Privacy policy

This policy explains how Invogital ("we", "us", "our") handles personal information when you visit invogital.com, create an account, use the app, or receive a document sent through it.

It applies together with our Terms of service. Please read both before you use the service.

For your account, your subscription and your use of the website, we decide how and why information is used, so we're responsible for it.

For the information a business puts into Invogital about its own customers and suppliers, such as names, contact details, invoices and payments, the business decides what's collected and why. We process that information on the business's behalf and only to provide the service. If you're a customer of a business that uses Invogital, please contact that business first about your information.

We collect only what we need to run the service:

• Account details: your name, email address, and your profile photo if you sign in with Google. Passwords are stored by our authentication provider only in hashed form.
• Business details you enter: trading and legal name, addresses, phone, email, website, tax and registration numbers, bank details, logo, currency, tax rates and document settings.
• Records you create: customers, products and services, quotations, invoices, payments and receipts, expenses and the receipt files you upload, notes and email templates.
• Emails sent through the service: recipients, subject, message, delivery status and the time sent.
• Contact form messages: your name, email address, company if you give it, and your message, so we can reply. We also keep a one-way hash of your IP address to stop spam.
• Subscription payments: your plan, the amount, the payment status and the payment reference from Ziina. Your card details are entered on Ziina's payment page and aren't shared with us.
• Account activity: changes to documents and settings, with who made them and when, so your records have a reliable history.
• Technical information: IP address, browser and device type, pages requested, errors and timestamps, recorded in our providers' logs to keep the service secure and working.

If a business sends you an invoice, quotation, receipt or statement through Invogital, we process your name, contact details and the document on that business's behalf. We deliver the email or link, and record when a document link is first opened so the business can see it. If you accept or decline a quotation online, your answer is recorded for the business.

Anyone who has a document link can open it, so please keep links private. The business can replace a link at any time. We don't use your information to market to you.

We use information to run and improve the service. We don't sell personal information, we don't use it for advertising, and we don't use your business records for anyone else's purposes.

Specifically, we use it to:

• Provide the service: store your records, calculate totals, create PDFs, and send the emails and links you ask us to send
• Create and protect your account, including email confirmation, password resets and Google sign-in
• Take subscription payments and keep a record of what you've paid
• Keep the service secure, and detect and prevent fraud, abuse and unauthorised access
• Answer support requests
• Tell you about changes to the service, your plan or these policies
• Find and fix problems, and understand how the service performs

Depending on the information and where you are, we rely on these grounds:

• Our contract with you: running your account and the features you use
• Legitimate interests: keeping the service secure, preventing abuse and improving how it works, balanced against your rights
• Legal obligations: keeping payment records and responding to lawful requests
• Consent: where we ask for it. You can withdraw consent at any time.

We share information only with the providers that run parts of the service for us, and only what each one needs. They may use it only to provide their service to us:

• Supabase: database, sign-in and file storage
• Vercel: website and application hosting
• Resend: delivery of emails sent from the service
• Ziina: card payments for subscription plans
• Google: Sign in with Google, if you choose to use it
• Hostinger: our support mailbox, when you email us

We may disclose information when the law requires it, or when it's needed to protect the rights, safety or property of our users, the public or us. If our business is merged, acquired or sold, information may be transferred as part of it, and this policy will continue to apply to it.

When you share a document by WhatsApp, the message is sent from your own device, and WhatsApp's own terms and privacy policy apply.

Our database and uploaded files are stored in Mumbai, India. Some providers, including Vercel, Resend and Google, may process information in other countries, such as the United States.

When information is transferred to another country, we rely on our providers' contractual commitments and security measures to protect it, as applicable data protection laws require.

We use only essential cookies, which keep you signed in and protect your session. We don't use advertising cookies, analytics trackers or cross-site tracking.

The sign-in and sign-up pages load Google's sign-in service, which may set its own cookies when you use Sign in with Google. If you block cookies in your browser, you won't be able to stay signed in.

We keep account and business information for as long as your account is open.

Issued invoices, receipts and payments are cancelled or voided rather than erased, because businesses need a complete record for tax and accounting. Your business may be legally required to keep these records for several years, so export them before you close your account.

When you ask us to close your account, we delete or anonymise your information within 90 days. We keep only what the law requires, such as records of subscription payments, and information in logs and backups held by our providers, which expires on their schedules.

Connections are encrypted, and our providers encrypt stored data. Each business's records are kept apart inside the database itself, every request checks who you are and what your role allows, and uploaded files are stored privately and shared only through short-lived links.

Passwords are stored only in hashed form, and document links use long random codes that can be replaced. No system is completely secure. If a breach affects your information, we'll tell you, and the authorities where the law requires, without undue delay.

You can view, change and export most of your information directly in the app. For anything else, email support@invogital.com. We'll reply within 30 days, and we may need to confirm your identity first.

Depending on where you live, including under the UAE Personal Data Protection Law and the EU and UK GDPR, you may have the right to:

• Access the information we hold about you and get a copy of it
• Correct information that's wrong or incomplete
• Delete your information, apart from records we must keep
• Receive your records in a portable format
• Object to or restrict some uses of your information, and withdraw consent you've given
• Complain to a data protection authority

Invogital is a tool for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children.

When we change this policy, we'll update the date at the top of this page. If a change is significant, we'll tell you by email or in the app before it takes effect.

Questions or requests about privacy: support@invogital.com. Please put "Privacy" in the subject line.