Privacy policy

Last updated: 8 October 2026.

1. Introduction

Collect Solutions Ltd (company number 16931356), trading as collects.io ("we", "our" or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit the collects.io website.

For the purposes of UK GDPR and EU GDPR, Collect Solutions Ltd is the data controller for the processing of personal data described in this Privacy Policy, except where section 13 says otherwise.

This Privacy Policy is a transparency notice, not a contract. It applies to this website, to the Google account (Gmail) data we access when you connect a Gmail mailbox (section 12), and to how our platform and its AI service handle data (section 13). If you become a collects.io customer, our customer terms and Data Processing Agreement apply to the data we process for you in the platform.

2. Information we collect

2.1 Information you provide. We collect personal information you choose to give us when you complete a form on this website (enquiry, demo or partner), chat with us through the support chat, email us or call us. This may include your name, email address, company name, role, phone number and anything you write in your message.

2.2 Information collected automatically. When you visit, we collect technical information through your browser and, only if you accept analytics cookies, through Google Analytics and PostHog. This may include browser type and device, operating system, pages visited and time on page, the referring website, campaign parameters in the page address (such as utm_source and a referral code), the user agent, and pseudonymous identifiers set by those analytics tools.

We do not load Google Analytics or PostHog unless you accept analytics cookies. If you decline, we store only your choice.

3. How we use your information

To respond to your enquiry or chat message and communicate with you about it
To understand how visitors use this website so we can improve it
To pass the campaign or referral code you arrived with to our sign-up page, so an introduction is credited correctly
To operate, secure and maintain this website
To comply with legal obligations

Our lawful bases are legitimate interests (responding to enquiries, operating the website, crediting referrals), consent (analytics cookies) and legal obligation.

4. Storage and security

Enquiries you send through our website forms are stored in our customer relationship management system (Attio). The website is hosted by Vercel. We use appropriate technical and organisational measures, including encryption in transit (HTTPS), access to enquiries on a need-to-know basis, and analytics that load only after consent. No method of transmission or storage is completely secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, as UK GDPR Article 34 requires.

5. Sharing

We do not sell, trade or rent your personal information. We share it with these service providers, which process it on our behalf under contractual data-protection obligations:

Google Analytics 4: website analytics, only after you consent. United States (UK IDTA and EU Standard Contractual Clauses).
PostHog: website analytics, only after you consent. EU.
Attio: stores the enquiries you send through our forms.
Intercom: our support chat, including its automated assistant (Fin). Loaded only when you open the chat; it stores your conversation and any details you give in it. EU-hosted.
Vercel: website hosting and delivery. United States and EU (UK IDTA and EU Standard Contractual Clauses).

For Gmail data, see section 12. For data in our platform, including our AI service, see section 13.

We may also disclose information where the law requires it, or to a buyer in the event of a merger, acquisition or sale of assets.

6. Your rights

Under UK GDPR and EU GDPR you can ask to access, correct, delete or move your personal data, object to processing based on legitimate interests, restrict processing, and withdraw consent at any time (including for analytics cookies). Contact privacy@collects.io.

You can complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, your local supervisory authority.

7. Cookies

Analytics cookies are set only with your consent. You can change your choice at any time from Cookie settings in the footer. Support chat cookies are set only when you open the chat. See our Cookie Policy for the full list.

8. How long we keep it

Enquiries and chat conversations: as long as needed to respond, and up to 6 years afterwards for sales and legal records
Website analytics: up to 26 months
Your cookie choice: 12 months, or until you clear it
Gmail data: see section 12
AI service records of each request and result, including message content: 30 days (see section 13)

9. Other websites

This website links to other sites, such as our sign-up page, the Xero App Store and Vimeo. We are not responsible for their privacy practices.

10. Children

This website is not directed at anyone under 18, and we do not knowingly collect their information. If you think a child has given us information, contact privacy@collects.io and we will delete it.

11. International transfers

Some providers above, and some of the sub-processors listed on our Sub-processors page, process data outside the UK and EEA, in particular in the United States. Where they do, we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses or an adequacy decision.

12. Google Account (Gmail) Data

If you connect a Gmail mailbox to Collect, we access it via the Gmail API to provide our core features.

What we collect:

your mailbox email address
up to two years of prior email history when you first connect (subject, body, sender and recipient)
emails sent or received through that mailbox while it remains connected

Why: (1) to automatically match incoming invoices to related email conversations, and (2) to send payment reminder emails on your behalf from your own address.

Storage: When you first connect, we copy up to two years of past email from your mailbox. While the mailbox stays connected, we keep copies of all emails sent and received through it. If you disconnect, we keep this data for up to 30 days. If the mailbox stays disconnected for 30 days in a row, we delete all of it on day 31, including from our service providers' systems and backups. Our AI service's records of emails it has read or written are deleted after 30 days in any case (section 13).

Sharing: We share this data only with the service providers listed on our Sub-processors page (www.collects.io/sub-processors) (for example Nylas, our email infrastructure provider, and Amazon Web Services, our hosting and AI provider), which process it on our instructions. We do not sell this data or share it with advertisers.

Limited Use: Collect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Gmail data for advertising or sell it. We do not use Gmail data to train or improve AI or machine learning models. People can read it only with your consent, for security, to comply with the law, or for our internal operations when it has been aggregated and anonymised.

13. Our platform and AI

When a business uses the collects.io platform, it decides what data the platform holds about its own customers and contacts, and it is the controller of that data. We process that data on the business's behalf, under our Data Processing Agreement. If a business that uses collects.io has contacted you about an invoice, please ask that business first about your data; we will help it respond.

Our AI service runs on Amazon Web Services (Amazon Bedrock). To manage and collect invoices, it receives the business's settings, its invoices, its customers' details and its collections history, including names, email addresses and the content of emails. This data is not hashed or anonymised before it reaches the AI model.

Amazon Web Services does not use this data to train its models. We do not use email data to train or improve AI or machine learning models.

Our AI service keeps a record of each request and its result, including message content, for 30 days, so we can check, explain and correct what it did and keep the service secure. After 30 days the record is deleted.

Say Digital Ltd (trading as MOHARA), a UK company, builds, operates and supports the platform for us.

Every company that processes platform data for us, with its location and safeguards, is listed on our Sub-processors page (www.collects.io/sub-processors).

14. Changes

We will post any change on this page and update the date at the top.

15. Contact

Collect Solutions Ltd (trading as collects.io), company number 16931356, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. ICO registration ZC074860. Email: privacy@collects.io.