Legal

Privacy Policy

Effective date: 17 September 2026 · Last updated: 4 November 2026

This Privacy Policy explains how OFSYRA LTD ("OFSYRA," "we," "us," or "our") handles information in connection with the OFSYRA Invoice application ("OFSYRA Invoice," the "App"). It describes what the App actually does, so that you know exactly what to expect.

OFSYRA Invoice relies on a number of services provided directly by Apple Inc. to operate — including iCloud/CloudKit, Sign in with Apple, the App Store/StoreKit, and the Mail app and iOS's native share sheet. Throughout this Policy, we distinguish between what OFSYRA itself does with your information and what Apple (or, where you choose it, another app you share to) does independently. If you choose to contact us for support, our email service is provided by Microsoft — see Section 17.

If you have questions about this Policy, contact us at privacy@ofsyra.com.

Using OFSYRA Invoice on Android? Read the separate Android Privacy Policy, including its optional Meta and TikTok measurement choices. The Apple-specific terms below apply to the Apple app.

1. Who we are

OFSYRA Invoice is developed and operated by:

OFSYRA LTD 66 Paul Street London, EC2A 4NA United Kingdom Company number: 17464477

OFSYRA Invoice is an invoicing application for iPhone and iPad, designed to help sole traders, contractors, and limited companies create, send, and track invoices.

2. What data OFSYRA Invoice collects

OFSYRA Invoice stores the information needed for your account and invoicing features. Optional advertising measurement involves the separate, limited information described in Section 10. For the invoicing features:

When you sign in, using Sign in with Apple, we receive and store a unique identifier for your Apple ID and, if you choose to share it, an email address (which may be a real address or an address Apple generates on your behalf to protect your actual email — see Section 5). We do not request your name.
When you set up your business profile, we store the business details you enter yourself: legal/trading name, address, contact email and phone, company number, VAT registration status and number, default payment terms, and — if you choose to add one — a business logo image. We also store any bank details (sort code, account number, IBAN, BIC/SWIFT) you enter to appear on your invoices.

The business and invoice information above is supplied by you or through the Apple sign-in flow; Meta does not receive it through advertising measurement. Optional measurement can send app activity and technical device information automatically after your consent (Section 10). Support messages are handled separately (Section 17).

3. Invoice, customer and business information

As you use OFSYRA Invoice, it stores the records you create in the ordinary course of invoicing your own customers, including:

Customer records you add: name, contact person, email, phone, address, company number, VAT number, and any payment-terms override.
Invoice records: invoice numbers, dates, status, notes, VAT details, and line items (description, quantity, unit, price, VAT rate).
Email activity: a record of each time you send an invoice through Apple Mail, including the To, CC, and BCC recipient addresses (BCC automatically includes a copy to your own sender address), the subject line, the full message text, the date and time, and the outcome (handed off to Mail, sent, cancelled, or failed). If you instead use the "Share Invoice" option described in Section 7, that is recorded differently, or not at all — see that section.
Attachments: the PDF generated for each invoice, and any supporting documents you choose to attach (such as receipts, timesheets, or scanned documents).

This information is entered by you and relates to your own business and the customers you invoice. You control what is entered and edited, and — as described in Section 16 — what is deleted, including your entire account and all of this data if you choose to.

4. How data is stored and synchronised with iCloud/CloudKit

The business, customer and invoice data described in Sections 2 and 3 is stored locally on your device first, and is also synchronised using Apple's CloudKit service to a private database associated with your own iCloud account.

A few important points about this:

OFSYRA does not operate its own servers to store or process this data. There is no separate OFSYRA-run database — your data is held on your device and, via Apple's CloudKit infrastructure, in your own private iCloud storage.
Your private CloudKit database is scoped to your Apple ID. It is not pooled, aggregated, or made visible to other users of the App.
Synchronisation happens automatically between your own devices signed in with the same Apple ID, so your invoices and settings stay up to date across, for example, an iPhone and iPad. The same automatic mechanism is what carries account deletion through to your private CloudKit database — see Section 16.
Apple's own handling of CloudKit data is carried out by Apple as an independent party, under Apple's own privacy policy — not this one.

5. Sign in with Apple

OFSYRA Invoice requires you to sign in using Sign in with Apple before you can use the App. When you do:

We request only your email address. We do not request your name.
If you choose to hide your email from us, Apple provides a private relay address instead, and that is what we store — we cannot see your real email address in that case.
We store the unique identifier Apple assigns to your Apple ID for use with this App, and whichever email address (real or private relay) Apple discloses to us.
We do not receive or store your Apple ID password, or any authentication token or credential — Sign in with Apple is handled entirely by Apple's own systems, and OFSYRA Invoice only ever receives the identifier and email described above.
To check that your sign-in is still valid, the App periodically asks Apple to confirm the status of your Apple ID credential for OFSYRA Invoice. This check sends only the stored identifier to Apple.

6. Keychain/sign-in information

OFSYRA Invoice stores one small piece of information in your device's Keychain: a flag recording that you are signed in, referenced by your Apple ID identifier. This entry:

Is stored only on the device you are using — it is explicitly configured not to sync via iCloud Keychain and not to transfer to any other device.
Contains no password, token, or credential of any kind.
Is deleted from that device when you sign out (Section 16), and is also deleted, as the final step, once an in-app account deletion has completed successfully (Section 16).

7. Emailing invoices through Apple Mail, and sharing when Mail isn't available

When you send an invoice, OFSYRA Invoice's primary method is unchanged: it prepares the email (recipients, subject, message, and attachments) using the information you've entered, and hands it to Apple's built-in Mail composer.

OFSYRA Invoice does not send the email itself and does not operate or contact any mail server. Once you tap Send inside the Mail composer, delivery is handled by iOS Mail, using whichever email account you have configured on your device (which may be Gmail, Outlook, iCloud Mail, or another provider of your choosing).
A copy of every invoice email is automatically sent to your own declared sender address (a "self-BCC"), so you have a record in your own inbox.
Because OFSYRA Invoice hands the message to the system Mail composer, it can only record whether the message was handed off, sent, cancelled, or reported as failed by that composer — it cannot confirm actual delivery to, or receipt by, your customer.

If Apple Mail isn't set up on your device, OFSYRA Invoice offers a "Share Invoice" option instead of a dead end. This opens Apple's native iOS share sheet, from which you can send the invoice PDF and any supporting attachments to any destination available on your device — for example Messages, AirDrop, Files, Mail (if you open it that way), or a third-party app you have installed.

A share is not treated as an email send. It is not recorded in your invoice's email activity log the way a Mail send is, and it never changes an invoice's status to reflect a confirmed send.
OFSYRA Invoice cannot confirm what happens after you share — whether the file was actually delivered, opened, or received by anyone — in exactly the same way, and for the same reason, that it cannot confirm delivery of an emailed invoice.
OFSYRA does not operate, control, or have a relationship with whichever destination you pick from the share sheet. The share sheet itself is provided by Apple; which app or service receives your file is entirely your own choice at the moment you share it, the same way choosing which email provider to send through is your choice, not ours.

8. Attachments and invoice PDFs

Invoice PDFs are generated entirely on your device, from the invoice and business information described in Sections 2–3. No external service is contacted to generate a PDF.

Any files you choose to attach to a send — a receipt, a timesheet, a photo, or a scanned document — are stored by the App in the same way as your other invoice data (Section 4): locally, and synchronised via your private CloudKit database. These are the same PDF and attachment files offered through Apple Mail or the "Share Invoice" fallback described in Section 7.

9. Subscriptions and payments through Apple

OFSYRA Invoice offers a free tier and an optional paid subscription ("Pro"), processed entirely through Apple's App Store (StoreKit):

OFSYRA does not see or store your payment card details. All purchases are handled directly by Apple's App Store, independently of OFSYRA.
The App checks your subscription status directly with Apple. For optional advertising measurement, it also stores transaction identifiers locally to avoid recording the same paid subscription event twice on that device. These identifiers are not added to Meta event parameters. This local record is separate from Apple’s subscription status and does not determine your entitlement. See Section 10.
Apple's own handling of your payment information and purchase history is carried out under Apple's own privacy policy and Media & Purchase terms.
Deleting your account does not cancel or affect an active subscription. Because your subscription is managed entirely by Apple and not by OFSYRA, account deletion within the App has no effect on it — see Section 16.

From version 1.0.7, a separate optional Apple ad measurement feature may also send Apple's signed transaction record to our dedicated service to verify a first paid Pro purchase. It does not send payment card details or change your subscription access. This is separate from Meta measurement; see Section 10.

10. Analytics, advertising and tracking

Advertising measurement is optional and is available in Meta-enabled versions from 1.0.3. Earlier public versions do not use Meta advertising measurement. With your permission, OFSYRA Invoice uses Meta’s app-events software to help measure advertising for OFSYRA Invoice.

If you allow tracking through Apple’s permission prompt, the App sends activation information and verified paid Pro subscription events to Meta. These may include the Pro product identifier, the actual purchase amount and currency, your device’s advertising identifier, and technical information needed to process the events, such as the app version, device information and network address. Meta may infer an approximate location from that network address; the App does not request location permission or supply precise GPS location to Meta. Meta may link this information with information from its other services to attribute and measure advertising, improve ad delivery and personalise content, including ads, under its Business Tools Terms and Privacy Policy. We do not display third-party advertisements inside OFSYRA Invoice.

Your invoice contents, customer details, business details, bank details, attachments, email contents and Sign in with Apple identity are not included in these events. In-app revenue charts continue to be calculated from your own invoice data on your device.

You can refuse permission and continue using all of the App’s features, including Pro. You can change your choice in your device’s Settings under Privacy & Security → Tracking. We check permission before initialising Meta’s SDK and before recording or requesting transmission of events. Withdrawal stops new app-initiated event submissions; it does not recall information already transmitted to Meta.

We rely on your consent for this optional advertising processing. You can withdraw it in the tracking settings described above without losing any invoicing features or Pro access. Automatic event logging, automatic purchase logging, UI indexing, advanced matching and SDK crash telemetry are disabled in this integration. Apple may therefore display privacy information declared by the SDK for capabilities that this app has disabled. The App does not send your support correspondence to Meta.

Meta’s Business Tools Terms state that Event Data may be retained for up to two years. Its Privacy Policy explains its handling of information: https://www.facebook.com/privacy/policy/. Deleting your OFSYRA account clears the local measurement deduplication record but does not automatically delete information already held by Meta. You may contact privacy@ofsyra.com about your rights and requests; Meta’s own privacy controls are also available through its services. Business Tools Terms: https://www.facebook.com/legal/technology_terms.

Apple may separately provide anonymised crash and performance reports through its developer tools if you have chosen to share analytics with app developers in your device settings.

Optional Apple ad-to-subscription measurement — from version 1.0.7

Some app versions from 1.0.7 offer a separate, optional Apple ad measurement choice on iPhone and iPad. If you allow it, OFSYRA uses Apple AdServices and a dedicated service hosted by Cloudflare to link the Apple ad source to a verified first paid Pro purchase. This uses campaign, ad-group and keyword information where Apple supplies it, placement, download or redownload, click or impression claim, and an interaction time when available. A random installation reference and random purchase-linking reference connect the source to a later eligible purchase. These references are specific to that installation and are not your Apple sign-in identity or advertising identifier.

For an eligible first paid Pro purchase, the app sends Apple’s signed subscription transaction record for verification. The service verifies Apple’s signature and stores only the necessary source, purchase date, actual gross price and currency, random linking reference and keyed transaction hashes for deduplication. It does not store raw attribution tokens or signed transaction records in the reporting database. Sandbox purchases, renewals and earlier or restored subscriptions do not count as new paid subscribers. It does not send these measurement records to Meta.

No invoice contents, customer records, business details, bank details, attachments, emails, payment card details, Sign in with Apple identity or IDFA are included in this measurement. Cloudflare processes the dedicated service and database for OFSYRA; network services process technical connection information to deliver requests. Application request-body logging is disabled, and network addresses are not written to the measurement database.

We rely on your separate consent for this optional measurement. You can decline without losing invoicing or Pro, or turn it off in Settings → Apple Ad Measurement. This choice does not change your Meta tracking permission. Turning measurement off stops new collection, clears the protected local queue of unsent purchases and requests deletion for this installation. If you are offline or the service is unavailable, deletion is retried when you reopen the app online. Account deletion also requests this installation’s measurement deletion. Repeat this on other devices if you opted in there; the references are not linked through your Apple sign-in. Uninstalling alone cannot send a server deletion request.

Service records are kept for up to 90 days. The app’s protected offline purchase queue is excluded from backup and expires after 30 days. Private company reports contain totals by ad source, not installation references or signed receipts. The full data flow, provider information, retention and choices are explained in the Apple Ad Measurement Privacy supplement. Earlier app versions do not include this integration.

Optional Google install and app-activity measurement — from version 1.0.11

When available on iPhone or iPad, Google measurement is off until you make a separate optional choice in the App and allow Apple tracking permission. An earlier choice for Meta or TikTok does not enable Google measurement. Refusing this choice does not affect invoicing, sign-in, iCloud or Pro access.

With that permission, Google Analytics for Firebase receives a random app-instance identifier, app version, device and operating-system information, app opens, session and engagement activity, and network information from which approximate location may be inferred. Its software may also collect App Store purchase events, including the product identifier, amount and currency. We do not provide invoice or quote contents, customer details, business or bank details, attachments, names, email addresses, Apple sign-in information or payment-card details to Google through this feature. Automatic screen-view reporting is disabled. This integration does not collect the Apple advertising identifier (IDFA) or vendor identifier (IDFV).

We use this information to measure OFSYRA Invoice advertising and understand app activity. The Google Analytics property is linked to our existing Google Ads account for conversion measurement, with personalised advertising disabled. Optional sharing for improving Google products, benchmarking, technical support and account specialists is disabled. We do not supply customer lists or contact details, and we do not use this connection to display third-party ads inside the App.

Google’s standard first_open event records the first time an app installation runs with Analytics enabled; it is not, by itself, proof of a new App Store download or a new customer. Enabling the feature through an update, reinstalling the App or consenting later can affect these figures. Google Ads uses its own attribution rules to report advertising results. We compare those results separately with App Store download and redownload reports rather than treating all SDK events as new downloads. Refusing measurement, later consent, platform privacy restrictions and reporting delays may limit attribution.

You can switch this feature off under Google advertising measurement in the App’s Settings or withdraw Apple tracking permission. Withdrawal stops new collection and resets the local Analytics identifier; it cannot recall data already transmitted. We rely on your consent for this optional processing. You can contact privacy@ofsyra.com about your privacy rights. Google provides the service under the Google Analytics terms and applicable data-processing terms. Processing may take place outside the United Kingdom under Google’s applicable safeguards. Read Firebase privacy information and Google’s Privacy Policy.

Apple’s private aggregate install attribution — from version 1.0.11

The App also registers first launch with Apple’s SKAdNetwork using an install-only conversion value. Apple validates eligible advertising attribution and sends privacy-preserving postbacks to participating ad networks. This mechanism does not require Apple tracking permission and is separate from the optional Meta, TikTok and Google SDK choices. We do not provide an advertising identifier, app-instance identifier, invoice or customer information in this registration, and do not create ad clicks or manually invent install postbacks. Apple determines attribution, privacy thresholds and delayed reporting. Aggregate attribution may therefore continue when optional SDK measurement is refused; it is not a named-user download list.

11. Data security

We take a number of technical measures to help protect your information:

Your data is stored on your device using file protection that keeps it encrypted while your device is locked and has not yet been unlocked since it was last restarted.
Your data syncs to a private CloudKit database tied to your own Apple ID, rather than to a shared or publicly accessible database.
Your sign-in Keychain entry is stored using device-only accessibility, and is never synced or backed up off your device.
We do not store your Apple ID password, authentication tokens, or payment card details at any point.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

12. Data retention

OFSYRA Invoice does not apply any automatic expiry or deletion period to your invoicing data. Your business, customer, invoice, and email-activity records are retained for as long as you continue to use the App with your account.

You control when data stops being retained: you can delete an individual Draft invoice at any time (Section 16), or delete your entire account and all associated data at once using the in-app Delete Account feature described in Section 16. Outside of one of those actions, signing out does not delete anything (see Sections 6 and 16), and data otherwise remains stored on your device and in your private CloudKit database until you sign back in or uninstall the App.

Messages you send to us for support (Section 17) are not part of your App data. They are kept in our email mailbox, not on your device or in iCloud, and are retained and reviewed as described in Section 17. Deleting your account does not delete them; you can ask us to delete them at privacy@ofsyra.com.

The optional Apple measurement service has a separate retention limit of up to 90 days; its protected local unsent-purchase queue expires after 30 days. Turning it off requests installation-scoped deletion, with retries when the app reopens online. This does not change retention of your private invoice records. See Section 10 and the Apple measurement supplement.

For optional Google measurement, our Google Analytics property is configured for two-month user- and event-data retention, with reset on new user activity disabled. Google states that changes take effect after 24 hours. These controls do not cover most aggregated standard reports or information separately retained by Google Ads under its applicable terms. Turning measurement off stops new collection and resets the local Analytics identifier; it does not automatically delete data already received by Google.

13. Data sharing and third parties

We do not sell your invoice or customer data. If you consent to advertising measurement, we share the limited app activity, Pro purchase and device information described in Section 10 with Meta for advertising measurement.

Apple provides CloudKit (data storage and sync), Sign in with Apple (authentication), StoreKit/the App Store (subscriptions), and Apple Push Notification service (background sync). Meta provides optional advertising measurement described in Section 10. It does not receive access to your invoice database or private iCloud storage through this integration.

Our support mailbox is a separate matter. If you choose to email us or send a problem report (Section 17), your message is received by an email service hosted by Microsoft, which acts as our service provider for that purpose only. Microsoft is not involved in operating the App and has no access to the data held on your device or in your private iCloud storage.

Separately, when you choose to send an invoice — whether by email or by using the "Share Invoice" option (Section 7) — delivery or handling from that point on is carried out by whichever email provider or app you have chosen. That destination is selected by you, not by us, and is not a service we contract with, integrate with, or control. (This is distinct from "Share Invoice" being a feature name — it does not mean OFSYRA itself shares your data with anyone; it means the App hands a file to Apple's own share sheet at your direction.)

For the separate optional Apple measurement in supported versions, Cloudflare provides the dedicated reporting service and database as our service provider. Apple supplies attribution and signed transaction verification. Cloudflare does not receive your private invoice database, customer records or Apple sign-in identity through this feature. See Section 10.

In supported versions, Google provides the separate optional install and app-activity measurement described in Section 10, and TikTok provides the separate optional measurement described below. Neither integration receives access to your private invoice database or iCloud storage.

14. International data processing

For your invoicing data, OFSYRA does not itself select or configure the country or region in which it is stored or processed. Storage and processing via CloudKit, Sign in with Apple, and StoreKit are carried out by Apple, according to Apple's own global infrastructure and the region/country settings associated with your Apple ID and iCloud account.

As a UK company using Apple's global services, your information may be processed outside the United Kingdom as a result. We are not in a position to specify the particular countries or data centres involved, as this is determined by Apple. For details of how and where Apple processes data on our behalf, please refer to Apple's own privacy documentation.

If you contact us by email, your message is processed by Microsoft, our email provider, which may process it outside the United Kingdom — see Section 17.

If you consent to advertising measurement, the information described in Section 10 may be processed outside the United Kingdom, including in the United States. Meta’s Business Tools Terms identify Meta Platforms, Inc. for UK processing, and incorporate Data Processing Terms, a UK Controller Addendum and a UK Data Transfer Addendum. Its role depends on the activity: measurement services may involve processing on our behalf, while collection and transmission for ad delivery may involve joint control, and subsequent uses may be under Meta’s independent control. You can read the applicable terms at https://www.facebook.com/legal/technology_terms, https://www.facebook.com/legal/terms/uk_controller_addendum and https://www.facebook.com/legal/terms/UK_Data_Transfer_Addendum. Meta’s Privacy Policy describes its international processing and safeguards.

For the optional Apple measurement service, Cloudflare network processing may take place outside the United Kingdom. We selected a Western European location for the dedicated reporting database; this does not restrict all network processing to that location. Cloudflare’s Privacy Policy and Customer Data Processing Addendum describe its processing and applicable transfer safeguards. See the measurement supplement.

15. Children's privacy

OFSYRA Invoice is a professional invoicing tool intended for business owners, sole traders, contractors, and companies. It is not directed at, and is not intended to be used by, children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@ofsyra.com so we can address it.

16. Your privacy rights

Deleting individual records: OFSYRA Invoice lets you permanently delete a draft invoice (and its line items) before it has been sent. This deletion is immediate and cannot be undone.

Signing out: You can sign out of OFSYRA Invoice at any time from Settings. Signing out removes only the local sign-in flag from your device (Section 6) — it does not delete your business, customer, invoice, or other data, which remains stored on your device and in your private CloudKit database, ready for when you sign back in. Signing out is not the same as deleting your account — if you want your data deleted, use Delete Account, described next.

Account deletion: OFSYRA Invoice provides an in-app Delete Account feature (Settings → Delete Account). Because this permanently removes your data, the App requires you to confirm before anything is deleted. Once confirmed:

The App deletes your invoice records first. Removing an invoice also removes the line items, email activity history, and attachments that belong to it, through the same deletion process the App already uses when you delete an individual draft invoice.
Your customer records, declared sender identity, business profile, and account record are then deleted.
This is carried out as a single local data operation where possible — either the deletion completes in full, or (if something prevents it from completing) none of it is applied, so your data is never left partially deleted.
Only once that local deletion has completed successfully does the App remove the Apple sign-in entry from your device's Keychain (Section 6) and sign you out, returning you to the sign-in screen.
Because your data syncs to your private CloudKit database (Section 4), the same automatic synchronisation that keeps your devices up to date also carries the deletion through to CloudKit once it's committed on your device. This happens through Apple's own infrastructure in the background; we are not able to state a specific time by which that synchronisation completes, or to independently confirm from our side that it has.
Account deletion does not cancel or delete any Apple subscription. Your subscription (if you have one) is managed entirely by Apple through the App Store/StoreKit and is unaffected by deleting your account in OFSYRA Invoice. If you have an active subscription, the App tells you this before you confirm deletion, and you'll need to manage or cancel it separately through your Apple ID's subscription settings if you no longer want it to renew.

Other requests: UK data protection law gives you certain rights over your personal data, including rights to request access to, correction of, deletion of, or a copy of your data, and to object to or restrict certain processing. For any of these — including requesting deletion by a route other than the in-app feature above, for example if you're unable to use the App itself — please contact us at privacy@ofsyra.com. We do not currently have an automated process for requests made this way, so we handle each one manually and respond to you directly. These rights also apply to any support messages we hold from you (Section 17).

Apple measurement choices: In versions offering this feature, Settings → Apple Ad Measurement lets you withdraw consent and request deletion for this installation. Reopen the app online for a pending deletion request to retry; repeat on each device where you opted in. These references are not tied to your Apple sign-in or email address. The measurement supplement explains the data and retention. You can also contact privacy@ofsyra.com about your rights.

17. Contacting support and sending a problem report

You can contact us at any time by emailing support@ofsyra.com, or from inside the App using Settings → Report a Problem. Contacting support is always your choice: no support message is sent automatically. Optional advertising measurement is a separate flow described in Section 10.

What Report a Problem does. You describe the problem in your own words. Before anything is created, the screen shows you the only three technical details the App will add to your message:

the App's name, version and build number;
your device's model identifier (for example "iPhone17,1") and whether it is an iPhone or an iPad; and
your iOS version.

The App then opens an email in Apple's Mail composer, addressed to support@ofsyra.com, containing your description followed by those three details under a heading that tells you they can be edited or deleted. The App does not send the email. Nothing leaves your device until you review the email and tap Send. If Apple Mail isn't set up, the App offers Apple's share sheet instead (as described in Section 7), or lets you copy our support address; what happens next is then entirely your choice.

What is never added. The App never adds your invoices, customers, business details, bank details, attachments, Apple ID or sign-in details, iCloud account, subscription plan, the name of your device, or any advertising or other identifier for your device. It never attaches screenshots, logs or files, and it never copies anyone else on the email. You can delete the three technical details before sending, or write to us without using the feature at all.

Please keep sensitive information out. Please don't put passwords, card numbers, bank details or other sensitive information in your message. You can describe a problem with an invoice without naming your customers.

What we receive. If you send us a message, we receive: the message you write; whichever of the three technical details you left in; the email address you sent it from and the sender name set in your email account (these are added by your email service, not by the App); the date and time; and anything else you choose to include in the message or in later replies, such as attachments you add yourself.

How we use it. We use support messages only to understand and answer your request, to investigate and fix problems in the App, and to keep a record of the conversation. We do not use them for advertising or marketing, we do not use them to build profiles, we do not sell them or share them with advertisers or data brokers, and we do not add them to advertising measurement or analytics systems. Our legal basis under UK data protection law is our legitimate interest in responding to the request you chose to send us and in keeping the App working reliably.

Microsoft's role. Our email, including support@ofsyra.com and privacy@ofsyra.com, is hosted by Microsoft Corporation through Microsoft 365 (Exchange Online). Microsoft therefore stores and processes the support emails we receive and the replies we send, on our behalf, as our email service provider (our "processor"), under Microsoft's data protection terms, which require Microsoft to keep your messages secure and to process them only on our instructions, so that they receive protection equivalent to what this policy describes. Microsoft processes the content of those emails to provide the email service to us; it also handles limited technical information about running its own service for its own purposes, under Microsoft's own privacy statement. Microsoft has no role in operating the App and no access to the invoice, customer and business data held on your device and in your private iCloud storage. Your message also passes through your own email provider (for example the account you use in Apple Mail), which is your choice and outside our control.

Where it is processed. The location in which Microsoft hosts our mailbox depends on our Microsoft 365 account and on Microsoft's own infrastructure, so your message may be processed outside the United Kingdom. Where that happens, we rely on the transfer safeguards Microsoft provides under its data protection terms. For details, please refer to Microsoft's own privacy and data protection documentation.

How long we keep it. We keep support and privacy correspondence while needed to resolve your enquiry, handle related follow-up or complaints, or meet applicable legal obligations. This applies to messages sent to support@ofsyra.com, including problem reports from the App, and to privacy@ofsyra.com. We do not apply an automatic deletion period tied to the date your request is resolved. We periodically review correspondence and delete personal information that is no longer needed, subject to the reasons for retaining information described below.

Support messages are kept separately from your App data. They are held in our email mailbox, not on your device or in iCloud, so deleting your account in the App (Section 16) does not delete them. We do not copy or forward support messages to other mailboxes or systems; if we need to record a technical problem elsewhere (for example in a list of bugs), we leave out your name, your email address and your message.

How we delete it. Our review and deletion of support and privacy correspondence is carried out manually. When a conversation is no longer needed, we delete its messages and attachments from the relevant folders in our Microsoft 365 mailbox. Deleted messages may remain temporarily recoverable in Microsoft 365. Their final removal depends on the mailbox's recovery settings and any applicable retention or hold requirements.

Asking us to delete sooner. You can ask us to delete your support messages at any time by emailing privacy@ofsyra.com from the address you used to write to us. We may need to confirm that the request comes from you, for example by replying to that address, before we delete anything. We will delete the conversation, subject to the exceptions below, and tell you when it is done, within one month of your request (UK law allows longer for complex requests, and we will tell you if that applies). The recovery and retention conditions described above apply to these deletions too.

When we may keep something longer. We may retain information after an enquiry is resolved, or after you ask us to delete it, where we need it for one of these reasons, and only for as long as that reason lasts:

to establish, bring or defend a legal claim, or because the law, a court or a regulator requires us to;
to investigate abuse, fraud or a security incident affecting the App or our systems; or
to keep a minimal record that you made a request about your information and how we dealt with it (for example the date, the request and what we did), without the content of your messages, so that we can show we complied with the law.

If one of these applies to a deletion request, we will delete everything else and tell you what we are keeping and why. We may also keep a note of the technical problem itself (for example, "the logo picker fails on Mac") without your name, your email address or your message, because that no longer identifies you.

Your rights. The rights described in Section 16 apply to support messages. You can ask us at privacy@ofsyra.com to tell you what we hold, to correct it, or to delete it. If you are unhappy with how we handle your information you can also complain to the UK's Information Commissioner's Office at ico.org.uk.

If you email us without using the App, the same applies to whatever you send, except that the three technical details are included only if you write them yourself.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the App or in applicable law. If we make changes, we will update the "Last updated" date at the top of this Policy. We encourage you to review this Policy periodically.

Optional TikTok install measurement

When available in your version of OFSYRA Invoice on iPhone or iPad, TikTok install measurement is off by default. It starts only if you choose “Allow measurement” in the optional TikTok choice after setup, or switch on “Help measure TikTok installs” in Settings, and allow Apple’s tracking permission. An earlier tracking choice for Meta does not switch TikTok on.

TikTok receives the first consented app-open event for the current App Store or TestFlight distribution, permitted device identifiers, app/device information and SDK operational information for advertising measurement. From version 1.0.11, choices and one-time event records are separated between those distributions. A prior refusal stays off. A prior opt-in is not silently reused for a new distribution-specific measurement choice: confirmation is requested before collection resumes. Withdrawal switches both distribution choices off. TikTok’s SDK diagnostics can include performance measurements and SDK crash reports. We do not supply invoice or quote contents, customer details, account contact details or purchase events to TikTok. Automatic purchase, retention, page and button event collection is disabled.

You can withdraw this optional consent in the App’s Settings or withdraw Apple tracking permission. This does not affect app access, invoices or your subscription. An event queued in the App is not proof of delivery or a new store download; existing users may receive the measurement feature through an update. Known existing users, or installations with an earlier measured or TestFlight event, are sent a first measured launch event rather than another new-install event. New-install events are limited to newly observed installations consenting within 24 hours. This conservative distinction can undercount reinstalls or people who consent later. Platform attribution and store new-download reports are checked separately.

19. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Privacy: privacy@ofsyra.com Support: support@ofsyra.com

Postal address: OFSYRA LTD 66 Paul Street London, EC2A 4NA United Kingdom Company number: 17464477