Privacy Policy

1. Introduction

Welcome to Invoiceitt. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our invoice management platform.

By using Invoiceitt, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our service:

• Account Information: Name, email address, password, organization name, phone number
• Business Information: Business address, GST number, logo
• Invoice Data: Client information, invoice details, line items, notes
• Communication Data: Messages, support inquiries, and feedback you send to us

2.2 Payment Information

We collect payment-related information to generate invoices and QR codes:

• UPI ID: Used solely to generate payment QR codes on your invoices. We do not process payments or have access to your UPI transactions.
• Bank Details: Account number, bank name, and IFSC code are displayed on invoices for your clients. We do not initiate any bank transactions.

2.3 Automatically Collected Information

When you access our service, we automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, features used, time spent)
• Cookies and similar tracking technologies
• Log data (access times, error logs)

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide Services: Create and manage invoices, send emails, generate PDFs and QR codes
• Account Management: Create and maintain your account, authenticate users
• Communication: Send transactional emails, service updates, and support responses
• Improve Service: Analyze usage patterns, fix bugs, develop new features
• Security: Detect and prevent fraud, unauthorized access, and security incidents
• Legal Compliance: Comply with applicable laws and regulations

3.1 Legal Basis for Processing

We process your personal data based on:

• Consent: When you create an account and agree to this policy
• Contract: To provide the invoicing services you requested
• Legal Obligation: To comply with tax and accounting laws
• Legitimate Interest: To improve our services and prevent fraud

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: Third-party vendors who help us operate our service (email delivery, cloud hosting, analytics)
• Invoice Recipients: Client information included in invoices is shared when you send invoices via email or share links
• Legal Requirements: When required by law, court order, or government authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share your information

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Password hashing using bcrypt
• Secure database access controls
• Regular security audits and updates
• Limited employee access to personal data

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

5.1 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you via email within 72 hours of becoming aware of the breach, along with details of the incident and steps we are taking to address it.

6. Data Retention

We retain your data for the following periods:

• Account Data: Until you delete your account, plus 90 days for complete removal
• Invoice Data: 7 years from creation date (to comply with Indian tax and accounting requirements under the Income Tax Act and GST laws)
• Log Data: 12 months for security and debugging purposes
• Email Records: 3 years for transactional emails sent through our platform

After account deletion, we anonymize or delete your data within 90 days, except where required by law (e.g., GST records, financial transactions under the Income Tax Act).

7. Your Privacy Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and personal data
• Data Portability: Export your invoice data in a machine-readable format (PDF, CSV)
• Withdraw Consent: Withdraw your consent at any time by deleting your account
• Opt-out: Unsubscribe from marketing communications (note: transactional emails will still be sent)
• Grievance Redressal: File a complaint if you believe your data has been mishandled

To exercise these rights, contact us at billing@invoiceitt.com. We will respond to your request within 30 days.

8. Cookies and Tracking

We use cookies and similar technologies to:

• Essential Cookies: Maintain your login session and remember your preferences
• Analytics Cookies: Analyze service usage and performance (via Google Analytics)

You can control cookies through your browser settings, but disabling essential cookies may affect your ability to use certain features. We do not use cookies for advertising purposes.

9. Third-Party Services

Our service integrates with third-party providers:

• Email Delivery: Resend (for sending invoice emails)
• Cloud Hosting: Vercel (application hosting)
• Database: PlanetScale (data storage)
• Analytics: Google Analytics (usage tracking, anonymized IP)
• Error Monitoring: Sentry (application error tracking)

These providers have their own privacy policies and are bound by data processing agreements. We encourage you to review their policies.

10. Public Invoice Pages

When you send an invoice, a public link is generated (e.g., invoiceitt.com/i/abc123). This page is accessible to anyone with the link and displays:

• Your business name, address, and contact information
• Your client's name and contact details (as entered)
• Invoice items, amounts, and payment terms
• Your UPI QR code and/or bank details

11. Children's Privacy

Our service is designed for businesses and professionals. It is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us immediately at billing@invoiceitt.com.

12. International Data Transfers

Your data may be transferred to and processed in countries outside of India where our service providers operate (e.g., United States for cloud hosting). We ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place, including standard contractual clauses and data processing agreements with our vendors.

13. Compliance with Indian Law

We comply with the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable Indian data protection laws. As a Data Fiduciary under the DPDPA:

• We process your personal data only for lawful purposes with your consent
• You have the right to withdraw consent at any time by contacting us or deleting your account
• We maintain reasonable security safeguards to protect your data
• We will notify you and relevant authorities in case of a data breach as required by law

We also comply with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 where applicable.

14. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, the name and contact details of the Grievance Officer are provided below:

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our service at least 30 days before the changes take effect. Your continued use of the service after changes become effective constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: