Privacy policy
Last updated: [date]. [Your legal company name] ("we") operates InvoiceFlow and is responsible for your personal data. Contact: felicelse@gmx.com, [Your business address], [Your country].
What we collect
- Account data: name, email address, business name, password (stored only as a salted hash).
- Invoice data you enter: your clients' names and email addresses, line items, amounts, dates and notes.
- Payment data: plan, amount, coin, the public wallet address we showed you and the blockchain transaction ID. We never see your private keys. We don't collect card numbers.
- E-signature data: the document text you send, the signer's name and email, the signature they draw or type, and an audit trail (times, IP address and browser of the signer).
- AI assistant chats: the messages you type to the assistant and its replies, plus basic account context such as your plan and remaining sends.
- Usage data: invoices sent, API key last-used times, request rates, and technical logs (IP address, browser) for security and abuse prevention.
How we use it
- To provide the service: create, store and email invoices, run the API, activate plans.
- To send service emails: verification links, payment receipts, important notices.
- To keep the service safe: prevent fraud, spam and abuse, enforce limits.
- To meet legal obligations such as tax and accounting records.
We do not sell personal data and do not use it for advertising.
Who we share it with
- Email delivery provider (Amazon Web Services SES) to send invoices and service emails.
- Hosting and infrastructure providers that run our servers.
- Public blockchain data providers (such as mempool.space and TronGrid), which we query using our own wallet addresses to confirm payments. We do not send them your personal data.
- AI provider (Anthropic), which processes assistant chat messages to generate replies. Do not put passwords, keys or other secrets in the chat.
- Authorities where legally required.
Cookies and local storage
We use your browser's local storage to keep you signed in. We do not use advertising or tracking cookies.
Retention
We keep account, invoice and uploaded signature documents (including the signed PDFs) while your account is active, until you delete them. The free PDF tools run in your browser and do not upload your files; the few tools that use our server delete your file as soon as it is processed. You can download a copy of your data or delete your account yourself from the Account tab. Deletion removes your account, invoices, clients and keys. We keep records we must keep by law (for example payment records, without your invoice content) for the required period, and a list of email addresses that bounced or complained so we do not send to them again.
Security
Passwords and API keys are stored as one-way hashes, access is rate limited, and traffic is encrypted in transit. No system is perfectly secure, so please use a strong, unique password.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete your data, or object to certain processing. Email felicelse@gmx.com and we will respond within the time required by law. If you send invoices to your clients, you are the controller of their data and we act as your processor.
International transfers, children and changes
Our providers may process data in other countries; we use appropriate safeguards where required. The service is not directed at children under 16. We will post changes to this policy on this page with a new date.