Privacy Policy

What we collect

• Your account: your email address, used to sign you in with a one-time code.
• Your profile: your name or studio name, the kind of work you do, phone number and address — whatever you choose to put on your invoices.
• Your payment details: account holder name, bank, branch, account number, IFSC, SWIFT, UPI ID and PAN, if you add them. They are printed on your invoices so your clients can pay you.
• Your clients: names, billing addresses, GSTIN or tax IDs, contact details and notes you enter about the people and brands you bill.
• Your invoices and services: line items, amounts, dates, statuses, payment records, reminders and recurring schedules.
• Technical data: a sign-in session cookie, and the standard request logs (IP address, browser, time) our hosting provider keeps for a short period to run and secure the service.

We don’t use advertising or analytics trackers, and we don’t buy data about you from anyone else.

Why we use it

• To create your account and sign you in.
• To fill in and produce your invoices, PDFs, share links, reminders and exports.
• To create recurring invoice drafts on the schedule you set.
• To keep the service secure, fix problems, and prevent abuse.
• To contact you about your account or important changes to Invflow.

We process your data because you ask us to provide the service by signing up. We never sell it, and never use it for advertising.

Invoice share links

When you share an invoice, anyone with its link can open it without signing in — including the payment details printed on it. Links are long and random, and drafts are never public, but please only send a link to the person it is meant for.

Information about your clients

When you add a client, you are the one deciding what to store about them and why; we store and process it only to provide Invflow to you. Please make sure you are allowed to use the details you enter, and only enter what you need to invoice them.

Who processes your data

We use a small number of service providers, each only for the job below:

• Supabase — database and sign-in. Data is stored in Mumbai, India.
• Vercel — hosting. The app runs in Mumbai, India; pages may be delivered through Vercel’s global network.
• Resend — sends your sign-in code emails. Its sending servers are in Tokyo, Japan, so your email address and the code pass through them.
• Sentry — error reports, if enabled. Reports contain the error and where it happened in our code, not your cookies, request contents or IP address.

We don’t share your data with anyone else unless the law requires it, or to protect Invflow and its users from fraud or abuse.

Cookies and local storage

We use one essential cookie to keep you signed in, and your browser remembers whether you picked light or dark mode. There are no advertising or analytics cookies, so there’s nothing to opt out of.

How long we keep it

We keep your data for as long as you have an account. When you delete your account, your profile, clients, services and invoices are deleted immediately. Copies may remain in our providers’ encrypted backups for up to 30 days before they are overwritten.

How we protect it

Everything is sent over HTTPS and stored encrypted by our providers. Each account’s data is isolated at the database level, so one user can never read another’s clients or invoices. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Your rights

• See and correct your data: everything we hold is visible in the app, and you can edit it in Settings and on each client and invoice.
• Take it with you: export your invoices as CSV or a ZIP of PDFs from Settings.
• Delete it: Settings → Delete account removes your account and all its data.
• Nominate someone to exercise these rights for you if you are unable to.
• Complain: write to us first (below). If you’re not satisfied, you can approach the Data Protection Board of India.

Children

Invflow is for adults running their own work. You must be 18 or older to use it.

Changes to this policy

If we change this policy, we’ll update the date at the top. For important changes, we’ll let you know by email or in the app before they take effect.

Contact and grievances

For any privacy question, request or complaint, email mousoom.personal@gmail.com. Mousoom Mudoi handles these personally and will reply within 30 days. See also our Terms of Service.