Privacy policy
This is a placeholder, not a legal document.
Small has not yet been incorporated and no lawyer has reviewed this page. Nothing here should be relied on. A real terms of service and privacy policy will be published, naming the actual operating company, before Small handles a live customer’s money or data.
What follows is a plain description of what data Small handles today, not a binding policy. When the real policy is written, it’ll need to cover at least this ground:
What we store
Account details for the person signing up; the business’s organization details (name, address, contact details) used on its invoices; and the invoices themselves, including customer names, emails and amounts entered by the business. We do not store card numbers — those are handled entirely by Stripe.
Who we share it with
Stripe, to process payments and run the connected account a business’s invoices are paid into. An email provider, to send invoices and payment reminders on a business’s behalf. Nobody else, and never for advertising.
A customer paying an invoice
Someone paying an invoice through Small does not need an account. Their name, email and payment are handled as part of fulfilling that invoice, on behalf of the business that sent it — not collected by Small for its own purposes.
What’s missing
The real policy will additionally need to cover: how long data is kept after an account closes, how to request deletion or export, the legal basis for processing, international transfers, and contact details for a data protection query. None of that is decided here, and there is deliberately no fabricated ICO registration number on this page — Small doesn’t have one yet.