Privacy policy

Last updated: 6 November 2026.

1. Introduction

Collect Solutions Ltd (company number 16931356), trading as collects.io ("we", "our" or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit the collects.io website.

For the purposes of UK GDPR and EU GDPR, Collect Solutions Ltd is the data controller for the processing of personal data described in this Privacy Policy, except where section 13 says otherwise.

This Privacy Policy is a transparency notice, not a contract. It applies to this website, to the Google account (Gmail) data we access when you connect a Gmail mailbox (section 12), and to how our platform and its AI service handle data (section 13). If you become a collects.io customer, our customer terms and Data Processing Agreement apply to the data we process for you in the platform.

2. Information we collect

2.1 Information you provide. We collect personal information you choose to give us when you complete a form on this website (enquiry, demo or partner), chat with us through the support chat, email us or call us. This may include your name, email address, company name, role, phone number and anything you write in your message.

2.2 Information collected automatically. When you visit, we collect technical information through your browser and, only if you accept analytics cookies, through Google Analytics and PostHog. This may include browser type and device, operating system, pages visited and time on page, the referring website, campaign parameters in the page address (such as utm_source and a referral code), the user agent, and pseudonymous identifiers set by those analytics tools.

We do not load Google Analytics or PostHog unless you accept analytics cookies. If you decline, we store only your choice.

3. How we use your information

• To respond to your enquiry or chat message and communicate with you about it
• To understand how visitors use this website so we can improve it
• To pass the campaign or referral code you arrived with to our sign-up page, so an introduction is credited correctly
• To operate, secure and maintain this website
• To comply with legal obligations

Our lawful bases are legitimate interests (responding to enquiries, operating the website, crediting referrals), consent (analytics cookies) and legal obligation.

4. Storage and security

Enquiries you send through our website forms are stored in our customer relationship management system (Attio). Business contact details we get from data providers (section 14) are enriched and checked using Clay. The website is hosted by Vercel. We use appropriate technical and organisational measures, including encryption in transit (HTTPS), access to enquiries on a need-to-know basis, and analytics that load only after consent. No method of transmission or storage is completely secure. If a personal data breach is likely to result in a high risk to your rights and freedoms, we will tell you without undue delay, as UK GDPR Article 34 requires.

5. Sharing

We do not sell, trade or rent your personal information. We share it with these service providers, which process it on our behalf under contractual data-protection obligations:

• Google Analytics 4: website analytics, only after you consent. United States (UK IDTA and EU Standard Contractual Clauses).
• PostHog: website analytics, only after you consent. EU.
• Attio: stores the enquiries you send through our forms.
• Clay: enriches and checks the business contact details described in section 14. United States (UK IDTA and EU Standard Contractual Clauses).
• Apollo.io: sends our business-to-business sales emails and records replies and opt-outs. It holds business contact details only (name, job title, employer, work email address and business social profile). You can opt out at any time by replying "stop", using the unsubscribe link in any email, or emailing privacy@collects.io. United States (UK IDTA and EU Standard Contractual Clauses).
• Intercom: our support chat, including its automated assistant (Fin). Loaded only when you open the chat; it stores your conversation and any details you give in it. EU-hosted.
• Microsoft (Microsoft 365 Bookings): our "Book a call" booking page. If you book a call, it holds your name, email address, the time you choose and anything you write in the booking form. Stored in Microsoft's European data centres. Any transfer outside the UK and EEA is covered by Microsoft's Data Protection Addendum, which includes the EU Standard Contractual Clauses and UK transfer safeguards.
• Vercel: website hosting and delivery. United States and EU (UK IDTA and EU Standard Contractual Clauses).

For Gmail data, see section 12. For data in our platform, including our AI service, see section 13.

We may also disclose information where the law requires it, or to a buyer in the event of a merger, acquisition or sale of assets.

6. Your rights

Under UK GDPR and EU GDPR you can ask to access, correct, delete or move your personal data, object to processing based on legitimate interests, restrict processing, and withdraw consent at any time (including for analytics cookies). Contact privacy@collects.io.

You can complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, your local supervisory authority.

7. Cookies

Analytics cookies are set only with your consent. You can change your choice at any time from Cookie settings in the footer. Support chat cookies are set only when you open the chat. See our Cookie Policy for the full list.

8. How long we keep it

• Enquiries, call bookings and chat conversations: as long as needed to respond, and up to 6 years afterwards for sales and legal records
• Website analytics: up to 26 months
• Your cookie choice: 12 months, or until you clear it
• Gmail data: see section 12
• AI service records of each request and result, including message content: 30 days (see section 13)
• Business contact details from data providers: 12 months from our last contact, or until you object (see section 14)

9. Other websites

This website links to other sites, such as our sign-up page, our call booking page (Microsoft Bookings, see section 5), the Xero App Store and Vimeo. We are not responsible for their privacy practices.

10. Children

This website is not directed at anyone under 18, and we do not knowingly collect their information. If you think a child has given us information, contact privacy@collects.io and we will delete it.

11. International transfers

Some providers above, and some of the sub-processors listed on our Sub-processors page, process data outside the UK and EEA, in particular in the United States (including Google Analytics, Clay and Vercel). Where they do, we rely on the UK International Data Transfer Agreement, EU Standard Contractual Clauses or an adequacy decision.

12. Google Account (Gmail) Data

If you connect a Gmail mailbox to Collect, we access it via the Gmail API to provide our core features.

What we collect:

• your mailbox email address
• up to two years of prior email history when you first connect (subject, body, sender and recipient)
• emails sent or received through that mailbox while it remains connected

Why: (1) to automatically match incoming invoices to related email conversations, and (2) to send payment reminder emails on your behalf from your own address.

Storage: When you first connect, we copy up to two years of past email from your mailbox. While the mailbox stays connected, we keep copies of all emails sent and received through it. If you disconnect, we keep this data for up to 30 days. If the mailbox stays disconnected for 30 days in a row, we delete all of it on day 31, including from our service providers' systems and backups. Our AI service's records of emails it has read or written are deleted after 30 days in any case (section 13).

Sharing: We share this data only with the service providers listed on our Sub-processors page (www.collects.io/sub-processors) (for example Nylas, our email infrastructure provider, and Amazon Web Services, our hosting and AI provider), which process it on our instructions. We do not sell this data or share it with advertisers.

Limited Use: Collect's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Gmail data for advertising or sell it. We do not use Gmail data to train or improve AI or machine learning models. People can read it only with your consent, for security, to comply with the law, or for our internal operations when it has been aggregated and anonymised.

13. Our platform and AI

When a business uses the collects.io platform, it decides what data the platform holds about its own customers and contacts, including data we read from the business's Xero organisation (read-only: invoices, contacts, credit terms and payments), and it is the controller of that data. We process that data on the business's behalf, under our Data Processing Agreement. If a business that uses collects.io has contacted you about an invoice, please ask that business first about your data; we will help it respond.

Our AI service runs on Amazon Web Services (Amazon Bedrock). To manage and collect invoices, it receives the business's settings, its invoices, its customers' details and its collections history, including names, email addresses and the content of emails. This data is not hashed or anonymised before it reaches the AI model.

Platform data is stored in the UK (Amazon Web Services London and Supabase UK). Our AI service may process requests in EU regions (Amazon Bedrock EU cross-region inference).

Amazon Web Services does not use this data to train its models. We do not use any customer data (ledger, invoice or email data) to train or improve AI or machine learning models.

Our AI service keeps a record of each request and its result, including message content, for 30 days, so we can check, explain and correct what it did and keep the service secure. After 30 days the record is deleted.

Say Digital Ltd (trading as MOHARA), a UK company, builds, operates and supports the platform for us.

Every company that processes platform data for us, with its location and safeguards, is listed on our Sub-processors page (www.collects.io/sub-processors).

14. People we contact about our services

We may contact people who work at UK businesses to tell them about Collects. We get work contact details (name, job title, employer, work email address and business social profile) from business data providers, namely TheirStack, DataHQ, Apollo.io and Sumble, from Clay, which we use to enrich and check those details, and from public business sources such as Companies House. We send these emails using Apollo.io (see section 5).

We use these details on the basis of our legitimate interest in telling businesses about our services (UK GDPR Article 6(1)(f)). We email work addresses at companies only, and every email lets you opt out.

We keep these details for 12 months from our last contact with you, or until you object, whichever is sooner. If you object, we keep only your email address on a suppression list so that we never contact you again.

You can object at any time by replying "stop" to any email from us, using the unsubscribe link, or emailing privacy@collects.io. You also have the right to see, correct or delete the data we hold about you, and to complain to the Information Commissioner's Office (ico.org.uk).

15. Changes

We will post any change on this page and update the date at the top.

16. Contact

Collect Solutions Ltd (trading as collects.io), company number 16931356, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. ICO registration ZC074860. Email: privacy@collects.io.