This Privacy Policy describes how InvoKeeper(“we”, “us”) collects, uses, and shares information when you use our website and services (the “Service”).
1. Information We Collect#
We collect information in the following ways:
- Account information. When you sign up, we collect your email address and a password (handled by Amazon Cognito and never stored as plaintext on our systems). You may also voluntarily provide your name, business name, address, phone numbers, and a logo for use on invoices.
- Customer / invoice data. We store the invoices, drafts, and client records you create, including names, contact details, line items, totals, and notes you choose to add.
- Payment information. Subscription payments are processed by Stripe. We never see or store your full card number, CVV, or bank account credentials. We store a Stripe Customer ID, subscription metadata (tier, status, period end), and billing history visible to us through the Stripe Dashboard.
- Usage information. We log basic request metadata (timestamps, aggregate counts of invoices generated per month) to operate the Service, enforce plan limits, and detect abuse.
- Technical information. Our servers receive standard request data (IP address, user agent, referrer) for routing, security, and rate-limiting.
- Analytics and advertising data. Our site loads Google Tag Manager, which records page views and a small number of product events: clicking a call to action, completing a sign-up, and starting a subscription (including the plan name and the billing period). If you arrived from one of our ads, Google also records that click so it can match it to the sign-up or subscription. This happens in your browser, not only on our servers. See section 6 for how to block it.
2. How We Use Information#
We use the information described above to:
- Provide, maintain, and improve the Service;
- Authenticate users and protect accounts;
- Process subscriptions, payments, and renewals;
- Enforce our Terms of Service and prevent abuse;
- Communicate with you about your account, security, billing, and material changes;
- Comply with legal obligations.
3. How We Share Information#
We do not sell your personal information for money, and we do not rent it. Our use of Google Ads conversion tracking may count as “sharing” personal information for cross-context behavioral advertising under California law. You can opt out by blocking cookies in your browser, by using a browser that sends a Global Privacy Control signal, or by emailing us. Otherwise we share information only with the service providers we depend on to run the product, and only as needed:
- Amazon Web Services. Hosting (Amplify), database (DynamoDB), file storage (S3), authentication (Cognito).
- Stripe, Inc.Payment processing and subscription management. Refer to Stripe's privacy policy at stripe.com/privacy.
- Google LLC.We use Google Tag Manager on every page of our site, and Google Ads conversion tracking, to measure whether our ads lead to sign-ups and subscriptions. Google receives your IP address, the pages you view on our site, your browser and device information, and a record of the sign-up or subscription that follows an ad click. We use this only to measure and improve our advertising. We do not use it for remarketing. See Google's privacy policy at policies.google.com/privacy, and manage ad personalization at myadcenter.google.com.
- Resend, Inc.Email delivery. This includes the invoices, quotes and payment reminders you send to your own clients, so Resend receives your client's email address, the message, and the attached PDF, which contains the names, contact details, line items and amounts you put on that document. Resend also tells us whether each message was delivered, bounced, or was marked as spam. See resend.com/legal/privacy-policy.
- Sentry (Functional Software, Inc.). Application error reports and performance traces, so we can find and fix faults. A report includes the page address, your browser and device information, and a technical stack trace. Page addresses can contain the identifier of an invoice or client you were viewing. See sentry.io/privacy.
- Legal compliance. We may disclose information when required by law, subpoena, or other legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of InvoKeeper, our users, or the public.
- Business transfers. If InvoKeeper is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
4. Data Retention#
We retain account data for as long as your account is active. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where we are required to retain it for legal, tax, or fraud-prevention purposes (typically up to seven (7) years for billing records).
Backups may persist for a limited additional period before being overwritten in the normal course of operations.
5. Security#
We use industry-standard practices to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest for databases and file storage, scoped IAM-based access controls, and secure authentication via Amazon Cognito. No system can be guaranteed 100% secure; you are responsible for choosing a strong password and keeping your credentials confidential.
6. Cookies and Similar Technologies#
We set two cookies of our own, and neither is used for advertising:
- ik_ref. Records which referral link brought you to the site, so the right person gets credit if you sign up. It lasts 30 days and is cleared as soon as you create an account.
- A short-lived security cookie used only while you are connecting your Stripe account, to confirm the request came back from Stripe and not from somewhere else. It is removed as soon as the connection finishes or is abandoned.
Keeping you signed in does not use a cookie. Your session is held in your browser's own storage on your device, and it is cleared when you sign out.
Google Tag Manager and Google Ads conversion tracking also set cookies or read similar identifiers in your browser, to record that you visited after clicking one of our ads and whether a sign-up or subscription followed. That is described in sections 1 and 3.
You can block or delete cookies in your browser settings, or use a browser that sends a Global Privacy Control signal. Blocking them does not affect your ability to use InvoKeeper: invoicing, sending, and payment all work the same.
7. Your Choices & Rights#
- You can edit or delete your business profile, clients, drafts, and invoices at any time from within the Service.
- You can block or delete cookies in your browser settings, or use a browser that sends a Global Privacy Control signal, which opts you out of our advertising measurement. Nothing in the product stops working if you do.
- You can cancel your subscription from the billing portal.
- You may request a copy of the personal information we hold about you, or request its deletion, by emailing support@invokeeper.com.
- If you are in a jurisdiction with specific privacy rights (e.g., GDPR for the EU/UK, CCPA/CPRA for California), those rights apply to you in addition to the above. Contact us to exercise them.
8. Children#
The Service is not directed to children under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us and we will delete it.
9. International Transfers#
Our infrastructure is hosted in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed there.
10. Changes to This Policy#
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. Material changes will be communicated via email or in-product notice.
11. Contact#
Privacy questions or requests: support@invokeeper.com.