1. Overview
This Privacy Policy explains what personal data InvoiceSmarty collects, how we use it and the choices you have. It applies to our website, web application and customer portal.
Two roles matter here. For your own account information we act as the "controller". For the data you enter about your customers (for example names, emails and invoices) you are the controller and we act as your "processor", handling that data only on your instructions.
2. Data we collect
- Account data: name, email address, password (stored hashed) and organization details such as name, address, currency and tax information.
- Business records you create: customers and their contacts, items, quotes, invoices, payments, projects, expenses, time entries, comments and uploaded documents.
- Usage and device data: pages viewed, actions in the app, browser type, IP address and basic diagnostic logs.
- Customer portal data: when your customer uses a portal link, we record the actions they take, such as viewing or approving a quote.
- Communications: messages you send to us and emails the Service sends on your behalf.
3. How we use data
- To provide, secure and maintain the Service, including sending invoices, quotes and reminders you ask for.
- To authenticate you and keep your organization's data separate from others'.
- To support you, respond to requests and send important service notices.
- To understand how the Service is used and improve it.
- To detect and prevent fraud, abuse and security incidents, and to meet legal obligations.
4. Legal bases
Where privacy law requires a legal basis, we rely on: performing our contract with you; our legitimate interests in running, securing and improving the Service; your consent where we ask for it; and compliance with legal obligations.
6. Security
We protect data with measures such as encrypted connections, encryption of sensitive fields, hashed passwords, access controls and per-organization separation. No system is perfectly secure, so we cannot guarantee absolute security, and we will notify affected users where the law requires.
7. Retention
We keep your data while your account is active. After you close your account we keep it for a limited period so you can export it, then delete or anonymize it, except where we must keep records for legal, tax or security reasons.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data, or delete data we no longer need;
- object to or restrict some processing, and withdraw consent you gave;
- receive your data in a portable format;
- complain to your local data protection authority.
9. If you are a customer of one of our users
If a business sends you an invoice or portal link, that business controls your data. Please contact them for access, correction or deletion requests. We will help them respond.
11. International transfers
Our providers may process data in countries other than your own. Where required, we use safeguards such as standard contractual clauses to protect it.
12. Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect their data.
13. Changes to this policy
We may update this policy. If a change is material we will notify you in the Service or by email before it takes effect, and we will update the date at the top of this page.
14. Contact
For privacy questions or to exercise your rights, please contact us through the support options in your InvoiceSmarty account.
