Part C: Privacy Policy
MSP Billing Privacy Policy. Version 1.0, last updated 15 October 2026.
1. Who we are
FinOptic Ltd (company number 17523265, registered office 30 Commerce Square, Nottingham, NG1 1HS), trading as MSP Billing, is the controller of the personal data described in sections 3 and 4 below. We are registered with the Information Commissioner's Office, registration number ZC275862. Contact us at j.doherty@mspbilling.cloud. We have not appointed a Data Protection Officer because the law does not require one.
MSP Billing is a platform that helps managed service providers (MSPs) reconcile billing data across their PSA, RMM, distributor and accounting systems. It is for businesses only.
2. Two roles, so please read both
| Role | What it covers | Where it is explained |
|---|---|---|
| We are the controller | Data about our customers' users, website visitors, sign-ups and enquiries | Sections 3 and 5 to 11 of this policy |
| We are the processor | The billing and client data an MSP connects to the Service, which belongs to that MSP | Section 4 and our Data Processing Agreement |
3. Data we collect for our own purposes
| Data | Examples | Why we use it | Our lawful basis |
|---|---|---|---|
| Account data | Name, work email, organisation, role | To create and run your account and send service emails | Contract; legitimate interests (running our business) |
| Sign-in and security data | IP address, timestamps, browser details, audit log of actions such as connecting a system | To keep the Service secure, prevent abuse and investigate incidents | Legitimate interests (security) |
| Trial and sign-up records | Name, email, organisation, trial dates, version of terms accepted | To run the trial, enforce one trial per organisation, and prove what was agreed | Contract; legitimate interests |
| Billing contact data | Name, email, billing address, payment status | To invoice and collect payment | Contract; legal obligation (tax and accounting records) |
| Support communications | Emails and messages you send us | To answer questions and fix problems | Contract; legitimate interests |
| Product emails | Trial reminders, deletion warnings, change notices | To tell you things you need to know about the Service | Contract; legitimate interests |
| Marketing emails | Email address, preferences | To tell you about MSP Billing | Legitimate interests (and the "soft opt-in" under PECR where it applies); consent where required. You can opt out at any time |
| Website data | Contact form entries; essential cookies | To respond to enquiries and keep the site working | Legitimate interests (see our Cookie Notice) |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you using solely automated processing that has legal or similarly significant effects.
4. Data we process on behalf of our customers
4.1 When an MSP connects a system to MSP Billing, we store the credentials or tokens needed to connect and pull billing data such as client names, product names, quantities, prices and invoice totals. This can include names and contact details of people at the MSP's clients.
4.2 For this data the MSP decides why and how it is used, and we act only on its instructions under our Data Processing Agreement. We do not use it for our own purposes, except for aggregated data that cannot identify the MSP or its clients, as the Terms allow.
4.3 If you are an individual whose details appear in an MSP's systems, please contact that MSP first. If you contact us, we will pass your request to the MSP.
5. Who we share data with
- Our suppliers (sub-processors) who host the Service and send emails for us. They are listed on our sub-processor page and act on our instructions.
- The systems you connect. When you run a feature that sends a draft invoice to your accounting system, we send it there because you asked us to.
- Professional advisers such as lawyers, accountants and insurers, under confidentiality duties.
- Authorities, where the law requires it or a valid legal process is served.
- A buyer or successor, if our business or assets are transferred (see clause 22.2 of the Terms), who must honour this policy.
- Our payment provider, Stripe, which processes card and payment details for subscription payments under its own privacy notice.
6. Transfers outside the UK
Some suppliers are based outside the UK. Where personal data is transferred, we make sure it is protected by UK adequacy regulations (including the UK-US data bridge) or by safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Our sub-processor page states the safeguard for each supplier.
7. How long we keep data
| Data | How long |
|---|---|
| Connection credentials and tokens | Deleted when you disconnect a system, or immediately when your trial or agreement ends |
| Free trial data | Deleted 14 days after the trial ends (from backups within a further 35 days) |
| Customer data of paying customers | Deleted 30 days after the agreement ends (from backups within a further 35 days) |
| Records of terms accepted | 6 years from acceptance for paying customers; 12 months after the trial ends for trial-only sign-ups |
| Trial and sign-up records (not converted) | 12 months after the trial ends |
| Invoices and tax records | 6 years, as the law requires |
| Security and audit logs | [12] months |
| Support emails | [2] years after the matter closes |
| Marketing preferences | Until you opt out, then a suppression record so we do not email you again |
We may keep data longer where the law requires it or where it is needed to deal with a legal claim.
8. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption of connection credentials, access controls, rate limiting and audit logging. No system is perfectly secure, and we will tell you and the regulator about a breach where the law requires.
9. Your rights
Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or stop our use of it, and (where it applies) to move it to another provider. You can object to processing that relies on legitimate interests, and withdraw consent at any time where we rely on it. To use these rights, email j.doherty@mspbilling.cloud. We normally respond within one month.
10. Complaints
If you are unhappy with how we handle your data, please tell us first at j.doherty@mspbilling.cloud. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, at any time.
11. Children
The Service is for businesses and is not directed at anyone under 18.
12. Cookies
We explain our use of cookies in our Cookie Notice.
13. Changes to this policy
We will update this policy from time to time. For material changes we will give you 30 days' notice by email or in the Service. The date at the top shows when it was last updated.