Privacy Policy

1. Who controls your data

HAMAR SOLUTIONS LTD (Co. No. 15630253), registered in England & Wales, is the data controller for personal data you provide while using HAMAR®. ICO registration: ZC203835. For data your clients provide to you (which you then enter into HAMAR to issue them quotes/invoices), you are the data controller and HAMAR is your data processor.

Contact for data matters: hello@hamar.io.

2. What data we collect

To provide the service, we collect:

• Account data — name, email, password (hashed), the email of the device that signed you up.
• Business data — your business name, trading address, VAT registration, contact email, phone, logo, brand colours.
• Client data you enter — names, contact details, addresses, internal notes about your clients.
• Transactional data — quotes, invoices, line items, payment status, chase history.
• Audit data — IP address and browser when you accept/decline a quote, when you submit a bug report, and when you sign in.
• Technical data — basic logging from Vercel (request paths, response codes, timing) for debugging and abuse prevention.
• Expense data — amounts, dates, suppliers and categories of the expenses you record, and images of any receipts you attach. The text on a receipt is read on your own device; the image is stored with your account so you have it for your records.
• Bank details for payment instructions— the sort code and account number you choose to show on your invoices so clients can pay you by bank transfer.
• Tax data — VAT number and scheme and your accounting basis. If you connect HMRC for Making Tax Digital: your National Insurance number and HMRC connection tokens (both stored encrypted), the figures you submit and HMRC’s receipts. HMRC requires technical details about your device and connection (such as IP address, browser, screen size and a device identifier) to be sent with each submission for fraud prevention. Figures are only sent to HMRC when you press submit.
• Survey answers — if you answer our market survey: your answers and, only if you choose to give it, your email address.
• Android app — the HAMAR® app on Google Play shows the same service and collects nothing extra. It sets one small cookie so the service knows it is running inside the app.

3. Why we use it (lawful bases under UK GDPR)

• To provide the service — performance of our contract with you.
• To send transactional emails (verification, quote/invoice notifications, chase reminders, welcome) — performance of our contract with you.
• To prevent fraud and abuse — our legitimate interests in keeping the service safe.
• To improve the service based on usage patterns and bug reports — our legitimate interests, balanced against your privacy.
• To comply with HMRC record-keeping rules — legal obligation.

We do not sell your data to anyone. We do not use it for advertising, profiling for marketing, or share it with brokers.

4. Sub-processors

HAMAR uses these third-party services to operate. Each is contractually bound to handle your data in line with UK GDPR:

HMRC is not a sub-processor. When you submit a Making Tax Digital update or VAT return, HAMAR sends it to HMRC on your instruction, and HMRC is responsible for it from then on.

Where data leaves the UK/EU (e.g. to Resend in the US), it moves under Standard Contractual Clauses providing equivalent protection.

5. How long we keep it

• Account data (clients, quotes, invoice content, notes, business profile, uploaded logo) — for as long as your account is active. If you cancel your subscription, this data is kept on ice for 60 days so you can pick up where you left off if you return.
• At the end of the 60-day window we email you a ZIP file containing a complete copy of your business records (quotes, invoices, clients, line item templates, logo, business profile) for your own record-keeping. After we’ve sent it, we remove our copy. You always end up with your data — we never delete without handing it back first.
• Financial records (invoices, payments) — anonymised at the 60-day mark but retained for 6 years from the end of the relevant financial year, in line with HMRC requirements. The retained record is stripped of personal data — it exists only to satisfy our tax-compliance obligations.
• Bug reports — retained for 12 months for analysis and product improvement, then anonymised.
• Server logs — typically retained by Vercel for 30 days.

6. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify inaccurate data — most can be done directly in the app under Settings → Business profile.
• Erase your data ("right to be forgotten") subject to our HMRC retention obligation for financial records.
• Restrict or object to certain processing.
• Data portability — quotes, invoices, and clients are exportable as CSV at any time from inside the app.
• Withdraw consent where processing is based on consent.
• Complain to the ICO — the UK Information Commissioner's Office at ico.org.uk.

To exercise any of these, email hello@hamar.io. We'll respond within one calendar month.

7. Cookies & tracking

HAMAR uses essential cookies only to keep you signed in (Supabase auth session) and remember your preferences. We do not use third-party advertising cookies and do not share your data with ad networks.

Analytics on marketing pages. We run two lightweight, privacy-respecting tools on hamar.io, /pricing, /terms, and /privacy (never inside your signed-in HAMAR account):

• Vercel Analytics - cookieless, aggregate page-view measurement. No personal data is collected, so there is nothing to opt out of.
• Microsoft Clarity - session recording for UX improvement. Passwords, payment fields, and inputs marked sensitive are automatically masked in the recording.

To opt out of Clarity, use any privacy-focused browser extension - uBlock Origin, Privacy Badger, and DuckDuckGo Privacy Essentials all block it by default. Clarity does not run inside the signed-in app (dashboard, quotes, invoices, settings) - only on the public marketing pages listed above.

8. Security

All data is encrypted in transit (TLS) and at rest (AES-256). Passwords are hashed with bcrypt by Supabase Auth. Access to the production database is restricted to the authorised administrator and audited.

In the event of a data breach affecting your personal data, we'll notify you and the ICO within 72 hours of becoming aware, in line with UK GDPR Article 33.

9. Young users (13-17)

HAMAR welcomes 13-17 year-olds running their own ventures — Young Founders. We take extra care with their data:

• Under-13s: we do not accept signups and do not knowingly collect personal data from under-13s, in line with the UK GDPR digital age of consent.
• 13-15 year-olds: we require verified consent from a parent or legal guardian before activating the account. The parent’s email address is collected only to send the approval link; we don’t use it for marketing or share it with third parties. Approval is recorded in a parental_approvals table with a unique token and timestamp.
• 16-17 year-olds: can sign up directly under standard UK GDPR rules. Card payment features (Stripe Connect) remain locked until they turn 18, per Stripe’s own terms.
• Same retention rules apply: 60-day cancellation grace + ZIP-return + HMRC anonymisation, as described in section 5 above. Young Founders are not treated as a separate data category for retention purposes.
• Parents/guardians’ rights: can request access to or deletion of their child’s account by emailing hello@hamar.io with evidence of their relationship to the account holder.

10. Making Tax Digital (HMRC)

If you choose to connect HAMAR® to HMRC for Making Tax Digital, we store the access granted by Government Gateway and your National Insurance number, both encrypted, so that we can send your quarterly updates when you ask us to. We send HMRC the totals you approve on screen, never your individual invoices, clients or receipts. Every update you send is kept as a record for five years, as HMRC requires, even if you later close your account.

The law also requires software like ours to send HMRC fraud-prevention information with every request: your public IP address, the time zone, screen size, browser and operating system of the device you use, a random identifier we set in a cookie to recognise that device, whether you use two-factor authentication with us, and the version of HAMAR® in use. We collect this only at the moment you take an HMRC-related action, and it goes to HMRC alone. You can read HMRC’s own description of this at gov.uk under “Fraud prevention headers”.

You can disconnect HMRC at any time from Settings. Doing so deletes the stored access; records of updates already sent are retained as above.

11. Changes to this policy

Material changes to this policy will be communicated by email before they take effect.