29 October 2026

Privacy policy

Orchard Telecom Ltd (company number 16176777) provides Windfall Invoicing. The registered office is 18 Hampden Road, Weston-super-Mare, BS22 6DS. For the account you open with us, Orchard Telecom Ltd is the data controller. Write to that office if you want to use a privacy right or ask a question.

Two kinds of information

We hold information about you so we can run your account and take the subscription. Separately, you store your own customers, invoices, payments, and messages in the books. For those records you are the controller, and we process them only to provide the service.

What we collect about the account

• The business name, your name, email address, username, and a hashed password.
• Company details you choose to print on invoices, such as an address, phone number, and VAT number.
• Subscription status, and the Stripe customer and subscription identifiers. Card numbers are entered on Stripe’s pages. We do not store the full card number.
• A session cookie and a security cookie, so you can stay signed in and forms can be submitted. These are required for the app. We do not use advertising cookies.

What you store in the books

That includes customer names, email addresses, phone numbers, addresses, invoice lines, amounts, and notes. When you send an invoice, reminder, or statement, we pass the message to the mail server configured for the app, addressed to the person you chose.

You need your own reason for holding and emailing those people. This policy does not replace the notice you give your own customers.

Why we use account information

• To open the account, take payment, and provide the books. That is the contract with you.
• To keep the service secure, and to deal with faults and support. That is our legitimate interest.
• To keep records we are legally required to keep, including records of the fees charged.

Who else sees it

Stripe processes the subscription payment. Their privacy notice describes how they handle card details. The company that hosts this application stores the database. The mail server configured for the app receives messages you ask us to send. We do not sell account information or the contents of the books.

People you invite to the business can see the records their role allows. A platform operator can open an account and see the business details needed to run the service.

How long we keep it

We keep the books while the account is open, including after you cancel, so you can return to them. Tell us if you want the books deleted. We will delete them unless we have to keep a limited record, for example of the subscription charges, for tax or to respond to a legal claim. Those records are kept only as long as that reason lasts.

Your rights

You can ask for a copy of the account information we hold, ask us to correct it, ask us to delete it, ask us to restrict it, or object to processing based on legitimate interests. You can also complain to the Information Commissioner’s Office at ico.org.uk. We will respond within one month.

If a request is about a customer’s invoice stored by a business using Windfall, we will usually ask that business to answer it, because they control those records.