Privacy Policy

1. Introduction

Recoup-IQ ("we," "our," or "us") is operated by RECOUPIQ LTD, a company registered in England and Wales (Company Number: 16947526). Our registered office is located at Flat1 410 High Street Lincoln LN5 7TE United Kingdom.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our invoice management and payment recovery service.

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us:

• Name, email address, and phone number
• Business name, address, and Company Registration Number
• Payment information (processed securely through Stripe)
• Client information (names, emails, invoicing details)
• Invoice data and transaction history
• Voice Recordings & Transcripts: Audio recordings of calls made via our AI Voice Agent (if enabled)
• HMRC Tax Data: VAT liabilities, obligations, and payment history (if MTD is approved)

2.2 Automatically Collected Information

• Device information and browser type
• IP address and location data
• Usage data and analytics
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our services
• Process payments and send invoices on your behalf
• Send payment reminders and recovery communications
• Provide customer support and respond to inquiries
• Send important updates about our services
• Comply with legal obligations and prevent fraud
• Analyze usage patterns and improve user experience
• Create, license, and sell anonymized, aggregated datasets to third parties, including but not limited to financial institutions, lenders, banks, credit reference agencies, and market intelligence firms, for purposes such as credit risk assessment and economic benchmarking

4. Legal Basis for Processing (UK GDPR)

We process your data based on:

• Contract Performance: To provide our services to you
• Legitimate Interests: To improve our services and prevent fraud
• Legal Compliance: To comply with UK tax and financial regulations
• Consent: For marketing communications (which you can withdraw at any time)

5. Data Sharing and Disclosure

We may share your information with:

• Authentication & Identity: Clerk (user accounts and session management)
• Payments: Stripe (payment processing and Stripe Connect for freelancer payouts)
• Infrastructure & Hosting: Google Cloud Platform — Firestore (database), Cloud Storage (files), Cloud Run (backend ML service), and Vercel (Next.js frontend hosting)
• CRM: HubSpot (customer relationship management — your name and email are synced to our HubSpot account when you sign up, to manage onboarding and support communications)
• Analytics: Mixpanel (product usage analytics — only with your cookie consent), Vercel Analytics (anonymous Web Vitals only, no PII)
• Error Monitoring: Sentry (error tracking and performance monitoring — may capture anonymised technical context including user IDs for debugging; subject to a data processing agreement)
• AI Processors: We use third-party AI models (Anthropic Claude, Google Gemini) to generate and analyse collection messages. Data sent to these models is subject to strict data processing agreements and is not used to train their public models.
• Telephony: Voximplant (AI voice calls and SMS delivery; call recordings stored securely)
• Government Bodies: HMRC (for Making Tax Digital) and Companies House (for business verification)
• Your Clients: Invoices and payment reminder communications
• Legal Authorities: When required by law or to protect our legal rights

We do not sell your personal information to third parties. Anonymised, aggregated datasets (with no personally identifiable information) may be licensed to financial institutions and market intelligence firms — see Section 3 for details.

6. AI Voice Agent and Call Recording

When you enable our AI Voice features (telephony):

• Recording: Calls initiated by the system are recorded for quality assurance, dispute resolution, and regulatory compliance.
• Analysis: Voice data is transcribed and analyzed by AI models to determine call outcomes (e.g., "Promise to Pay", "Dispute").
• Storage: Recordings are stored securely via our telephony provider (Voximplant) and are accessible only to you and authorized personnel.
• Consent: You warrant that you have the right to contact the debtor and that your use of the service complies with relevant telecommunications regulations (e.g., Ofcom).

7. Account Information & Payment Initiation (Open Banking)

We use approved Third Party Providers (TPPs) and HMRC APIs to facilitate payments:

• Payment Initiation: When using "Pay HMRC", we act as a technical gateway. We do not touch or hold your funds. Payments move directly from your bank to HMRC.
• Tax Data: By connecting your HMRC account, you grant us read-only access to your VAT and Tax liabilities for the purpose of displaying them in your dashboard.

8. Data Security

We implement industry-standard security measures including:

• End-to-end encryption for sensitive data
• Secure HTTPS connections
• Regular security audits
• Access controls and authentication
• Secure cloud infrastructure (Google Cloud Platform)

9. Your Rights Under UK GDPR

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: For marketing communications

To exercise these rights, contact us at contact@recoup-iq.tech

10. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. Generally, we retain:

• Account data: Duration of account plus 7 years (UK tax requirements)
• Transaction data: 7 years (legal and accounting requirements)
• Marketing data: Until you withdraw consent

11. Cookies

We use cookies and similar technologies for authentication, analytics, and user preferences. You can control cookies through your browser settings. For more details, see our Cookie Policy.

12. International Data Transfers

Your data may be transferred to and stored on servers located outside the UK/EEA (e.g., Google Cloud servers). We ensure appropriate safeguards are in place through:

• Standard Contractual Clauses approved by the UK ICO
• Adequacy decisions where applicable
• Service provider compliance with UK GDPR standards

13. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our website. Your continued use of our services after changes constitutes acceptance.

15. Contact Us

For questions about this Privacy Policy or to exercise your rights, contact us:

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):ico.org.uk