Privacy
Privacy notice
This notice explains how Infinity Square Labs Ltd ("we", "us") handles personal data in connection with this website. Each of our products (AiresDocs, PDFMagpie, PixWrench, MoneyOtter, CryptoTaxOwl and DebtWren) has its own privacy notice on its own website, because each one handles data differently.
Who we are
Infinity Square Labs Ltd is a software and analytics company registered in England and Wales, company number 16880965. Our registered office is 483 Green Lanes, London, N13 4BS, United Kingdom. We are the controller of the personal data described in this notice. You can reach us at [email protected].
What we collect
Technical data when you visit. Our hosting provider, Cloudflare, receives your IP address, browser type and the pages you request in order to deliver the site, cache it near you and protect it from abuse. Cloudflare keeps short-lived logs for security purposes. We do not run analytics, advertising or tracking scripts on this website, and we do not build profiles of visitors.
Fonts. Typefaces are loaded from Google Fonts. When your browser requests them, Google receives your IP address and the referring page. Google states that it does not use Fonts requests to track or profile users. If you would rather avoid this, a browser extension that blocks third-party fonts will not stop the site working.
What you send us. If you use the contact form or email us, we receive what you choose to give us: your name, email address, company if you add it, the topic you pick and your message. The form also records the time, the page it was sent from and the country Cloudflare reports for your connection, which helps us spot abuse. We do not store your IP address with your message.
The contact form
Messages sent through the form go to a small program running on Cloudflare's network. It checks the message is complete, drops obvious spam (a hidden field that only automated submissions fill in, and a limit of five messages an hour per connection), stores a copy in Cloudflare KV storage, and emails it to our team. If the email service is unavailable the stored copy is still there, so nothing you send is lost. Ticking the consent box tells us you have read this notice; the form will not send without it.
If the form cannot reach our server at all, the page offers to open your own email app with the message prefilled. In that case the message travels by ordinary email and nothing is stored by us until it arrives.
Why we use your data, and on what legal basis
- To reply to you and discuss work. Legal basis: our legitimate interest in responding to enquiries, and where relevant taking steps at your request before entering into a contract (UK GDPR Article 6(1)(f) and 6(1)(b)).
- To run and protect the website. Legal basis: legitimate interest in keeping the site available and secure (Article 6(1)(f)).
- To meet legal obligations, for example keeping records for tax or responding to lawful requests (Article 6(1)(c)).
We never sell personal data, and we do not use what you send us to train AI models. If we use AI tools to help draft a reply, the tool is run under a business agreement that prohibits training on our data, and a person reviews every reply before it is sent.
How long we keep it
- Contact form messages: stored for up to 12 months in Cloudflare KV, then deleted automatically. The emailed copy is kept in our mailbox for up to two years so we can follow up.
- Emails you send us directly: up to two years, unless they become part of a contract, in which case we keep them for the life of the contract plus six years for tax and legal purposes.
- Cloudflare security logs: retained by Cloudflare for a short period under their own policy; we do not keep copies.
Who we share it with
We use a small number of service providers, each under a contract that limits what they can do with the data:
- Cloudflare, Inc.: hosting, network security and the storage behind the contact form.
- Resend, Inc.: delivers contact-form messages to our mailbox by email.
- Google LLC: serves the fonts used on this site, as described above.
We may also share data if the law requires it, or with professional advisers (for example our accountant or lawyer) under a duty of confidence. We do not share your data with advertisers or data brokers.
International transfers
Cloudflare, Resend and Google operate globally, so data may be processed outside the United Kingdom, including in the United States. Where that happens the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK's adequacy regulations for the country concerned. You can ask us for details of the safeguards in place.
Security
The site is served only over HTTPS. Messages are stored in encrypted storage with access limited to the people who need to reply. Our own products are built with independent review of every release; this website follows the same discipline. No system is perfectly secure, so if you are sending something sensitive, tell us first and we will agree a safer channel.
Your rights
Under UK data protection law you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, where we have no overriding reason to keep it;
- stop or restrict how we use it, including objecting to our use on the basis of legitimate interest;
- give you your data in a portable form, where we process it by automated means on the basis of consent or contract.
To exercise any of these, email [email protected]. We reply within one month. There is no charge unless a request is clearly unfounded or excessive. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113; we would welcome the chance to put things right first.
Cookies and local storage
This website sets no cookies of its own. It stores one value, your light or dark theme choice, in your browser's local storage, on your device only; it is never sent to us. Cloudflare may set a short-lived security cookie if it needs to challenge suspicious traffic; that cookie contains no personal data and is strictly necessary, so no consent is required. Our product websites that show advertising have their own cookie notices and consent controls.
Children
This website is aimed at businesses and is not directed at children under 16. We do not knowingly collect their data; if you believe a child has sent us personal data, email us and we will delete it.
Changes to this notice
We will update this page if how we handle data changes, and change the date at the top. Significant changes will be flagged on the home page for a period after they take effect.