Slate — Privacy Policy
1. Who we are
Slate is an online invoicing and timesheet tool for independent contractors, operated by Matthew Smith ("Slate", "we", "us"), a sole trader trading as Slate. We operate the website at slateone.co.uk.
We are the controller of the personal data described in this notice, except where section 3 says we act as a processor.
- Contact: hello@slateone.co.uk
- Data Protection Officer: we are not required to appoint one under Article 37 UK GDPR and have not done so. Data protection queries go to hello@slateone.co.uk
2. What this notice covers
How we handle personal data when you visit slateone.co.uk, create and use a Slate account, send invoices or timesheets through Slate, or contact us.
3. Controller and processor — the important distinction
Slate handles two different sets of personal data, and our role differs for each.
Your data — we are the controller. The data you give us to open and run your account, and the data we generate about how you use Slate. Sections 4 to 7 describe this.
Your clients' data — we are the processor. When you enter details of the businesses and people you invoice, and when you send them invoices or timesheets, you decide why and how that data is used. You are the controller of it; we process it on your instructions to deliver the service. Our obligations to you for that data are set out in our Terms of Service, in Schedule 1 (Data Processing Terms). In practice we do not use your clients' data for any purpose of our own beyond operating and securing Slate.
If you are a client who has received an invoice or timesheet through Slate and want to know how your data is used or ask for it to be deleted, contact the contractor who sent it. They control that data. You can also contact us at hello@slateone.co.uk and we will pass your request on.
4. The data we collect
Account and profile data. Your name, email address, password (stored only as a cryptographic hash — we never see it), business or trading name, business address, and where you choose to add them, your VAT number, company number and logo.
Payment details you publish on invoices. The bank account name, sort code and account number you want your clients to pay into. We store these so they can be printed on your invoices. We do not process payments, take card details, or move money. Slate has no payment integration; all payment happens directly between you and your client by bank transfer.
Invoice and timesheet content. Line items, rates, hours, dates, project and role descriptions, notes, totals, and the status and history of each document.
Client records you enter. Company names, contact names, email addresses and billing addresses of the businesses and people you invoice. See section 3 — you are the controller of this data.
Communications. Emails and messages you send us, and our replies.
Technical and usage data. IP address, browser and device type, pages and features used, dates and times of access, authentication events, and error and security logs generated by our hosting and database providers.
We do not collect special category data (health, biometrics, political opinions, religious beliefs and so on) or criminal offence data. Please do not put it into Slate.
5. Why we use it, and our lawful basis
| Purpose | Lawful basis | Retention |
|---|---|---|
| Creating your account, authenticating you, and providing the invoicing and timesheet features | Contract — Art. 6(1)(b) | Life of your account |
| Sending invoices and timesheets to the recipients you choose, and recording delivery status | Contract (to you); processed on your instructions as regards recipients | Life of your account |
| Sending you service emails — sign-up confirmation, password resets, security notices, changes to this notice or our terms | Contract; Legal obligation | Duration of account |
| Keeping Slate secure, investigating abuse or unauthorised access, maintaining audit and error logs | Legitimate interests — protecting the service and its users | Security and access logs: 12 months |
| Fixing bugs and improving Slate, using usage patterns and aggregated statistics | Legitimate interests — running and improving a service our users rely on | 26 months, then aggregated or deleted |
| Responding to your support enquiries | Legitimate interests — answering and evidencing enquiries | 24 months from resolution |
| Our own accounting, tax and business records | Legal obligation — Companies Act, HMRC | 6 years from the end of the relevant financial year |
| Establishing, exercising or defending legal claims | Legitimate interests; Legal obligation | 6 years |
Where we rely on legitimate interests, we have weighed our interest against your rights. You can ask us for a summary of any of those assessments.
If you do not provide it. We need your name, email address and password to give you an account. Business details and bank details are needed only if you want them to appear on your invoices — you can use Slate without them, but your invoices will be incomplete.
6. How invoices and timesheets are sent — please read
When you send an invoice or timesheet through Slate:
- it is emailed to the recipient you choose, from our sending domain, with the reply-to address set to your own email, so replies go to you and not to us;
- the document is attached as a PDF; and
- the email contains a unique web link to view the document online. That link is long and unguessable, but it is not password-protected and does not expire. Anyone who has the link — including anyone the recipient forwards it to — can view that invoice or timesheet.
This is deliberate: corporate accounts payable teams routinely forward invoices internally and need to open them without creating an account. But you should treat the link as sensitive and not publish it anywhere public.
We record that a document was sent, and when.
7. Cookies and similar technologies
Slate uses strictly necessary cookies and browser storage only. These keep you signed in, secure your session and protect against cross-site request forgery. They are set by us and by Supabase, our authentication provider. They are exempt from the consent requirement under PECR because they are essential to a service you have asked for, so we do not show a cookie banner.
We do not use advertising cookies, third-party tracking, or cross-site profiling.
8. Automated decision-making
We do not make any decision about you that produces legal or similarly significant effects based solely on automated processing, and we do not profile you.
9. Who we share data with
We use a small number of service providers. They act on our documented instructions under written contracts meeting Article 28 UK GDPR, and may not use your data for their own purposes.
| Provider | What it does | Data involved |
|---|---|---|
| Vercel | Website and application hosting | All data in transit; technical and request logs |
| Supabase | Database and authentication | Account, invoice, timesheet and client data; authentication events |
| Resend | Sending transactional and invoice emails | Names, email addresses, invoice PDFs and links |
| Professional advisers | Accountants, insurers, legal advisers, as needed | Only as necessary |
| Authorities | HMRC, courts, police, the ICO, where legally required | Only as required |
We do not sell your personal data, and we do not share it with advertisers or data brokers.
If Slate is ever sold, merged or transferred, personal data may transfer to the buyer as part of that transaction. We will tell you beforehand where we can, and the buyer will remain bound by this notice until it gives you a new one.
10. Where your data is stored
Our providers operate internationally, so some data is stored or accessed outside the United Kingdom.
- Supabase (database): our project is hosted in the Frankfurt (eu-central-1) region.
- Vercel (hosting) and Resend (email): these are US-headquartered providers and some processing, including support access and logging, takes place in the United States.
Where personal data leaves the UK we rely on either an adequacy decision, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, incorporated into our contracts with each provider, supported by an assessment that protection in the destination is not materially lower than in the UK. You can request details by emailing hello@slateone.co.uk.
11. How long we keep data
- Your account, invoices, timesheets and client records: for as long as your account is open. If you close your account, we delete or irreversibly anonymise them within 30 days. Export your records before closing — you are legally required to keep your own invoicing records for your tax affairs, and once deleted we cannot recover them.
- Inactive accounts: if an account is unused for [24] months we may email you and then close and delete it.
- Our own business records (accounting, correspondence): 6 years.
- Security and access logs: 12 months.
- Marketing suppression records: kept indefinitely, so that an opt-out stays honoured.
- Backups: deleted data can persist in encrypted backups for up to [35] days before being overwritten.
12. Security
We protect your data using encryption in transit (TLS) and at rest, hashed passwords, row-level security in our database so that one user's records cannot be read by another, restricted administrative access, and monitoring and logging. We keep our dependencies patched and assess vulnerabilities as they are disclosed.
No system is completely secure. If a personal data breach occurs we will assess it without delay, notify the ICO within 72 hours where it is likely to risk your rights and freedoms, and tell you directly where the risk is high.
13. Your rights
You have the right to be informed; to access your data; to have it corrected; to have it erased; to restrict how we use it; to portability — a copy in a structured, machine-readable format; to object to processing based on legitimate interests, and to object to direct marketing at any time, absolutely; and to withdraw consent at any time where we rely on it, without affecting what we did before.
To exercise any right, email hello@slateone.co.uk. We may ask for information to confirm your identity. There is no fee unless a request is manifestly unfounded or excessive. We respond within one month, extendable by up to two further months for complex requests — we will tell you within the first month if we need longer, and if we decide not to act we will explain why.
Many rights you can exercise yourself: you can edit or delete your invoices, client records and account details directly in Slate at any time.
14. Complaining to us
You have a statutory right to complain to us directly if you think we have breached your data protection rights. Email hello@slateone.co.uk with "Data protection complaint" in the subject line. We will acknowledge within 30 days, investigate, keep you updated and tell you the outcome without undue delay.
15. Complaining to the regulator
You can complain to the UK regulator at any time, though we would like the chance to put things right first.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk
16. Age
Slate is a business tool. You must be 18 or over to open an account. Slate is not directed at children, we do not market it to them, and we do not knowingly collect their personal data. If you believe someone under 18 has created an account, email hello@slateone.co.uk and we will delete it.
17. Other sites
Slate may link to third-party websites. We do not control them and are not responsible for their privacy practices.
18. Changes
We keep this notice under review. The version number and date at the top change with every update. Where a change materially affects how we use your data we will email you or notify you in the app at least 14 days before it takes effect.
| Version | Date | Change |
|---|---|---|
| 1.0 | 10/08/2026 | First publication |