Privacy Policy

1. Who we are

This Privacy Notice describes how xInvoicer ("xInvoicer", "we", "us", "our") collects, uses, shares, and protects personal data when you use our website and service. xInvoicer is the data controller of the personal data we process about you for the purposes described below. You can reach us at privacy@xinvoicer.app.

2. Personal data we collect

• Account data: name, email, hashed password, authentication provider identifiers (e.g. Google sign-in).
• Business and invoicing data you input: sender profile details, client contacts, invoice line items, bank details, notes, logos.
• Support communications: messages and attachments you send us.
• Product usage and telemetry: device type, browser, IP address, coarse location, pages viewed, errors — only where you have consented to analytics.
• Cookies and local storage: a session cookie, your language preference, and (with consent) analytics identifiers.

Payment data (card details, billing address, tax IDs) is collected and processed directly by our payment provider, Paddle. We do not store your full card number.

3. How and why we use your data

• Create and secure your account, authenticate you, and provide the service (legal basis: performance of a contract).
• Generate, store, and export the invoices you create (contract).
• Process payments, subscription renewals, refunds, invoicing, and tax compliance via Paddle (contract and legal obligation).
• Prevent fraud, abuse, and security incidents (legitimate interests).
• Provide customer support (contract and legitimate interests).
• Improve the product via aggregated analytics (consent, where required).
• Send service and, where you have opted in, product update emails (consent or legitimate interests).
• Comply with legal obligations and enforce our Terms (legal obligation and legitimate interests).

4. Who we share your data with

We share personal data only with the following categories of recipients, and only as needed for the purposes above:

• Paddle.com Market Ltd — Merchant of Record. Paddle is our reseller and handles checkout, payment processing, subscription management, tax collection and remittance, invoicing, and refund handling. See Paddle's Privacy Notice.
• Cloud hosting and database (Supabase / Lovable Cloud). EU-hosted infrastructure providing authentication, database, and file storage.
• Authentication providers such as Google, when you choose to sign in with them.
• Analytics and error monitoring providers, only where you have consented to non-essential cookies.
• Professional advisers (legal, accounting, auditors) under duties of confidentiality.
• Authorities where required by law, legal process, or to protect our rights.

We do not sell your personal data.

5. International transfers

Personal data is primarily processed within the EU/EEA. Where a recipient (such as Paddle, Google, or certain analytics providers) processes data outside the EU/EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Data retention

We retain account and invoicing data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must retain records to comply with legal obligations (for example, tax and accounting records retained by Paddle for the period required by applicable law) or to establish, exercise, or defend legal claims. Support communications are kept for up to 24 months. Analytics identifiers are retained for up to 14 months.

7. Security

We apply appropriate technical and organisational measures to protect personal data, including HTTPS/TLS in transit, encryption of secrets at rest, hashed passwords, scoped database access with row-level security, and least-privilege access controls for staff. No system is perfectly secure; please help us by using a strong, unique password.

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time. In the EU/EEA and UK you also have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, email us at privacy@xinvoicer.app; we will respond within one month.

9. Cookies

We use a small number of strictly-necessary cookies for authentication and language preference. Analytics cookies are loaded only after you accept them via the cookie banner, and you can withdraw consent at any time from your browser settings or by clearing the consent choice stored on your device.

10. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be notified via the service or by email.

11. Contact

Questions or requests about your data? Email privacy@xinvoicer.app.