Privacy policy

1. The short version

We collect what we need to run an invoicing product and nothing else. We do not track you, we do not run advertising, we do not sell or rent personal data to anyone, and we never see your card number. There is no analytics package in Small at all — no page-view tracking, no session recording, no third-party tags.

2. Two different roles, and which one applies

This matters more than anything else here, because it decides who you ask when you want something changed or deleted.

For your own account, we are the controller. Your email address, your business details, your subscription — we decide how those are handled, and this policy governs them. Ask us.

For the people you invoice, we are a processor. When a business types a customer’s name, email and amount into an invoice, that customer’s data belongs to that business’s relationship with them, not to ours. We hold it and act on it — storing it, rendering the invoice, sending it where we are told to — on that business’s instructions and for no purpose of our own. If you have been invoiced through Small and want your details corrected or erased, ask the business that invoiced you. They can do it themselves in the product, and we will help them if they ask.

3. What we collect

From the person signing up: an email address. That is the whole of it — sign-in is by emailed link, so there is no password to store, and we ask for no name, phone number or date of birth.

From the business: the organization’s name, address, contact details and tax registration number, used to render them onto its invoices; its chosen currency and settings; the members it invites; and any API keys it issues.

Entered by the business about its own work: clients and their contact details, projects, tasks, tracked time, invoices and their line items, schedules for recurring invoices, credit notes, and the record of payments, refunds, disputes and reminders against each invoice.

Generated by using it: server logs from our hosting provider, which include IP addresses and are kept for a short period for security and debugging; and the record of which reminders were sent, so the same one is not sent twice.

We do not collect card numbers. Payment details are entered on Stripe’s own hosted checkout and never reach our servers. We receive back the fact of a payment, its amount, and Stripe’s identifiers for it.

4. Why we process it, and on what basis

To provide the service — creating and sending invoices, tracking time, collecting payment, running your subscription. This is processing necessary to perform our contract with you.

To keep the service working and secure — logs, rate limiting, investigating abuse, and fixing things that break. Our legitimate interest in running a service that is not broken or under attack.

To email you about your own account: sign-in links, invoices you sent, reminders you configured, billing notices. Necessary to perform the contract. We do not send marketing email, so there is no marketing list to be on or to leave.

To meet legal obligations — keeping records of what was invoiced and paid, for tax and accounting.

5. What we never do

We do not sell, rent or trade personal data. We do not share it for anyone else’s advertising, and we run none of our own. We do not profile you, we do not build an advertising identity for you, and we do not combine your data with data bought from anyone. We do not use your business’s data, or your customers’ data, to train machine learning models.

6. Who we share it with

Only the companies we need to run the product. Each one gets the minimum the job requires, is bound to handle it on our instructions, and none of them may use it for their own purposes.

• Supabase — hosts the database and runs sign-in. United States (us-east-1).
• Stripe — processes payments and runs the connected account invoices are paid into. United States, with global processing.
• Resend — delivers invoices, reminders and sign-in links. United States.
• Vercel — hosts and serves the application and this website. United States.

Stripe is different from the other three: for the payments you collect, Stripe is an independent controller under its own privacy policy, not merely our processor. Your Stripe connected account is your own relationship with them.

We will also disclose data where the law requires it — a valid court order, for instance — and, if Small is ever sold or merged, to the acquirer, who would be bound by this policy until they gave you notice of a different one.

7. Cookies

Small sets two kinds of cookie and neither one tracks you. One keeps you signed in; the other remembers which organization you are currently looking at, for people who belong to more than one. Both are strictly necessary for the product to work, which is why there is no cookie banner asking for consent we do not need.

There are no advertising cookies, no third-party tracking cookies and no analytics cookies, because there is no analytics.

8. Where your data is held

In the United States. Our database and sign-in run on Supabase in AWS us-east-1; the application is served by Vercel; email goes through Resend; payments through Stripe.

If you are in the United Kingdom or the European Economic Area, that means your data is transferred out of it. Those transfers are covered by the standard contractual clauses our providers offer, and you can ask us for the detail at phil@functionform.co.

9. How long we keep it

While your account is open, we keep your data so the product works — an invoice from three years ago is supposed to still be there.

If you ask us to delete your account, we delete it and its data within 30 days. Two exceptions, and they are real rather than boilerplate: we keep records of what was invoiced and paid where tax and accounting law requires it, and backups age out on their own schedule rather than being rewritten to remove one account. Both are deleted when their period ends.

Server logs are kept for a short period and then discarded.

10. Your rights

You can ask us for a copy of the personal data we hold about you, to correct it if it is wrong, to delete it, to restrict or object to what we do with it, or to receive it in a portable form. You can export your invoices from inside the product at any time without asking.

Email phil@functionform.co. We will answer within 30 days. We do not charge for this and we will not treat you differently for asking.

If you are in the UK or EEA and think we have got something wrong, you may complain to your data protection authority. If you are in California, we do not sell or share personal information as those terms are defined there, and the rights above are the ones you would otherwise be exercising.

Remember section 2: if your data is in Small because a business invoiced you, the business decides, and the fastest route is to ask them.

11. Security

Data is encrypted in transit and at rest by our providers. Access to production data is limited to those who need it. Each organization’s data is isolated at the database level by row-level security, so one business cannot read another’s even if the application asked it to.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data we will tell you, and any regulator we are required to tell, without undue delay.

12. Children

Small is a tool for businesses and is not offered to anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, write to phil@functionform.co and we will delete it.

13. Changes to this policy

If we change this policy materially — adding a subprocessor, or using data for something new — we will email you at least 30 days before it takes effect. The date at the top of this page is what to check it against.

14. Contact

Function Form LLC
10912 Serenbe Lane, Palmetto, GA 30268
Privacy and legal notices: phil@functionform.co
Support: phil@functionform.co