Privacy Policy

Inventra ("we", "us", "the Service") is operated by Darby Dalus trading as Inventra Interface, based in the United Kingdom. We are the data controller for your personal data and are committed to protecting it in line with the UK GDPR and the Data Protection Act 2018.

1. Data we collect
(a) Account data: name, email address, hashed password, account creation date, role.
(b) Operational data: stock listings, sales records, expense entries, receipt images, locations and SKU history.
(c) Payment metadata: Stripe handles all card details — we only receive success/failure events and the last 4 digits of the card used.
(d) Communications: any messages you send us via the in-app help widget or email.
(e) Technical data: IP address, browser type, device, log timestamps, and session cookies necessary to authenticate you.
(f) Optional analytics: if you accept all cookies, an additional analytics cookie helps us understand product usage.

2. Why we use it (lawful basis under UK GDPR)
- To deliver the Service you paid for — Article 6(1)(b) "contract performance".
- To send service emails (2FA codes, password resets, receipts, renewal reminders) — Article 6(1)(b).
- To protect against fraud and abuse — Article 6(1)(f) "legitimate interest".
- For optional product analytics — Article 6(1)(a) "consent" (via the cookie banner).
- To comply with HMRC, tax and accounting law — Article 6(1)(c) "legal obligation".

3. Who we share it with
We share data only with the minimum number of essential providers:
- Stripe Payments Europe Ltd — payment processing.
- Resend, Inc. — transactional email delivery (2FA, resets, receipts).
- Our hosting and database provider — encrypted-at-rest infrastructure.
We never sell your data, never share it for marketing, and never grant access to third parties beyond the providers above.

4. International transfers
Some providers (e.g. Resend, Stripe) may process data outside the UK. Transfers are protected by Standard Contractual Clauses or equivalent UK GDPR safeguards.

5. How long we keep it
- Active accounts: data is retained for the lifetime of the account.
- Cancelled accounts: data is retained for 30 days post-cancellation so you can resume, then permanently deleted on request.
- Sales/expense records may be retained for up to 7 years to comply with HMRC record-keeping requirements.
- Logs: rotated and deleted within 90 days.

6. Your rights under UK GDPR
You have the right to:
(a) access a copy of your personal data ("subject access request");
(b) correct inaccurate data;
(c) request deletion ("right to be forgotten");
(d) restrict or object to processing;
(e) data portability (we provide a CSV export of all stock + sales);
(f) withdraw consent for analytics cookies at any time via your browser settings;
(g) complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

To exercise any of these rights, email Admin@inventrainterface.com. We respond within one month.

7. How we protect it
- Passwords are hashed with bcrypt (industry-standard, salted).
- Sessions use HttpOnly cookies + JWT.
- Optional two-step email verification (2FA) for sign-in.
- HTTPS / TLS enforced across all endpoints.
- Database backups encrypted at rest.
- Card details are handled exclusively by Stripe (PCI-DSS Level 1).

8. Cookies
We use:
- Essential cookies for authentication and CSRF protection (no consent required).
- An optional analytics cookie if you accept all cookies via the banner.
You can change your preference at any time by clearing cookies in your browser.

9. Children
The Service is not intended for users under 18. We do not knowingly collect personal data from children.

10. Changes to this policy
We may update this Privacy Policy. Material changes will be notified by email or in-app banner at least 14 days before they take effect.

11. Contact
Inventra · Darby Dalus trading as Inventra Interface · United Kingdom
Email: Admin@inventrainterface.com
Postal address: available on request via the email above.