Privacy Policy

InvoizeFlow is invoicing and billing software for businesses. This policy covers our website, invoizeflow.com, the web app at app.invoizeflow.com, and our mobile apps.

We handle two kinds of information, and our role is different for each:

• Information about you as our customer: your account, your plan and your messages to us. We decide how this is used, as this policy describes.
• Information inside your business: your clients, suppliers, products, invoices and payments. You decide what goes in and what it is for. We store and process it to provide InvoizeFlow to you, and we don't use it for anything else, such as marketing.

If you received an invoice from a business that uses InvoizeFlow, that business is responsible for your details. Please contact them first; we'll help them answer you.

Your account

• Your name, email address and password. We store the password only as a one-way hash, so nobody at InvoizeFlow can read it.
• Your phone number, if you add one to your profile.
• Your time zone, and the page or campaign that brought you to sign up.
• If you sign in with Google: the name, email address and account ID of your Google account.
• A history of your sign-ins and security events: the time, your IP address and your browser or device.

Your business

• The details you enter about it: name, address, phone, GSTIN and GST registration, Udyam details, logo and signature.
• The bank, UPI and other payment details you choose to print on your invoices.
• The keys you give us to connect services such as your Razorpay account. Their secret parts are stored encrypted.
• What you create and record: clients and suppliers and their contact details, products, invoices, estimates, purchase orders, expenses and receipts, payments, notes and attachments.
• The people you invite to work with you, by email address, and their roles.
• An activity log of the changes made in the business: who made each one, when, and from which IP address. The business's owner and admins can read it.

When you pay us

• Your plan and your payments to us.
• When you pay in rupees, the billing name, GSTIN, address and email address for your GST invoices.
• Card and UPI details are entered on the payment pages of our payment providers, Stripe and Razorpay. We never see or store your card number.

When you contact us

• Messages sent through our contact form: your name, email address, company, what you're interested in and your message.
• Support conversations, bug reports, feature suggestions and feedback, with any files you attach. We strip location and other hidden data from the screenshots and photos you attach to a support message or a bug report.
• With a bug report, details that help us reproduce the problem: the app version, the screen you were on (not its full address), your type of device, browser and operating system, your language, time zone and screen size, your last few requests to our servers and any error you saw. You can leave these out when you send the report.

When you use our free tools

The invoice and document generators on our website send what you type to our servers to work out the totals and make the PDF. Nothing you type is saved on our servers, and it is left out of our error reports. Your drafts are kept in your own browser so you can come back to them. If you choose to save a draft to InvoizeFlow, it goes to your account without its images so you can finish it in the app; it expires after 7 days.

From our mobile apps

• A notification token for your device, so that we can send you notifications.
• The version of the app, sent with each request.
• Photos you take or choose to attach to a receipt, logo or signature. The app asks your permission before it uses your camera or your photos.

About your clients, when you send them documents

When you send an invoice, estimate or reminder, we email it to your client in your business's name, with a link where they can view it. When they open the link, we tell you it has been viewed. These links expire, and you can turn a link off at any time.

• To provide InvoizeFlow: to keep your records, produce your documents, send the emails and notifications you ask for, and show you reports.
• To keep accounts secure: to verify email addresses, slow down repeated sign-in attempts, notice unusual sign-ins and sign out your other devices when your password changes.
• To bill you: to take payments for your plan and issue the invoices the law requires.
• To support you: to answer your messages, look into problems you report and fix bugs.
• To run the service: to count how InvoizeFlow is used, for example how many invoices are created, without looking at what they contain.
• To meet legal obligations, such as keeping financial records and answering lawful requests from authorities.

We email you about your account: to verify your address, reset your password, and tell you about your plan and payments. We don't send you marketing emails unless you've agreed to receive them.

We don't sell your personal information, we don't show advertising, and we don't use the contents of your business for our own marketing.

People you choose

• The people you invite see your business as far as the role you give them allows.
• Your clients see what you send them: documents, links and reminders.

Companies that help us run InvoizeFlow

Each of these receives only what it needs for its part:

• Hosting: the servers and databases InvoizeFlow runs on.
• Email delivery: the services that deliver our emails, including the invoices and reminders you send.
• Stripe: payments for InvoizeFlow plans in US dollars, and your clients' payments if you connect your own Stripe account. For our plans, Stripe receives your name and email address.
• Razorpay: payments in rupees, and your clients' payments if you connect your own Razorpay account. For our plans, Razorpay receives your name, email address and phone number.
• Google: Google sign-in, if you use it; Firebase Cloud Messaging, which delivers notifications to our mobile apps; the fonts and the sign-in script the web app loads from Google, so Google receives your IP address when you open the web app; and Google Analytics on our website, only if you accept analytics cookies.
• Apple: Apple's push notification service, which delivers notifications to iPhones.
• Sentry: reports of errors on our servers, so we can fix them. We remove passwords, access tokens, keys and tax identifiers from these reports before they are sent.
• GSTINAPI: when you ask us to verify a GSTIN, we send that GSTIN, and nothing else, to look it up in the GST register.

Other cases

• When the law requires it, for example a valid order from a court or a tax authority, or to protect the rights, property or safety of our users, the public or InvoizeFlow.
• If InvoizeFlow is merged, sold or reorganised, your information may pass to the new owner, who must protect it as this policy describes.

Some of these providers process information outside India, including in the United States. Where the law sets conditions on sending personal information abroad, we follow them.

Our website

Our website sets no cookies unless you agree to analytics. If we ask and you choose Accept, we load Google Analytics, which sets its own cookies to count visits; its advertising features stay switched off. If you decline, or later change your mind, we remove those cookies.

The website also keeps a few things in your browser's storage: your answer about cookies (for a year), light or dark mode, the region you picked for prices, and your drafts from the free tools.

The web app

The web app sets no cookies of its own. It uses your browser's storage to keep you signed in, to remember settings such as light or dark mode, and to hold a sign-up link or a free-tool draft for up to 7 days. Signing out removes your sign-in details from the browser.

The mobile apps

The apps keep your sign-in in your phone's secure storage, and your name, email address and settings in the app's own storage. Signing out removes your sign-in and your details.

• Your account and your business records: for as long as your account is open.
• Your sign-in history: 90 days.
• Messages sent through our contact form: 2 years, then they are deleted automatically.
• Support conversations, bug reports and feedback: for as long as they help us support you and improve InvoizeFlow. Ask us and we'll delete yours.
• Our billing records and tax invoices: for as long as tax law requires us to keep them.
• What you type into our free tools: not kept on our servers.

Closing your account. You can ask us to close your account at any time. When we close it, you are signed out everywhere and can no longer sign in, you are removed from businesses you don't own, and your devices stop receiving notifications. We keep the account record and the records of the businesses you own, because invoices and payments are financial records that you, and we, may have to keep by law. If you want them deleted, tell us: we'll delete what we can and tell you what the law requires us to keep.

• Information travelling between your device and InvoizeFlow is encrypted (HTTPS).
• Passwords are stored only as one-way hashes, and the secret keys you give us for other services are encrypted.
• Email addresses are verified, repeated failed sign-ins are slowed down, and changing or resetting your password signs out your other devices.
• Our staff use separate accounts that need a second sign-in step. They can see your account, your plan and the support conversations you start, but not the invoices, clients and other records inside your business. The changes they make are recorded.

No system is perfectly secure. If a breach affects your personal information, we'll tell you and the authorities as the law requires. Please use a strong password that you don't use anywhere else, and tell us straight away if you think someone else has used your account.

You can see and correct most of your information yourself, in your profile and your business settings. You can also ask us to:

• give you a summary of the personal information we hold about you and what we do with it;
• correct, complete or update it;
• delete it, unless the law requires us to keep it;
• stop using it for something you agreed to, such as analytics on our website;
• let someone you name act for you if you die or become unable to act yourself.

Write to us at hello@invoizeflow.com from the email address on your account, so we can be sure the request is yours. We'll answer within the time the law allows, and if we can't do something, we'll tell you why. If you're not satisfied with our answer, you can complain to the Data Protection Board of India, or to the data protection authority where you live.

You can also turn notifications on or off in the app or in your phone's settings, decline analytics cookies on our website, and leave out the technical details when you report a bug.

InvoizeFlow is for businesses and is not meant for anyone under 18. We don't knowingly collect information about children. If you believe a child has given us their information, contact us and we'll delete it.

When our practices change, we'll update this page and the date at the top. If a change affects how we use your information, we'll tell you by email or in the app before it takes effect. Our Terms of Service explain the rest of our agreement with you.

For questions or requests about your privacy, write to hello@invoizeflow.com.