Privacy policy

1. Who is responsible

Patch Pay is operated by Ple Consulting AB, a company registered in Sweden, organisation number 559262-1212, registered address Viktoriavägen 20, 434 93 Vallda (“Ple”). Privacy questions: support@patch-pay.com.

Ple has two different roles, depending on the data:

• Controller for the public site, for the request-access form, and for the account data needed to let people sign in and to keep the service secure (sign-in identity, sessions and sign-in records).
• Processor for everything a customer puts into Patch Pay or connects it to: invoices and the emails they arrive in, supplier records, approvals, coding, payment drafts and the audit trail of the customer’s work. The customer, the business that uses Patch Pay, is the controller of that data and decides what it is used for. Ple processes it only to provide the service, under the data processing agreement with that customer. Questions about it are best sent to the customer first; Ple will help the customer answer them.

2. What is processed

Visiting patch-pay.com. The public site loads no analytics, advertising or tracking scripts, and its fonts are served from Patch Pay’s own host. The hosting provider records technical request data, such as IP address, browser type and time of request, in its logs in order to deliver and protect the service.

The request-access form. Name, work email address, company, country, accounting system, approximate invoices per month, and an optional note. To limit abuse, a keyed hash of the network address the form was sent from is stored, never the address itself. Ple staff are told about each request by Slack direct message or by email, and the request is kept with its outcome (approved or declined) and who decided it.

Signing in. Patch Pay has no passwords of its own. People sign in with Google or Microsoft, and Patch Pay receives their name and email address, and from Microsoft also the directory (tenant) id and the account’s object id. Each sign-in is recorded with the email address, the provider used and, for Microsoft, the directory and object id. A refused Microsoft sign-in is recorded with the directory and object id and the address it claimed.

Members of a customer’s company. Email address, role, approval limits, which of the customer’s companies the person can open, preferred notification channel, timezone, who covers for them while away, who invited them and when, and when they first signed in. The customer’s admins manage these.

Customer data (Ple as processor).

• Invoice documents (PDF, images, Word files) and the data read from them: supplier, amounts, dates, references, line items and any bank details printed on them.
• The email an invoice arrives in: sender address, subject, body text and links. Where an email links to an invoice on a known invoicing platform, Patch Pay fetches the document from that link, without credentials.
• Supplier records: names, other names they trade under, the addresses and domains they send from, and verified bank details. A supplier can be an individual, such as a sole trader or freelancer.
• Approvals and decisions, notes, coding, holds, payment drafts, and an audit trail recording each action and the person or system that took it.
• Records read from the systems the customer connects: vendors, bills and accounts from the accounting system; accounts, counterparties and transactions from the bank.
• Usage records for document reading: when a document was read, by which model, and its size in tokens.

3. Purposes and legal bases

For the data Ple controls, under the EU General Data Protection Regulation (GDPR):

• Delivering and securing the site and the service, including request logs, sign-in records and rate limits: legitimate interests (Article 6(1)(f)) in a working, secure service.
• Answering a request for access and deciding whether to set up a company: legitimate interests in answering business enquiries, and steps taken at the request of a prospective customer before a contract (Article 6(1)(b)) where the person asking is entering into it.
• Providing accounts to the people a customer invites: performance of the contract with the customer (Article 6(1)(b)), and legitimate interests of Ple and the customer in giving those people secure access (Article 6(1)(f)).
• Meeting legal obligations, such as Ple’s own bookkeeping: legal obligation (Article 6(1)(c)).

For customer data, the customer decides the purposes and the legal basis. Ple processes it only on the customer’s documented instructions, which are set out in the data processing agreement and given through the settings the customer chooses in Patch Pay.

Patch Pay reads documents with an AI model and proposes how to code them. These proposals are about invoices, not about people, and a person in the customer’s team releases every payment in the bank. Patch Pay does not make decisions about individuals that have legal or similarly significant effects on them.

Ple does not sell personal data and does not use customer data to train AI models.

4. Sub-processors

Ple uses these providers to run Patch Pay:

Services the customer connects. Patch Pay also exchanges data with services the customer connects using its own accounts. These are the customer’s own providers, under the customer’s agreements with them, and the customer decides which to connect:

• Google: Gmail, when a customer connects a mailbox for invoices to arrive in and for notifications to be sent from.
• Microsoft: Dynamics 365 Business Central (read only).
• Intuit QuickBooks Online: reads vendors, bills and accounts; creates bills, vendor credits and vendors, and attaches the invoice document.
• Revolut Business: reads accounts, counterparties and transactions; creates and withdraws payment drafts. Never releases a payment.
• Mercury: reads accounts and creates payment requests for a person to approve in Mercury. Never sends a payment.
• A customer’s own order system, where it provides purchase orders to match against.
• An AI assistant a person connects to Patch Pay’s read-only connector, which then reads what that person can see.

Ple tells customers by email before adding or replacing a sub-processor, so they have time to object. A customer may object on reasonable data protection grounds, and if the objection cannot be resolved, may end the affected part of the service without penalty.

5. Where data is kept, and transfers outside the EU and UK

The database and invoice documents are stored in London, in the United Kingdom, which is covered by the European Commission’s adequacy decision for the United Kingdom.

Personal data leaves the EU and UK in these cases:

• Document and email text sent to Anthropic for reading, processed in the United States.
• Email received and sent through Postmark, in the United States.
• Notifications and access-request notices sent through Slack, in the United States.
• Sign-in through Google, in the United States.
• Access by the United States parent companies of the hosting and database providers, where needed to run or support their service.

These transfers rely on the European Commission’s standard contractual clauses, together with any additional measures the transfer needs. Services a customer connects with its own accounts transfer data under the customer’s own arrangements with those providers.

6. How long data is kept

• Sign-in sessions end after 7 days for Google and 12 hours for Microsoft.
• Requests for access, approved and declined: 12 months.
• Account records and sign-in records: while the account is open, then 90 days.
• Hosting request logs: kept by the host for a short period, and not used to build a profile of anyone.
• Customer data is kept while the customer uses Patch Pay. After the subscription ends, it is returned on request and deleted 90 days after the subscription ends, or earlier on the customer’s request, as the data processing agreement says. The customer remains responsible for keeping its own accounting records for as long as the law requires.
• Data held by Anthropic and Postmark after processing: kept under each provider’s own retention policy.

7. Cookies and browser storage

Patch Pay uses only cookies needed for signing in and for the application to work. There are no analytics or advertising cookies, and the public site sets no cookies.

The browser’s own storage keeps a few display choices on the device and never sends them to Patch Pay: the light or dark theme (pp-theme, on the site and in the application), which payment groups are folded (pp-pay-fold-*, pp-pay-waiting-*), and one-time messages shown after an action (pp_flash, pp-company-reload, cleared when the tab closes).

8. Security

• All traffic to Patch Pay and to its database is encrypted in transit.
• Supplier bank details and the credentials for connected services are encrypted in the database with AES-256-GCM.
• Invoice documents are kept in private storage and can only be opened by a signed-in person with access to that company.
• Each company’s records are kept apart by access checks in the application and by row-level security in the database.
• Sign-in is through Google or Microsoft only. Sessions are signed and expire.
• Roles limit who can approve and up to what amount. A person who uploads an invoice cannot approve it, and a change to a supplier’s bank details needs a second person.
• Actions are recorded in an audit trail with the person who took them.
• Patch Pay cannot move money. Its Revolut access is limited to reading and preparing drafts, and its Mercury access to payment requests. A person releases every payment in the bank.
• Data at rest is encrypted by the database and storage providers.

9. Your rights

Under the GDPR, a person can ask for access to their personal data, for its correction or erasure, for processing to be restricted, to object to processing based on legitimate interests, and to receive data they provided in a portable format. These rights have conditions and exceptions set by law.

For data Ple controls, write to support@patch-pay.com. Ple answers within one month, and may ask for information to confirm who is asking.

For customer data, such as a supplier’s details on an invoice, contact the business that uses Patch Pay, which is the controller. A request sent to Ple about customer data is passed to that customer.

Anyone can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy.se, or to the supervisory authority where they live or work.

10. Changes to this policy

When this policy changes, the new version is published here with a new date. Customers’ admins are told of material changes by email before they take effect.