1. Who controls your data
Thomas Jerman, trading as InvoiceFlow (“InvoiceFlow”, “we”, “us”), is the data controller for personal data handled through the service. For privacy questions or requests, contact us through the support contact shown in InvoiceFlow or on your purchase receipt.
2. Data we collect and why
- Account and profile data, such as your name, email address, business details and login identifiers, to create and secure your account and provide the service.
- Invoice and customer data, including customer details, invoice contents, notes and recurring billing settings, to provide the invoicing tools you request.
- AI input and output, including work descriptions you submit and drafted line items, to provide the AI drafting feature.
- Support communications and related contact details, to answer questions and resolve issues.
- Usage, device and technical data, such as IP address, browser information, activity logs and security events, to operate, protect and improve InvoiceFlow and prevent fraud or abuse.
We do not collect your full payment card details. Paddle handles payment information under its own privacy notice.
3. Legal bases
We process account, profile, invoice, customer and AI-feature data as necessary to perform our contract with you. We process security, fraud-prevention and service-improvement data for our legitimate interests in running a safe and reliable service. We rely on consent where the law requires it, including for optional cookies or marketing, and on legal obligation where records must be retained by law.
4. Who receives data
We share data only as needed with hosting, database, authentication, AI processing, monitoring and customer-support providers; professional advisers such as legal and accounting advisers; and authorities when required by law. Paddle, our Merchant of Record, receives data needed to sell the product, manage subscriptions and payments, calculate and remit taxes, prevent fraud and issue invoices or receipts. We do not sell personal data.
5. International transfers
Our providers may process data outside your country, including outside the UK or European Economic Area. Where required, we use safeguards such as adequacy decisions, the European Commission’s Standard Contractual Clauses, or equivalent lawful transfer mechanisms.
6. Retention
We retain account and service data while your account is active and for a reasonable period afterward to provide exports, resolve disputes, prevent fraud and meet legal obligations. Financial and transaction records may be kept for legally required periods. When data is no longer needed, we delete or anonymise it.
7. Your rights
Depending on where you live, you may request access, correction, deletion, restriction or portability of your data; object to certain processing; or withdraw consent at any time. UK and EEA users may also complain to their local data-protection authority. We normally respond to valid UK or EEA requests within one month. Some rights may be limited where we must retain information by law or need it to establish or defend legal claims.
8. Security
We use appropriate technical and organisational safeguards, including encryption in transit, access controls, account authentication, data-isolation rules and restricted administrative access. No online service can guarantee absolute security.
9. Cookies and local storage
InvoiceFlow uses essential browser storage and similar technologies for sign-in, security, preferences and core service operation. We do not currently use optional advertising cookies. If analytics or marketing cookies are introduced, we will provide any notice and choice required by law. You can manage browser storage in your browser settings, although blocking essential storage may prevent the service from working.
10. Changes
We may update this notice as the service or law changes. We will post the revised notice here, update its date and provide additional notice when a material change requires it.