Privacy notice

Version 2026-10-27 · Last updated 27 October 2026

In short

• We collect only what we need to chase your late invoices, and we use it only for that.
• If you connect Xero or QuickBooks, we only read your unpaid sales invoices and your customers' names and email addresses. We never change anything in your accounts.
• We never sell your data, never use it for advertising, and never use it to train AI or machine-learning models.
• You can disconnect your accounting software, delete imported data, or delete your whole account at any time, from inside the app.

1. Who we are

Latefee is a trading name of HaidurQureshi Ltd, a company registered in England and Wales (company number 16936643), with its registered office shown on our contact page. We are registered with the Information Commissioner's Office (ICO), registration number ZC177358.

For information about you as a Latefee user, we are the controller. For information about your clients that you put into Latefee or import from your accounting software, you are the controller and we are your processor. Section 5 and our Terms explain this.

For any privacy question or request, email privacy@latefee.co.uk.

2. What we collect

• Account details: your email address, business name, a securely hashed password (we can't see your password), and the payment details and payment link you choose to add to your chasers. We also record which version of our terms and this notice you accepted, and when.
• Invoices you enter: client names, client email addresses, invoice numbers, amounts, due dates and whether they've been paid.
• Data from your accounting software, if you connect it. Section 4 lists exactly what we read.
• Chasers we send for you: a record of each email, including recipient, subject, date, whether it was sent automatically or by you, and whether our email provider accepted it.
• Billing: Stripe collects your card and billing details directly. We only store your Stripe customer and subscription IDs and your plan.
• Security records: the email address and IP address used in failed login attempts, so we can block password-guessing.

3. How we use it, and our lawful basis

We don't send marketing emails unless you've asked to receive them. We don't make any automated decisions that have a legal or similarly significant effect on you. Automatic chasing is a scheduled email that you switch on and control.

4. Xero and QuickBooks data

Connecting accounting software is optional. When you connect Xero or QuickBooks Online, you sign in on their website and choose to give Latefee access. Here is exactly what happens next.

What we access

• Xero: we ask only for read-only access to invoices and contacts (accounting.invoices.read, accounting.contacts.read), plus ongoing access so we can keep your ledger up to date (offline_access).
• QuickBooks Online: QuickBooks offers a single accounting permission (com.intuit.quickbooks.accounting). Latefee uses it only to read. Our software never creates, changes or deletes anything in your QuickBooks company.

What we store

From your unpaid sales invoices: the invoice number, customer name, amount outstanding, currency, due date, payment status and date paid. From your customer records, only an email address where the invoice doesn't include one. We also store your organisation or company name, and the reference IDs needed to match invoices on later syncs. Any other information the accounting software returns, such as line items, is discarded and not stored.

We don't access bank accounts, bank transactions, payroll, employees, bills, expenses, reports or tax records.

What we use it for

Only to provide the features you asked for: show your unpaid invoices, calculate what you're owed, send your chasers, and stop chasing once an invoice has been paid, voided or deleted. We check for changes about once an hour during the working day and every few hours otherwise.

• We never sell, rent or trade it.
• We never share it with third parties, except the service providers in section 6 who help us run Latefee.
• We never use it for advertising or profiling.
• We never combine it with other customers' data for benchmarking or analytics.
• We never use it to train, fine-tune or improve any artificial intelligence or machine-learning model.

Who can see it

Only you, when logged in to your Latefee account. Our staff don't look at your data, except when you ask us for help, or when it's strictly needed to fix a fault, keep the service secure, or meet a legal obligation.

How it's protected

The access tokens Xero and Intuit give us are encrypted with AES-256-GCM before they're stored, and all data travels over encrypted (TLS) connections. Section 9 covers our wider security measures.

Disconnecting and deletion

• You can disconnect at any time, in Latefee (Accounting software → Disconnect), in Xero (Settings → Connected apps), or in QuickBooks (Apps → My apps).
• When you disconnect in Latefee, we revoke our access with Xero or Intuit straight away and delete the access tokens. You choose whether to keep the imported invoices in your ledger or delete them.
• If you disconnect from Xero or QuickBooks instead, or our access expires, we stop syncing as soon as we notice. Unless you reconnect, we delete the imported invoices and access records automatically 90 days after we lost access.
• Deleting your Latefee account deletes all of it straight away.

Xero and Intuit handle your data under their own privacy policies. Latefee isn't affiliated with, or endorsed by, Xero Limited or Intuit Inc.

5. Information about your clients

Latefee holds your clients' names and business email addresses so it can send payment reminders on your behalf. You decide which clients and invoices to add or import, and when to chase. That's why you are the controller of this information and we process it on your instructions, under the data processing terms in section 10 of our Terms. You're responsible for having a lawful basis for contacting your clients. For overdue business invoices, this is usually your legitimate interest in being paid. If one of your clients contacts us about their information, we'll pass the request to you.

6. Who we share it with

We use these service providers (processors) to run Latefee. Each one may only use your data to provide its service to us.

Stripe is also an independent controller of some payment information, for example for fraud prevention, under its own privacy policy. We may also disclose information if the law requires it, to protect our rights or users' safety, or to a buyer if our business is sold, in which case this notice would continue to apply.

7. International transfers

Where a provider processes data outside the UK, we rely on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

8. How long we keep it

9. How we protect it

• Everything is encrypted in transit (HTTPS/TLS), and the service runs on Cloudflare's infrastructure.
• Passwords are hashed with PBKDF2-SHA256 and a unique salt. Accounting software tokens are encrypted with AES-256-GCM, with the key held separately from the database.
• Login sessions use secure, HttpOnly cookies. Repeated failed logins are blocked, and requests from other websites are rejected.
• We ask Xero and QuickBooks only for the access we need, and our app credentials are stored as encrypted secrets, never in our code.
• Only the account holder can see their data in the app.

If a personal data breach puts your rights at risk, we'll tell you without undue delay, and we'll report it to the ICO within 72 hours where the law requires.

10. Your rights

You have the right to access your data, have it corrected, have it deleted, restrict or object to how we use it, and receive it in a portable format. Many of these you can do yourself in the app. For anything else, email privacy@latefee.co.uk. We'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.

11. Cookies

We use one strictly necessary cookie, lf_session, to keep you logged in for up to 30 days. We don't use analytics, advertising or tracking cookies, and our fonts are served from our own website, so visiting Latefee doesn't send your details to anyone else.

12. Children

Latefee is for businesses and isn't intended for anyone under 18.

13. Changes to this notice

If we make an important change, we'll email you before it takes effect. The version and date at the top show when this notice was last updated.

14. Contact us

Email privacy@latefee.co.uk, or write to HaidurQureshi Ltd at the address on our contact page.