Privacy Policy

1. Who we are

UK Biz Tools Hub is the trading name of this website: free business calculators, invoice tools and guides for UK freelancers, contractors, sole traders and small businesses. A trading name is not itself a legal entity, so this section also identifies the person or organisation that operates the site and is the data controller for UK data protection law.

The data controller for your personal information is Nosa Osahon, whose legal structure is recorded as sole trader, of 16 Brinklow Road, Birmingham, B29 5XR, UK, which is also the service address for data protection correspondence.

Privacy questions and data protection requests can be sent to ukbizhub@itwave.co.uk or through the contact form by choosing “Privacy request”.

2. The short version

The calculators run in your browser. The figures you type into a calculator are not sent to us or stored on any server.
If you create an account, we store your sign-in email, your saved invoices and your business profiles so you can come back to them.
A company logo you upload is stored in private storage (stored privately) and is only ever shown to you and to an administrator providing support.
Card details are entered on the payment provider’s own checkout. They never reach this application, and we never store them.
Analytics and advertising cookies are off unless you accept them, and they stop if you withdraw your consent.
Following a labelled sponsored or affiliate link is recorded by this site itself only if you have allowed analytics. The record says which campaign or programme, where the link appeared, which page it was followed from and when — and nothing about who you are.
You can ask for a copy of your data, ask for it to be corrected, or ask for your account to be deleted.

3. Information we collect

Account and sign-in information

If you register, we hold the email address you sign up with, your display name if you provide one, the account role, and the dates the account record was created and last updated. Your password is held by the Base44 platform’s authentication service, which manages sign-in and account credentials: this application never receives, displays or stores your password, and it keeps no password hash of its own. Passwords are changed through a single-use reset link emailed to you. If you sign in with Google, we receive the account identity that provider confirms, not your Google password.

Business profiles

A saved business profile holds the details you choose to enter: business name, address, email, telephone, website, company registration number, VAT registration number, bank payment details, default payment instructions and payment terms. A business profile is visible only to the account that created it and to an administrator providing support.

Invoices

A saved invoice holds the invoice number and dates, the customer name and address you enter, the line items and amounts, the VAT rate and totals, payment instructions, notes, the business details copied at the time of saving, and the reference to the logo used. Invoices are visible only to the account that created them and to an administrator providing support. You are responsible for the accuracy of the personal information you enter about your own customers, and for having a lawful basis to hold it.

Uploaded files

Company logos you upload are stored in the application’s private file storage (stored privately) and are shown to you through short-lived signed links. Replacing a logo, or deleting the business profile that uses it, removes the reference to the image from your record — but this application has no feature that deletes the uploaded image file itself, so the file remains in that private storage.

Membership, payment and billing information

If you take out a paid membership, we store a membership record: the plan, status, price and billing interval, the current period dates, whether it is set to cancel at the end of the period, the payment service’s subscription reference, and a billing history showing the date, amount, status and order reference of each payment. Base44 Payments is the payment service used for card payments and recurring memberships, and it runs on the Wix payments platform.

We also keep a purchase record for each checkout: the checkout and order references, the subscription reference where there is one, the product or plan bought, the amount and currency, the payment status, and the email address the buyer entered. Card numbers, security codes and expiry dates are never received or stored by this application — they are entered on the payment service’s own hosted checkout page, which also collects the buyer’s name, email address and billing address. From the payment service we receive only the order and subscription details above, the amounts and currency, the payment status, and the buyer’s email address.

Support enquiries

The contact form records the name, email address, subject, selected topic and message you send, and any internal notes an administrator adds while handling it.

Account notification records

When the application sends you an account email — a membership activation, renewal receipt, cancellation, expiry notice or a notice that your saved business details changed — it keeps a delivery record: the event type, the recipient address, the email template used, the delivery status, the number of attempts and the values used to fill the email. This record never contains passwords, card details or sign-in tokens.

Data protection requests

If you ask for access to your information, its correction, erasure of your account or an email change, the request records the type, your details, what you asked for, the status and any notes an administrator adds. These are the only request types the site offers: there is no advertising or affiliate preference to opt out of beyond the cookie categories you control yourself.

Cookie and consent choices

Your cookie choice is saved in your own browser’s local storage: the categories you allowed, the time you saved them, and the policy version you answered under. It is not sent to us and no account is needed.

Analytics and advertising information

No analytics service is currently enabled on this site, so no analytics data is collected. If analytics is enabled in future, it will only run after you give analytics consent, and this policy will be updated first.

Advertising is not currently enabled on this site, so no advertising cookies are set and no advertising code is loaded.

Security identifiers used when recording clicks

Both click recorders are rate-limited to prevent automated abuse, which would otherwise inflate advertiser and partner reporting. To apply that limit, the application computes a short one-way hash — SHA-256, salted with a value held on the server and truncated to 16 characters — from the caller’s network address and the current date. The raw address is never written down, and the hash is used for nothing except counting requests within a limit.

The hash exists only inside a short-lived rate-limit bucket: one record per recorder per minute, holding a request total, per-campaign counts and that daily hash. Buckets are deleted automatically when a later click sweeps expired ones, normally about two minutes after the bucket begins; if no further clicks arrive, a bucket remains until the next one does. Buckets are readable only by the site’s administrators.

A salted hash of a network address is a pseudonymous identifier, not an anonymous one, while it exists: the same address on the same day always produces the same hash, and a guessed address could be tested against it. That is exactly why it is salted, truncated, rotated every day and deleted within minutes. It is never used to recognise, contact or profile anyone, and it is not shared with advertisers or partners.

4. How we use your information

Providing the tools — running the calculators and generating invoices, which happens in your browser.
Your account — creating and securing your account, signing you in, remembering your saved invoices and business profiles.
Membership and payments — taking and renewing a membership, confirming payments, and granting or withdrawing the access you have paid for.
Account notifications — telling you your membership started, renewed, was cancelled or expired, and confirming changes to your saved business details.
Support — reading and answering your enquiries and correcting reported errors.
Security and fraud prevention — protecting accounts, detecting abuse of the payment and tracking endpoints, and keeping an audit record of administrative actions.
Analytics — understanding which tools are used so they can be improved, only with your consent.
Advertising — showing and measuring adverts, only when advertising is enabled and you consent.
Link measurement — understanding which sponsored placements and affiliate links are used, only with analytics consent, and recorded without attaching your account, a cookie or your network address to the record.
Rate limiting — preventing automated abuse of the click recorders, using a short-lived salted hash instead of a stored address.
Legal obligations — keeping financial and tax records, and responding to data protection requests and lawful requests from public authorities.

Lawful bases

Performance of a contract — the account, saved invoices, business profiles and paid membership you have asked us to provide.
Consent — analytics cookies, advertising cookies, and optional partner-link measurement. You may withdraw consent at any time.
Legitimate interests — answering support enquiries, keeping the service secure, preventing abuse and improving the tools. We balance these against your rights and only use data that is needed for them.
Legal obligation — retaining financial records for tax purposes and handling statutory data protection requests.

5. Who we share it with

Base44 — the platform that hosts and serves this site, runs its backend functions, stores its database records and uploaded files in private storage, and provides the authentication service that handles sign-in and passwords. It acts as a processor on our instructions.
Base44 Payments — processes card payments and recurring memberships, and sends this application a signed, verified confirmation when a payment succeeds, is cancelled or expires. It runs on the Wix payments platform, so Wix companies process the payment transaction itself. Card details are collected by the payment service, never by us.
Base44’s email service — account notifications (membership activated, renewal receipt, cancellation, expiry, and a notice that saved business details changed) are sent through the Base44 platform’s transactional email feature. This application does not configure a separate email provider, and the delivery network behind that platform feature is not identified anywhere in this application’s code.
Google — only where a Google service is enabled above: Google Analytics 4 for analytics consent, or Google AdSense for advertising consent.
Affiliate programmes — only the programmes the site has genuinely joined, and only after you follow a labelled link, at which point the partner’s own privacy policy applies.
Professional advisers and authorities — where required by law, for example HMRC, or to establish or defend legal claims.

We do not sell personal information, and we do not share your invoices, business details or customer details with advertisers or affiliate programmes.

6. International transfers

The providers described in section 5 are international services, so your information may be processed outside the UK — in the United States or the European Union, depending on the provider and the service used. Which transfer mechanism actually applies cannot be confirmed from this application: it depends on each provider’s own data processing terms and on where that provider processes the data. Base44 hosts the site, its database and its files; Base44 Payments, and the Wix companies behind it, handle payments; Google handles analytics or advertising only where those services are enabled. This policy therefore does not assert that transfers rest on UK adequacy regulations or on the UK International Data Transfer Addendum. Before public launch the operator must obtain each provider’s data processing terms, record which safeguard applies to each, and correct this section to match.

This section is honest about a gap rather than filling it: the transfer position has not yet been verified against the providers’ current terms and must be reviewed, with legal advice if needed, before the site is launched.

7. How long we keep it

Account and sign-in records — while your account exists. When an erasure request is actioned, the sign-in record and your personal details are removed along with your saved invoices and business profiles; only the records listed below as retained are kept.
Business profiles and saved invoices — you can delete either yourself at any time, and the deletion takes effect immediately. Otherwise they are kept while your account exists.
Uploaded logos — the reference is removed with the profile, but the image file itself is not deleted from private storage by this application.
Membership and purchase records — kept while the site operates, and for the tax period below where they are financial records. They are not deleted automatically.
Records with tax significance — kept for the period UK tax law requires of a sole trader, which is the operator’s confirmed legal structure: VAT records must generally be kept for six years, and business records for the self-employed under HMRC’s record-keeping rules. The exact period for a particular record should be confirmed on GOV.UK.
Account notification records — up to 24 months from the date sent.
Support enquiries — up to 24 months, so an earlier error report can be referred back to.
Data protection requests — kept after a request is closed, as evidence that it was handled and of what was erased.
Sponsored and affiliate click records — kept while the site operates. They carry no visitor identifier, and no fixed retention period is applied to them yet; if one is adopted, this section will state it.
Rate-limit buckets — about two minutes: each holds one minute of counters, including the salted hash described in section 3, and is removed when a later click sweeps expired buckets.
Administrative audit log — kept as a record of administrative actions, so that accountability can be demonstrated and misuse investigated.
Cookie consent choices — in your browser only, until you change or clear them.

The periods above are the maximum we keep each type of record for. Deletion is carried out when the operator reviews stored data, not by an automatic purge, so a record can remain a little longer than the stated period while a review is pending. Where the law sets no fixed period, we keep a record only while there is a reason to.

8. Your rights

UK data protection law gives you a number of rights over your personal information. Several of them are conditional rather than absolute: each request is assessed on its facts under the UK GDPR and the Data Protection Act 2018, and an exemption can apply.

To be informed — through this policy and the cookie policy.
Access — to a copy of your personal information, subject to the exemptions in the Act.
Rectification — correction of information that is inaccurate or incomplete.
Erasure — where no overriding legal obligation, legal claim or other lawful reason requires us to keep the information.
Restriction — pausing use of your information while its accuracy, or the lawfulness of the processing, is in question.
Objection — where we rely on legitimate interests you may object, and we must then show compelling grounds that override your rights, or a legal claim.
Portability — only for information you gave us, processed by automated means on the basis of your consent or a contract, and where transferring it is technically feasible.
Withdrawing consent — at any time, for anything based on consent (analytics cookies, advertising cookies and optional link measurement). Withdrawal does not affect processing carried out before it.

To make a request, use the contact form and select “Privacy request”, or use the data request options in your account settings, or email ukbizhub@itwave.co.uk. We act without undue delay and normally within one month of receiving the request. Where a request is complex, or we receive several, UK law allows up to two further months, and we will explain why if we need that extension. If a request cannot be met, or can only be met in part, we will tell you which exemption applies and how you can complain.

9. Deleting your account

You can ask for your account, its saved invoices and its business profiles to be deleted at any time from your account settings. The request is logged and actioned by the site operator: your saved invoices and business profiles are erased and the sign-in record is removed, keeping only what we must keep for tax or legal reasons — and we tell you what was kept and why.

Cancelling a paid membership is a separate step. Ending your account does not by itself stop a membership you have taken out, and the payment service would continue to charge for it: cancel the membership first in your account settings, or ask us to cancel it, and then request deletion.

10. Security

The site is served over HTTPS. Access to saved invoices, business profiles and uploaded logos is restricted to the account that owns them and to administrators providing support. Sponsored and affiliate click records, rate-limit buckets and the administrative audit log are readable only by administrators. Significant administrative actions — including changes to monetisation settings, subscriptions, sponsored campaigns, products and data-request handling — are recorded in an audit log. Your cookie choice is kept in your own browser. The click recorders are rate-limited with a short-lived salted hash rather than a stored address, as described in section 3. If a personal data breach occurred that was likely to result in a risk to your rights and freedoms, we would notify the Information Commissioner’s Office without undue delay and, where the risk is high, tell you without undue delay, as UK data protection law requires.

11. Children

This site is aimed at businesses and is not intended for children under 13. We do not knowingly collect information from children.

12. Changes to this policy

This page changes whenever the site’s data practices change, and the “last updated” date changes with it. If a change affects what you have consented to, the consent policy version is updated and this site asks you to confirm your cookie choice again — see the cookie policy for how that works.

13. Complaints

If you are unhappy with how your information has been handled, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

14. Contact

For any question about this policy or your information, use the contact form and choose “Privacy request”, or email ukbizhub@itwave.co.uk. Further information about your rights is available from the Information Commissioner’s Office.