Badger← Back to Badger

Privacy Policy

Last updated / effective date: 23 August 2026

The short version (plain English)

Badger is a tool that automatically chases your unpaid invoices by sending polite payment reminders to your clients on your behalf, and works out the statutory interest and compensation that UK business clients owe on late commercial invoices. This policy explains what personal data we handle and why.

  • There are two kinds of personal data here, and we wear two different hats. For your own account information (your name, email, settings, and so on), Badger is the data controller. For your clients' information that you load into Badger (their names, email addresses, and invoice details), you are the controller and Badger is only your data processor — we handle it on your instructions to run the service for you.
  • We never sell your data or your clients' data, and we do not use it for advertising or cross-site tracking.
  • Reminder emails go out under your name, from you, to your clients — Badger just automates what you could send yourself.
  • We use a small number of carefully chosen suppliers (listed below) to host, secure, and operate the service. Some are outside the UK; where that happens we use the safeguards UK law requires.
  • We use only one strictly-necessary cookie (to keep you logged in). No tracking cookies, so no annoying consent banner.
  • You have rights over your personal data, and you can complain to the UK regulator (the ICO) if you are unhappy with how we handle it.

The rest of this policy sets all of that out in full.

1. Who we are

This service, "Badger" (the "Service"), is operated by the sole trader proprietor of Badger, based in and trading from the United Kingdom under the trading name "Badger" ("Badger", "we", "us", "our"). Badger operates the website at https://getbadger.co.uk. The proprietor's name and a United Kingdom correspondence address will be provided free of charge, and without undue delay, to anyone who requests them by emailing hello@getbadger.co.uk.

The quickest way to reach us about this policy or your personal data is by email at hello@getbadger.co.uk, which we monitor and treat as our primary contact channel.

We register with the Information Commissioner's Office (ICO) as a data controller where we are required to do so, and keep that registration up to date.

2. The two roles: when we are a "controller" and when we are a "processor"

UK data protection law (the UK GDPR and the Data Protection Act 2018) distinguishes between the "controller" — who decides why and how personal data is used — and the "processor" — who only acts on the controller's instructions. This distinction is central to how Badger works, so please read it carefully.

2.1 Badger as controller: your own account data

Badger is the data controller for the personal data relating to you as our customer — the information you give us to set up and run your account. This includes:

  • your name and email address;
  • your password and authentication data (including data associated with "Sign in with Google" if you use it);
  • your business/trading name, your invoice sign-off and signature, and your logo if you upload one;
  • your reminder-tone preferences and chasing schedule settings;
  • optional bank details you enter (account name, sort code and account number) — used only to display "pay by bank transfer" details on your own invoices and reminders; we never move money in or out of any account;
  • your subscription, plan and billing status;
  • tokens for any payment or accounting integrations you connect (stored encrypted at rest — see Security below); and
  • records of your use of the Service, support correspondence, and technical logs.

For all of the above, this Privacy Policy governs how we use that data and you can exercise your rights against us directly.

2.2 Badger as processor: your clients' data

When you upload, import or create records about the people and businesses you invoice (your "Clients"), you are the data controller for that personal data and Badger acts as your data processor. We process it only to provide the Service to you and on your documented instructions. This Client data typically includes:

  • your Clients' names and the names of their contacts;
  • your Clients' email addresses;
  • invoice numbers, amounts, line items, dates and due dates; and
  • the history of reminders sent and payment status.

Because you are the controller of this Client data, you are responsible for having a lawful basis to load it into Badger and to have us send reminders on your behalf, and for meeting your own transparency obligations to your Clients. Our processing of Client data on your behalf is governed by our Data Processing Agreement / processor terms, which form part of our Terms of Service and set out the mandatory terms required by Article 28 of the UK GDPR (including confidentiality, security, use of sub-processors, assistance with data-subject requests, and deletion or return of data at the end of the service). If you need a signed standalone Data Processing Agreement, contact hello@getbadger.co.uk.

The remainder of this policy focuses on Badger's own activities as controller, but it also describes, for transparency, how Client data flows through the Service on your behalf.

3. How we collect personal data

We collect and process personal data that is:

  • Entered manually by you in the app (for example, when you set up your account or add an invoice or Client);
  • Created within the app as you use it (for example, reminder history, statutory-interest calculations, and logs);
  • Imported by CSV when you upload a file of invoices or Clients; or
  • Imported read-only from an accounting tool you choose to connect (Xero, FreeAgent or QuickBooks) so that Badger can chase invoices you already have. These connections are read-only: Badger imports existing invoice data and does not write back to your accounting tool.

4. What we use personal data for, and our lawful bases

As controller of your account data, we rely on the following lawful bases under Article 6 of the UK GDPR:

  • Performance of a contract — to create and run your account, provide the Service, generate and send reminders on your behalf, calculate statutory interest and compensation, reconcile payments, provide support, and take payment for your subscription. Without this data we cannot provide the Service.
  • Legitimate interests — to operate, secure, maintain, troubleshoot and improve the Service; to prevent fraud and abuse; to keep records of what was sent and when; and to send service/administrative messages. We also process Client data (as your processor) to give effect to your legitimate interest in chasing money you are lawfully owed. Where we rely on legitimate interests we have considered your and others' rights and interests, and you may object (see Your rights below).
  • Consent — for any optional marketing emails and for the pre-launch waitlist. Where we rely on consent you can withdraw it at any time, including via the unsubscribe link or by emailing us. Withdrawing consent does not affect processing already carried out.
  • Legal obligation — to keep records we are required to keep (for example, tax, accounting and VAT records) and to respond to lawful requests from authorities.

We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR.

5. Reminder emails sent on your behalf

Reminder and chasing emails are sent on your behalf: the "From" name is you (or your business), and the "Reply-To" is your address, so your Client's reply reaches you directly. You authorise Badger to send these messages for you, and you are responsible for the accuracy and legitimacy of the underlying invoice or debt and for ensuring your communications with your Clients are lawful. Badger passes the message to our email delivery provider (Brevo) for sending; email deliverability ultimately depends on third parties and networks outside our control.

6. The optional AI rephrasing feature

If you switch on the optional AI feature, the wording of a reminder may be rephrased into your chosen tone by an AI model provided by Anthropic (Claude). Important safeguards:

  • All monetary figures, dates, invoice numbers and other hard facts are inserted by Badger deterministically and are verified after the AI has finished, so the AI cannot change any amount, date or reference.
  • The AI is used only to phrase text; it does not make decisions about your Clients.
  • To rephrase text, the relevant draft wording (which may include a Client name and invoice context) is sent to Anthropic as a sub-processor for that purpose only. This feature is off unless you enable it.

7. The statutory-interest / Letter Before Action feature

Badger can calculate the interest and fixed compensation potentially due on late UK business-to-business commercial invoices under the Late Payment of Commercial Debts (Interest) Act 1998, and can generate a print-your-own "Letter Before Action" pack for you to send or hand to an adviser yourself. This is a calculation and document tool, not legal advice, and Badger does not collect debts on your behalf. You are responsible for confirming that the statutory late-payment regime applies to your situation and for how you use any letter or figure it produces. This section is about how the feature works with your data; your legal responsibilities for using it are set out in our Terms of Service.

8. Sub-processors and other recipients

We use the following carefully selected suppliers to provide the Service. They process personal data on our instructions (as our sub-processors when we act as your processor for Client data, and as our processors when we act as controller of your account data). We share only what each supplier needs for its role.

  • Supabase — database hosting, authentication, and storage of data at rest.
  • Vercel — hosting and serving of the application.
  • Brevo (Sendinblue) — sending reminder emails and transactional/service emails.
  • Stripe — the card-payment rail you can optionally connect via Stripe Connect so your Clients can pay you, and the provider that bills your Badger subscription. Funds flow directly to you; Badger never receives them.
  • PayPal — an optional payment rail you can connect so your Clients can pay you directly.
  • Xero, FreeAgent and QuickBooks — optional read-only accounting integrations you can connect (via OAuth) to import your existing invoices. Access tokens are encrypted at rest.
  • Anthropic (Claude) — optional AI rephrasing of reminder wording, only if you enable it (see above).
  • Google — "Sign in with Google" authentication, only if you choose to use it.

We may also disclose personal data to professional advisers, or to law enforcement, regulators or courts, where we are legally required or permitted to do so, and to a successor entity in connection with a business reorganisation, merger or sale (in which case this policy will continue to apply, or you will be told of any change).

An up-to-date list of sub-processors is available on request at hello@getbadger.co.uk. Where we act as your processor, we will give you a reasonable opportunity to object to material changes to our sub-processors, as set out in our processor terms.

9. International transfers

Some of our suppliers are based outside the UK, or host or support data outside the UK (for example in the United States or the European Economic Area). Where personal data is transferred outside the UK, we rely on one of the safeguards recognised under UK data protection law, which may include:

  • the destination country being covered by UK "adequacy" regulations (for example, transfers within the EEA, or to a US organisation certified under the UK Extension to the EU–US Data Privacy Framework); or
  • the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum, plus any additional measures needed to protect the data.

You can ask us for more detail on the safeguards used for a particular supplier by emailing hello@getbadger.co.uk.

10. Cookies and similar technologies (PECR)

We keep this simple. Badger uses only strictly-necessary cookies — specifically the Supabase authentication/session cookie that keeps you securely logged in. This cookie is essential to provide the Service you have asked for, so under the Privacy and Electronic Communications Regulations (PECR) it does not require consent.

We do not use advertising cookies, cross-site tracking cookies, or non-essential analytics cookies, and we do not use any third-party website analytics that profile or track you. Because we set no non-essential cookies, we do not show a cookie consent banner — there is nothing for you to consent to.

11. How long we keep personal data

We keep your account data for as long as your account is active and for a reasonable period afterwards, and we keep records we are legally required to retain (such as billing and tax records) for the period required by law. For Client data that you load into Badger, we keep it for as long as you keep it in your account; we delete or return it in accordance with our processor terms when you delete it, close your account, or ask us to. Backups are cycled out on a rolling basis.

12. Security

We take appropriate technical and organisational measures to protect personal data, including:

  • encryption of data in transit (TLS);
  • encryption at rest of sensitive stored secrets — connected-integration tokens and similar credentials are encrypted using AES-256-GCM;
  • authentication and access controls, with access limited to what is needed to run the Service; and
  • use of reputable infrastructure providers (see Sub-processors above).

No online service can be guaranteed to be completely secure, but we work to protect your data and will notify you and, where required, the ICO of a personal data breach in line with our legal obligations.

13. Your rights

Under UK data protection law you have rights over your personal data, which (depending on the circumstances and the lawful basis we rely on) include the right to:

  • be informed about how we use your data (this policy);
  • access a copy of your data;
  • have inaccurate data corrected;
  • have data erased in certain circumstances;
  • restrict or object to certain processing (including processing based on legitimate interests);
  • data portability; and
  • withdraw consent where we rely on it.

To exercise these rights in relation to your own account data, contact us at hello@getbadger.co.uk. We will respond within the statutory time limits. Because we rarely need to charge, most requests are free.

If your request concerns a Client's data, remember that the Client's controller is the freelancer who loaded it, not Badger. If a Client contacts us directly, we will generally refer them to the relevant freelancer and assist that freelancer in responding, as our processor terms require.

14. Complaints

We would like the chance to resolve any concern first, so please contact us at hello@getbadger.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at https://ico.org.uk or by calling 0303 123 1113.

15. Children

Badger is a business tool intended for use by people aged 18 or over. It is not directed at children, and we do not knowingly collect personal data from children.

16. Changes to this policy

We may update this policy from time to time. If we make a material change we will take reasonable steps to tell you (for example, by email or an in-app notice) before it takes effect. The "Last updated" date at the top shows when it was last revised.

17. Contact

Questions about this policy or your personal data? Email hello@getbadger.co.uk.

This document is a good-faith template that reflects the practices described above. It is not legal advice. Before relying on it commercially, it should be reviewed by a qualified solicitor against the operator's final, real-world practices, suppliers and data flows.