Privacy Policy

This Policy applies to personal information we handle in two different roles:

• As a controller (business operator). When you register for and use the Service as our customer, we determine how your account and usage information is handled, and we act as the controller (or “business”) of that information.
• As a processor (service provider). When you, as our customer, enter information about your own clients (“End Customers”) and create invoices, you control that information and we process it on your behalf and under your instructions to provide the Service. For that information, you are the controller and we are a processor (or “service provider”). If you are an End Customer with questions about how your information is used, please contact the business that issued your invoice; we will support that business in responding to your request.

Information you provide to us. We collect information you give us when you use the Service, including:

• account and registration details, such as your name, email address, password, and business information;
• billing information needed to start and manage a paid subscription (processed by our payment provider, as described below);
• Customer Data you input, such as End Customer names, contact details, and the line items, amounts, and notes you place on invoices; and
• communications you send us, including support requests and feedback.

Information we collect automatically. When you use the Service, we automatically collect certain technical information, such as IP address, device and browser type, log and usage data, the pages or features you use, and timestamps. We collect some of this information using cookies and similar technologies (see Section 5).

Information from third parties. We may receive information from service providers that support the Service, such as our payment processor (for example, confirmation that a payment succeeded or failed) and our hosting, analytics, and email-delivery providers.

Sensitive information. The Service is not designed to collect sensitive or special categories of personal information (such as government identifiers, health, or financial-account details beyond what the payment processor handles). Please do not enter such information into invoice fields.

Where we act as a controller, we use personal information to:

• provide, operate, maintain, and secure the Service, including creating and delivering invoices;
• process subscriptions, payments, and free trials, and send related billing and account notices;
• respond to your requests and provide customer support;
• monitor, troubleshoot, and improve the Service and develop new features;
• detect, prevent, and address fraud, abuse, security incidents, and technical issues;
• comply with legal obligations and enforce our Terms and Conditions; and
• send you administrative or, where permitted, marketing communications (you can opt out of marketing at any time).

Where we act as a processor, we use Customer Data, including End Customer information, only to provide the Service to you and as instructed by you, and not for our own independent purposes.

Payments for subscriptions are processed by our third-party payment processor, Stripe. Your payment-card details are collected and handled by that processor under its own privacy policy and security standards. We do not store full payment-card numbers on our systems; we may retain limited details such as the last four digits, card type, and billing contact for recordkeeping.

We use cookies and similar technologies to keep you signed in, remember your preferences, maintain security, and understand how the Service is used. We may use analytics tools, such as Google Analytics, to help us measure and improve performance. You can control cookies through your browser settings; disabling some cookies may affect how the Service works. Some browsers send “Do Not Track” or Global Privacy Control (GPC) signals. Where applicable law requires, we treat a valid GPC signal as a request to opt out of the “sale” or “sharing” of personal information. For more detail about the specific cookies we use, see our Cookie Policy.

We do not sell your personal information. We share personal information only as described below:

• Service providers and sub-processors. We share information with vendors that help us run the Service, including Google Cloud Platform (hosting and storage), Stripe (payments), Brevo (sending invoice emails), and Google Analytics (analytics). These providers may process information only to perform services for us.
• At your direction. When you create and send an invoice, we share it with the recipients you designate (your End Customers).
• Legal and safety. We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Company, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.
• With your consent. We may share information for other purposes with your consent.

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. PDF invoices generated through the Service are stored in private storage and are automatically deleted approximately seven (7) days after they are generated, so you should download and keep your own copies of any records you need. We generally retain account information while your account is active and for [ACCOUNT DATA RETENTION PERIOD] afterward, unless a longer period is required by law (for example, for tax or accounting purposes). When acting as a processor, we delete or return Customer Data in accordance with your instructions and our Terms, subject to routine backups that expire on a rolling basis.

We use reasonable administrative, technical, and organizational measures designed to protect personal information, such as encryption in transit, access controls, and private storage of invoice files. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us of any suspected unauthorized access.

We operate in the United States, and our infrastructure is hosted in [HOSTING REGION] (a United States region of Google Cloud Platform). If you access the Service from outside the United States, you understand that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

Depending on where you live, you may have some or all of the following rights regarding personal information we hold about you as a controller:

• Access and portability — to know what personal information we process and to receive a copy;
• Correction — to request that we correct inaccurate personal information;
• Deletion — to request that we delete your personal information, subject to legal exceptions;
• Opt-out — to opt out of the “sale” or “sharing” of personal information or targeted advertising (we do not sell personal information); and
• Non-discrimination — to not be discriminated against for exercising your rights.

To exercise these rights, contact us at [PRIVACY EMAIL]. We will verify your request and respond within the time required by applicable law. You may use an authorized agent where permitted. If we deny your request, you may appeal within a reasonable time by emailing [PRIVACY EMAIL] with “Appeal” in the subject line. This appeal right applies to residents of states such as Texas whose laws require it; if we deny your appeal, you may submit a complaint to your state attorney general (for example, the Texas Attorney General).

Texas and other U.S. state residents. Residents of Texas (under the Texas Data Privacy and Security Act) and of other states with comprehensive privacy laws, including California (CCPA/CPRA), may exercise the applicable rights above. The categories of personal information we collect, use, and disclose are described in Section 2. We do not sell personal information, and we do not share it for cross-context behavioral advertising; if that ever changes, we will provide the notice and opt-out that the law requires, including by honoring recognized opt-out preference signals. Because we do not collect sensitive personal information beyond what our payment processor handles, the right to limit the use of sensitive personal information does not apply; if that changes, we will update this Policy.

End Customers. If your personal information was entered by a business that uses our Service to invoice you, that business is the controller. Please direct your privacy requests to that business; we will assist them as their processor.

The Service is intended for businesses and is not directed to children. The Service is restricted to users 18 and older, and we do not knowingly collect personal information from anyone under 18 (including children under 13 under the U.S. Children’s Online Privacy Protection Act). If you believe a child has provided us personal information, contact us at [PRIVACY EMAIL] and we will take appropriate steps to delete it.

The Service may contain links to third-party websites or integrate third-party services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated Policy with a new “Last Updated” date and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect constitutes your acceptance of the updated Policy.

If you have questions or requests regarding this Policy or your personal information, contact us at: