Aperture Works Privacy Policy.
CIS Invoice Mobile Application
Aperture Works Ltd
Last updated: 17 April 2026
Introduction
Aperture Works Ltd (“we”, “us”, “our”, “the Company”) is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use:
The CIS Invoice mobile application (“the App”)
Our website at https://cis-invoice.co.uk (“the Website”)
Any services provided through the App, including Making Tax Digital (MTD) submissions to HM Revenue & Customs (HMRC)
This Privacy Policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025.
By using our App, Website, or Services, you acknowledge that you have read and understood this Privacy Policy.
1. Data Controller Information
The data controller responsible for your personal data is:
Aperture Works Ltd Enterprise House, The Courtyard, Old Court House Road Bromborough, Wirral, England, CH62 4UE
Email: info@aperture-works.com Company Registration Number: 16563160
For data protection enquiries, please contact us at info@aperture-works.com.
2. Personal Data We Collect
We collect and process different categories of personal data depending on how you interact with our App and Services. It is important to understand that most of your data remains on your device and is never transmitted to our servers.
2.1 Data We Store (Cloud)
The following personal data is stored on our secure cloud servers:
Data Type | Purpose | Stored With |
Email address | Account identification, authentication, service communications | Supabase (UK) |
Full name | Account identification, personalisation | Supabase (UK) |
Marketing preferences | To manage your communication preferences | Supabase (UK) |
Profile picture | Profile display (Google sign-in only) | Supabase (UK) |
Social Sign-In:
Google Sign-In: We receive and store your email address, name, and profile picture from Google
Apple Sign-In: We receive and store your email address (which may be a private relay address) and name (on first sign-in only). Apple does not provide a profile picture.
Subscription Management (RevenueCat):
To manage your subscription, we share the following with RevenueCat, our subscription management provider:
User ID
Email address
Full name
Subscription status and entitlements
RevenueCat processes this data in the USA (see Section 11 for safeguards).
2.2 Data Stored Locally on Your Device
The following data is processed by the App but stored only on your device. We do not have access to this data, and it is not transmitted to our servers.
Business Information:
Company/business name
Tradesman name
Business address (street, city, postcode)
Business phone and email
Phone number (personal)
Company logo (if uploaded)
Vehicle registration number (if provided)
Tax Identification Numbers:
Unique Taxpayer Reference (UTR)
VAT registration number (if VAT registered)
National Insurance Number (NINO) — stored using encryption (iOS Keychain or Android Secure Storage)
Bank Details:
Bank name
Account holder name
Account number
Sort code
Invoices and Quotes:
Invoice/quote numbers and dates
Work descriptions and job references
Daily work entries
Labour amounts, extras, materials
CIS tax deductions
VAT amounts
Payment status and history
Invoice notes
Customer and Supplier Data:
Names
Business names
Addresses and postcodes
Phone numbers
Email addresses
Notes
Note: You are responsible for ensuring you have the appropriate legal basis to store your customers’ and suppliers’ personal data within the App.
Expense Data:
Expense dates and amounts
Categories (Travel, Materials, Tools, Office, etc.)
VAT amounts
Vendor/supplier names
Payment methods
Receipt photographs (if attached)
Notes and descriptions
2.3 Data Transmitted to HMRC (Pro Tier Only)
When you use Making Tax Digital features, certain data is transmitted directly to HMRC. This data is sent from your device to HMRC and is not stored on our servers. See Section 6 for full details.
2.4 Device and Technical Data
To operate the App securely and meet HMRC legal requirements for fraud prevention, the following device data may be collected when making HMRC submissions:
Device type, manufacturer, and model
Operating system and version
App version
Screen resolution
Device timezone
Device IP address
Unique device identifier (UUID)
This data is transmitted directly to HMRC as legally required and is not stored on our servers.
2.5 Data We Do NOT Collect
We want to be clear about what we do not collect:
We do not use analytics services (no Google Analytics, Mixpanel, Firebase Analytics, or similar)
We do not use crash reporting services
We do not track your behaviour within the App
We do not collect location data (GPS)
We do not sell your personal data to third parties
We do not use your data for advertising purposes
3. How We Use Your Personal Data
3.1 Legal Bases for Processing
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:
Purpose | Legal Basis |
Providing our Services (invoicing, expense tracking) | Performance of contract |
Processing account registration and authentication | Performance of contract |
HMRC Making Tax Digital submissions | Legal obligation / Performance of contract |
HMRC fraud prevention data transmission | Legal obligation (UK law) |
Subscription management | Performance of contract |
Sending service-related communications | Performance of contract / Legitimate interests |
Sending marketing communications | Consent (opt-in) |
Responding to support requests | Performance of contract / Legitimate interests |
Complying with legal obligations | Legal obligation |
3.2 Specific Processing Activities
Account Management:
Creating and managing your user account
Authenticating your identity when you sign in
Managing your subscription and entitlements
Core App Functionality:
Creating, editing, and storing invoices and quotes
Generating PDF documents for sharing and printing
Calculating VAT and CIS tax deductions
Tracking expenses and categorising them
Managing your customer and supplier database
HMRC Making Tax Digital (Pro Tier):
Connecting to your HMRC account via Government Gateway
Retrieving your registered self-employment business details
Submitting quarterly income and expense updates
Transmitting legally required fraud prevention data
Communications:
Sending you important service updates and security notices
Sending marketing emails (only if you opt in)
4. Data Storage and Security
4.1 Where Your Data is Stored
Local Device Storage: Most of your business data is stored locally on your device:
Invoices and quotes
Customer and supplier information
Products and services
Company settings and bank details
Expense records
Receipt photographs
This data is stored using your device’s built-in storage, protected by your device’s operating system encryption.
Secure Encrypted Storage (Device): Highly sensitive data is stored using additional encryption:
iOS: Apple Keychain (hardware-backed Secure Enclave encryption)
Android: Encrypted Keychain storage with AsyncStorage fallback
Data stored in secure storage includes:
HMRC OAuth access and refresh tokens
Your National Insurance Number
Device identifier for HMRC fraud prevention
Cloud Storage (Supabase): We store limited data in our secure cloud database:
Email address
Full name
Phone number (if provided)
Authentication tokens (encrypted)
Marketing preferences
Our cloud infrastructure is provided by Supabase, which uses Amazon Web Services (AWS) with encryption at rest and in transit.
4.2 Security Measures
We implement appropriate technical and organisational measures to protect your data:
Technical Measures:
All data transmitted between the App and our servers uses TLS/HTTPS encryption
All data transmitted to HMRC uses TLS/HTTPS encryption
Sensitive data (NINO, HMRC tokens) is stored using hardware-backed encryption where available
Row Level Security (RLS) in our database ensures users can only access their own data
OAuth 2.0 with PKCE for HMRC authentication
No plain-text storage of passwords (bcrypt hashing via Supabase)
Organisational Measures:
Limited access to production systems
Secure development practices
Regular security reviews
4.3 No Automatic Cloud Backup
Important: Your invoices, quotes, expenses, and business data are stored primarily on your device. We do not automatically back up this data to the cloud. You are responsible for:
Exporting important documents as PDFs
Maintaining your own backups if needed
Understanding that uninstalling the App or losing your device may result in data loss
5. Data Sharing
5.1 Third-Party Service Providers
We share personal data with the following third-party service providers who act as data processors on our behalf:
Service Provider | Purpose | Data Shared | Location | Privacy Policy |
Supabase | Authentication and user account management | Email, name, phone, auth tokens | EU/US (AWS) | supabase.com/privacy |
RevenueCat | Subscription and payment management | User ID, email, name, subscription status | USA (AWS) | revenuecat.com/privacy |
HM Revenue & Customs (HMRC) | Making Tax Digital tax submissions (Pro tier only) | See Section 6 below | UK | gov.uk/government/organisations/hm-revenue-customs/about/personal-information-charter |
Social Sign-In Providers (if you choose to use them):
Provider | Data Received | Their Privacy Policy |
Email, name, profile picture | ||
Apple | Email (may be private relay), name |
5.2 Payment Processing
We do not directly process payments. All subscription payments are handled by:
Apple App Store (iOS) – governed by Apple’s Privacy Policy
Google Play Store (Android) – governed by Google’s Privacy Policy
We do not have access to your payment card details.
5.3 When You Share Data
When you use the App’s sharing features (email, print, share to other apps), you control what data is shared. This may include:
PDF invoices and quotes containing your business details, customer information, and financial data
Shared via email, messaging apps, cloud storage, or AirDrop
5.4 Legal Requirements
We may disclose your personal data if required by law, regulation, or legal process, or if we believe disclosure is necessary to:
Comply with applicable laws or regulations
Respond to a court order, subpoena, or government request
Protect our rights, property, or safety, or that of our users or the public
5.5 Business Transfers
If Aperture Works Ltd is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.
6. HMRC Making Tax Digital
This section applies to Pro-tier subscribers who use MTD features.
6.1 Your HMRC Authorisation
To use MTD features, you must:
Connect your HMRC account through the Government Gateway
Provide your National Insurance Number (NINO)
Select a business registered with HMRC for self-employment
This authorisation is granted through HMRC’s official OAuth 2.0 process. You can revoke this authorisation at any time through your HMRC online account or within the App.
6.2 Data Submitted to HMRC
When you submit a quarterly update, we transmit the following to HMRC on your behalf:
Personal Identifiers:
Your National Insurance Number
Business Information:
Business ID (assigned by HMRC)
Tax year and accounting period
Financial Data:
Income/turnover figures
Expense totals categorised as:
Cost of goods sold
Travel costs
Wages and staff costs
Premises costs
Repairs and maintenance
Professional fees
Financial charges
Advertising and marketing
Interest paid
Other expenses
By initiating a submission, you confirm that the information is accurate to the best of your knowledge and authorise us to transmit it to HMRC.
6.3 Fraud Prevention Headers (Legal Requirement)
UK law requires us to submit fraud prevention data to HMRC with every API request. This is not optional and is mandated by HMRC to help detect and prevent tax fraud.
The fraud prevention headers include:
Header | Data Collected | Purpose |
Gov-Client-Device-ID | Persistent device identifier (UUID) | Identify the device used |
Gov-Client-User-Agent | Device OS, version, manufacturer, model | Technical identification |
Gov-Client-Timezone | Device timezone (e.g., UTC+01:00) | Audit and fraud detection |
Gov-Client-Local-IPs | Device IP address(es) | Network identification |
Gov-Client-Screens | Screen dimensions and resolution | Device identification |
Gov-Client-Window-Size | App window dimensions | Device identification |
Gov-Client-Connection-Method | “MOBILE_APP_DIRECT” | How the connection is made |
Gov-Vendor-Product-Name | “CIS Invoice” | Identify our software |
Gov-Vendor-Version | App version number | Software identification |
By using MTD features, you consent to this data collection and transmission to HMRC as required by law.
For more information about HMRC’s fraud prevention requirements, visit: https://developer.service.hmrc.gov.uk/guides/fraud-prevention/
6.4 NINO Security
Your National Insurance Number is:
Stored using encryption on your device (Keychain/Secure Storage)
Displayed in masked format within the App (e.g., “AB 12 34 ** **”)
Only transmitted to HMRC when making authorised API calls
Never stored on our servers
6.5 Disconnecting from HMRC
You can disconnect your HMRC account at any time through the App. This will:
Remove stored HMRC tokens from your device
Prevent further submissions until you reconnect
Not affect data already submitted to HMRC
7. Device Permissions
The App requests the following device permissions:
Permission | Purpose | Required? |
Camera | Take photos of completed work or receipts to attach to invoices and expenses | Optional |
Photo Library | Select existing photos to attach to invoices and expenses | Optional |
Contacts | Import customer details from your address book | Optional |
Internet | Authentication, HMRC submissions, subscription verification | Required |
You can deny any optional permission, but some features may not function without them. You can change permissions at any time in your device settings.
8. Data Retention
8.1 How Long We Keep Your Data
Data Type | Retention Period | Reason |
Account data (email, name) | Until you delete your account | Service provision |
Authentication tokens | Until logout or expiry | Security |
HMRC OAuth tokens | Until you disconnect or they expire | HMRC access |
Local business data (invoices, quotes, etc.) | Until you delete them or uninstall the App | Your business records |
Marketing preferences | Until you change them or delete your account | Consent management |
8.2 Your Tax Record Obligations
Important: Under UK law, self-employed individuals must keep business records for at least 5 years after the 31 January submission deadline of the relevant tax year. This is your responsibility, not ours.
We recommend:
Regularly exporting important invoices as PDFs
Maintaining your own backup copies
Not relying solely on the App for long-term record storage
8.3 Data Submitted to HMRC
Data submitted to HMRC is retained by HMRC according to their own retention policies. We have no control over data held by HMRC. For information about HMRC’s data retention, visit: https://www.gov.uk/government/organisations/hm-revenue-customs/about/personal-information-charter
9. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
9.1 Right of Access
You have the right to request a copy of the personal data we hold about you. Most of your data is visible directly within the App.
9.2 Right to Rectification
You have the right to request correction of inaccurate personal data. You can update most of your data directly within the App.
9.3 Right to Erasure (“Right to be Forgotten”)
You have the right to request deletion of your personal data. You can:
Delete individual invoices, quotes, customers, suppliers, items, and expenses within the App
Delete your entire account through the Profile/Settings screen
Account deletion will:
Remove your account from our authentication system
Clear all locally stored data on your device
Not affect data already submitted to HMRC
Not automatically cancel App Store/Play Store subscriptions (you must cancel these separately)
9.4 Right to Data Portability
You have the right to receive your personal data in a portable format. You can:
Export invoices and quotes as PDF documents
Use the App’s sharing features to transfer documents
9.5 Right to Restrict Processing
You have the right to request that we restrict processing of your personal data in certain circumstances.
9.6 Right to Object
You have the right to object to processing based on legitimate interests. You can:
Opt out of marketing communications at any time via the Profile settings
Contact us to object to other processing
9.7 Rights Related to Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
9.8 Exercising Your Rights
To exercise any of these rights, please contact us at:
Email: info@aperture-works.com
We will respond to your request within one month. In some cases, we may need to verify your identity before processing your request.
9.9 Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office Wycliffe House, Water Lane Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk Helpline: 0303 123 1113
10. Guest Mode
You may use the App without creating an account (“Guest Mode”) with the following limitations:
Maximum of 3 invoices
No cloud backup or synchronisation
No access to HMRC MTD features
All data is stored only on your device
In Guest Mode:
We assign a temporary local identifier
No personal data is transmitted to our servers
If you uninstall the App, all guest data is permanently lost
You can migrate your guest data to a registered account when you sign up.
11. International Data Transfers
Your personal data may be transferred to and processed in countries outside the United Kingdom.
11.1 Data Processed in the UK
The following service processes data within the United Kingdom:
Recipient | Purpose | Location |
Supabase | Authentication and user account management | UK |
As this data remains within the UK, no international transfer safeguards are required.
11.2 Data Transferred Internationally
The following services process data outside the United Kingdom:
Recipient | Purpose | Country | Safeguard |
RevenueCat | Subscription and payment management | USA | Standard Contractual Clauses, DPA |
Google (sign-in) | Authentication (if you choose Google sign-in) | USA | Standard Contractual Clauses |
Apple (sign-in) | Authentication (if you choose Apple sign-in) | USA | Standard Contractual Clauses |
These transfers are protected by appropriate safeguards, including Standard Contractual Clauses approved by the UK Government, which ensure your data receives an equivalent level of protection as it would under UK law.
11.3 Data Transmitted to HMRC
Data submitted through Making Tax Digital features is transmitted directly from your device to HM Revenue & Customs servers in the United Kingdom. This data is not routed through our servers.
12. Children’s Privacy
Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@aperture-works.com, and we will delete such data.
13. Cookies and Similar Technologies
13.1 Website
Our website may use essential cookies necessary for the website to function. We do not use cookies for analytics or advertising.
13.2 Mobile App
The App does not use cookies. We use:
Authentication tokens: Stored securely to keep you signed in
Local storage: To store your business data on your device
Secure storage: For sensitive data like HMRC tokens
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make material changes, we will notify you by:
Displaying a notice within the App
Sending an email to your registered email address
Updating the “Last updated” date at the top of this Policy
We encourage you to review this Privacy Policy periodically.
Your continued use of the App after changes are posted constitutes your acceptance of the updated Privacy Policy.
15. Third-Party Links
The App and Website may contain links to third-party websites or services (e.g., HMRC Government Gateway). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Aperture Works Ltd Enterprise House, The Courtyard, Old Court House Road Bromborough, Wirral, England, CH62 4UE
Email: info@aperture-works.com
We aim to respond to all enquiries within 5 business days.
17. Summary of Key Points
Topic | Summary |
What we store | Email address, full name, marketing preferences, profile picture (Google sign-in only) |
What stays on your device | Business information, tax IDs (NINO, UTR), bank details, invoices, quotes, expenses, customer and supplier data |
What we DON’T collect | Analytics data, location data, usage tracking, advertising data, crash reports |
Cloud storage | Supabase (UK) for account data only |
International transfers | RevenueCat (USA), Google/Apple sign-in (USA) — protected by Standard Contractual Clauses |
Who we share with | Supabase (auth), RevenueCat (subscriptions), Google/Apple (sign-in), HMRC (tax submissions – Pro tier) |
HMRC MTD | Pro tier only; requires NINO; fraud prevention headers are legally required; data sent directly to HMRC |
Your rights | Access, rectification, erasure, portability, restrict, object, complain to ICO |
Data retention | Account data until you delete; local data until you delete or uninstall; you are responsible for tax record keeping |
Security | TLS encryption, Keychain/Secure Storage for sensitive data, no plain-text passwords |
This Privacy Policy was last updated on 17 April 2026.
Aperture Works Ltd – Registered in England and Wales