Introduction & Scope
Welcome to Invorio ("Invorio", "Company", "we", "us", or "our"). Invorio is a cloud-based software-as-a-service application operated at https://invorio.app designed to provide businesses, freelancers, agencies, and enterprises with tools to create, customize, calculate, manage, and dispatch professional digital invoices, quotations, and commercial billing documentation.
This Privacy Policy sets out how we collect, process, store, disclose, and safeguard personal information when you:
- Visit our public website, marketing materials, and documentation at
invorio.app. - Register for an Invorio account, authenticate via single sign-on (SSO), and use our authenticated web portal.
- Input, manage, and store client records, product catalogues, bank details, tax IDs, and digital signatures.
- Generate, share, or view public invoices, billing previews, and payment QR codes.
Key Guarantee:We do not sell your personal data, your business profile, or your clients' invoice contents to any third party. Your business documents belong exclusively to you.
Data Controller vs. Data Processor Roles
Depending on the nature of the data and your relationship with our platform, Invorio operates under distinct legal capacities defined under data protection frameworks like the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA):
We act as a Data Controller for information related to your account creation, billing registration, direct communications with our team, and diagnostic usage telemetry collected to operate, secure, and improve the platform.
When you enter your customers' names, addresses, emails, and invoice line items into Invorio, you are the Data Controller of that customer information, and Invorio acts solely as a Data Processor performing services on your documented instructions.
If you are an enterprise or European economic entity requiring a signed Data Processing Addendum (DPA) incorporating Standard Contractual Clauses (SCCs), please contact our legal team at eliasemon0025@gmail.com.
Information We Collect
We collect personal data across four main categories to deliver, power, and safeguard our services:
badgeA. Account & Business Profile Data
Provided directly when you sign up, complete onboarding, or edit your company settings:
- Contact & Identity: Full name, verified email address, phone number, and password hashes.
- Corporate Credentials: Legal business name, company registration number, VAT / GST / TIN tax numbers, physical business address, business phone, website URL.
- Settlement & Bank Coordinates: Bank name, account holder name, account numbers, IBAN, SWIFT / BIC codes, settlement instructions, and QR code targets.
- Branding Assets & Signatures: Uploaded company logo, currency preferences, digital signatory name, and digitized handwritten signature vector/PNG files.
receipt_longB. Invoice & Client Directory Records
Information you submit regarding transactions and customer relationships:
- Client Identifiers: Client names, corporate entities, contact person, client email address, telephone numbers, and billing addresses.
- Invoice Items & Amounts: Line item descriptions, category groupings, item quantities, hourly or unit rates, discounts, shipping charges, applied tax rates, subtotal calculations, and total settlement balances.
- Payment Tracking: Status tags (Draft, Pending, Paid, Overdue, Cancelled), payment records, date stamps, and transaction reference memos.
devicesC. Technical & Telemetry Information
Collected automatically when you browse or interact with the Invorio application:
- Device & Network Data: IP address, browser user-agent, operating system version, screen resolution, preferred language, internet service provider.
- Usage & Navigation: Timestamps of visits, page load times, referring URLs, features accessed, template downloads, and interface error traces.
loginD. Third-Party Identity Providers (Social Login)
If you authenticate using Google Social Login or Auth0 SSO, we receive your basic public profile, primary email address, authentication provider ID, and avatar image, strictly to authenticate your identity and populate your user profile.
How We Use Data & Legal Bases
Under European data protection laws (GDPR Art. 6) and global privacy requirements, we must have a lawful basis for every processing activity:
| Processing Purpose | Data Categories | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Creating and managing user accounts | Name, email, password hash, business details | Performance of Contract (Art. 6(1)(b)) |
| Generating invoices, PDFs & QR payment codes | Invoice items, client contacts, bank details, signatures | Performance of Contract (Art. 6(1)(b)) |
| Facilitating public invoice verification links | Invoice snapshot, client name, payment status | Performance of Contract (Art. 6(1)(b)) |
| Security, fraud detection & abuse prevention | IP address, audit logs, login timestamps | Legitimate Interest (Art. 6(1)(f)) |
| Transactional email alerts & verification | Email address, verification tokens | Performance of Contract (Art. 6(1)(b)) |
| Statutory tax, commercial & financial record keeping | Billing history, tax identifiers, payment logs | Legal Obligation (Art. 6(1)(c)) |
Data Sharing & Sub-Processors
We treat your data with strict confidentiality. We only share personal information with vetted service providers who assist us in operating our platform, subject to strict confidentiality covenants and Data Processing Agreements:
Legal Disclosures: We may disclose data if required by enforceable legal process, subpoena, court order, or applicable law, or where necessary to investigate potential fraud, violations of our Terms of Service, or threats to physical safety.
Public Invoices & Client Privacy
Invorio offers a public invoice preview capability (/public/invoice/[id]) designed to make client billing frictionless.
When you generate a public invoice link or QR code, anyone in possession of that link can view the invoice details, including your business name, client name, line items, and payment instructions. You are responsible for distributing these links solely to authorized client personnel. Invorio applies obfuscated cryptographically secure IDs to prevent unauthorized sequential crawling.
Security & Technical Safeguards
We employ multi-layered technical and organizational safeguards to protect your records:
Every database query enforces strict PostgreSQL Row-Level Security policies. Users cannot access, view, or query records belonging to another tenant or account.
All communications are encrypted using TLS 1.3 with HSTS enabled. Data at rest is encrypted using industry-standard AES-256 on SOC-2 Type II certified database clusters.
Passwords are salted and hashed using adaptive algorithms (bcrypt/Argon2). We never store or transmit plain-text user passwords.
Automated continuous backups, isolated staging environments, and continuous vulnerability scanning prevent data loss and unauthorized intrusions.
Data Retention & Account Deletion
We retain your personal data and invoice archives only for as long as necessary to provide the services or fulfill statutory tax and legal obligations:
- Active Accounts: Records, clients, and invoices are maintained in your account until you deliberately delete them or terminate your account.
- Account Deletion Protocol: Upon receiving an account closure request, all profile credentials, bank details, client dossiers, and digital signatures are permanently purged from active production databases within 30 days.
- Statutory Tax Archival: In instances where billing receipts or fiscal invoices were issued between you and Invorio, we may retain transaction logs for up to 7 years in compliance with tax regulations.
Your Privacy Rights (GDPR & CCPA)
Depending on your jurisdiction, you enjoy enforceable statutory rights regarding your personal data:
To exercise any of these rights, email our Data Protection Officer at eliasemon0025@gmail.com. We respond to all verified requests within 30 days without fee.
International Data Transfers
Invorio operates globally with primary cloud infrastructure in the United States and European Union. When data is transferred across international boundaries, we ensure adequate protections are in place by executing European Commission approved Standard Contractual Clauses (SCCs) and adhering to the EU-U.S. Data Privacy Framework principles.
Children's Privacy
Invorio is strictly a business-to-business commercial software solution and is not intended for or directed towards children. We do not knowingly collect personal data from individuals under 18 years of age. If we discover a minor has created an account, we will immediately terminate the account and purge their data.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect operational modifications, product enhancements, or regulatory developments. When material changes occur, we will post an announcement in the dashboard, send an email notification, and revise the "Last Updated" date at the top of this document. Continued use of Invorio after the effective date constitutes acknowledgment of the revised policy.
Contact & Data Protection Officer
If you have questions, inquiries, or privacy concerns regarding this policy or our data practices, please contact our legal and compliance department:
Questions regarding these terms?
Our compliance team is available Monday through Friday to address privacy and licensing questions.