Privacy Policy

This policy explains how invoiqo handles personal data in invoiqo, in line with India's Digital Personal Data Protection Act, 2023.

1. Two kinds of data

• Your account data: the name, email, phone number and business details of you and your team. For this data we decide how it is used.
• Your business records: details of your customers and suppliers, invoices and payments that you enter. You decide what is stored and why; we process it only on your instructions to provide the Service. If you hold personal data of your customers, you are responsible for having a lawful reason to do so.

2. What we collect

• Account and contact details you give when registering and inviting users.
• Business records you enter, import or upload (including scanned bills when you use AI bill scanning).
• Subscription and payment status from Razorpay. We do not receive or store your card or bank details.
• When you pay for a plan by UPI: the amount, the UPI reference number (UTR) and a masked form of the UPI ID you paid from, taken from our bank's payment alert, used only to confirm your payment. Alerts are deleted after 90 days.
• Technical data needed to run and secure the Service: sign-in times, IP address, device type and error reports.

In the Android app, additionally:

• Notifications: a notification token from Google Firebase Cloud Messaging and your phone's model name, so we can send the notifications you choose to receive (payments received, support replies, enquiries, the daily summary) and show where you are signed in. They are deleted when you sign out.
• Camera: used only on your phone to scan product barcodes. No pictures are stored or sent to us.
• Fingerprint or screen lock: checked by Android on your phone. We never receive fingerprints or any biometric data.
• Offline copy: your customers, suppliers, products and recently opened documents are kept on your phone so you can view them without internet. Signing out deletes them from the phone.

3. Why we use it

• To provide the Service, including GST calculations, documents, reminders and reports.
• To secure accounts, prevent fraud and fix errors.
• To bill subscriptions and send service messages (e.g. password resets, payment reminders you enable, data exports).
• To meet legal obligations such as tax and accounting record-keeping.

We do not sell personal data and we do not use your business records to advertise to you or to your customers.

4. Who processes it for us

We use service providers who process data only on our instructions: our hosting provider (servers in India), email delivery, Razorpay for payments, Google Firebase Cloud Messaging to deliver the Android app's notifications, and an error-tracking service. When you use AI features, the text or images you submit are sent to our AI provider (Anthropic, or another provider we name in the app) to produce the result; this may involve processing outside India. AI features can be turned off in Settings.

5. How long we keep it

We keep your data while your account is open. When you close it, we stop using it and keep your records only for as long as tax and accounting law requires (GST law requires business records to be kept for 72 months), then delete them. Uploaded bills used for AI scanning are deleted after 30 days; data exports after 72 hours.

6. Your rights

You can access and correct your data in the app, download all of it (Settings → Data & privacy → Export), close your account (see how to delete your account), and withdraw consent for optional processing such as AI features. You may also nominate someone to exercise these rights for you. To exercise a right or raise a complaint, contact our Grievance Officer below; we will respond within the time the law requires. If you are not satisfied, you may complain to the Data Protection Board of India.

7. Security

Data is encrypted in transit; passwords are hashed; payment-gateway secrets@if (config('backup.backup.password')) and backups@endif are encrypted; each business's data is isolated from others; staff access is restricted by role. No system is perfectly secure, and we will notify you and the authorities of a personal data breach as the law requires.

8. Cookies

We use only the cookies needed to keep you signed in and to protect forms. We do not use advertising or tracking cookies.

9. Children

The Service is for businesses and is not intended for anyone under 18.

10. Changes

We will post changes here and tell you in the app or by email before material changes take effect.

11. Grievance Officer and contact

Grievance Officer, invoiqo. Email hello@app.invoiqo.in.