection complaints service for current contact details and guidance.

We may update this notice when our services, suppliers or legal obligations change. Material changes will be highlighted through an appropriate channel, and the date at the top will show the latest version.