Privacy Notice

This Privacy Notice explains how LEPETUKHA KYRYLO (“we”, “us”), trading as InvoiceFlow, handles personal data in connection with the InvoiceFlow web application (the “Service”). We act as the data controller for the personal data described below, meaning we decide why and how it is processed.

1. Personal data we collect

• Account data — username, login credentials (stored hashed), display name, and contact email where provided.
• Business profile data — company name, address, phone, logo, signature image, tax details and payment instructions you add to your documents.
• Content you create — clients, services, estimates, invoices, projects, tasks, schedule entries, income and expense records, and any notes or files you upload.
• Support and feedback data — messages, feature suggestions and any information you send us.
• Technical and usage data — IP address, device and browser identifiers, log data, pages viewed and actions taken in the Service.

Payment card details are never collected or stored by us. Payments are processed by Paddle (see section 4).

2. Why we use it, and our legal basis

• Providing the Service (creating your account, storing and rendering your documents, sending them to your clients) — performance of our contract with you.
• Billing and subscription management — performance of our contract and compliance with legal obligations (accounting, tax).
• Customer support — performance of our contract and our legitimate interest in helping users.
• Security, fraud prevention and abuse detection — our legitimate interest in keeping the Service safe.
• Product improvement and aggregate analytics — our legitimate interest in improving InvoiceFlow.
• Marketing emails — your consent, which you may withdraw at any time.

3. AI features

Where you use AI-assisted text generation (for example, drafting estimate descriptions), the prompt and relevant document content are sent to our AI provider solely to produce the output. We do not authorise providers to use your content to train their models.

4. Who we share data with

• Service providers / subprocessors — hosting, database, email delivery, AI processing and error-monitoring vendors acting on our instructions.
• Paddle.com Market Ltd, our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, invoicing, refunds and tax compliance. Paddle processes your billing data under its own privacy policy.
• Professional advisers — accountants and lawyers, where necessary.
• Authorities — where required by law or to establish or defend legal claims.

We do not sell your personal data.

5. International transfers

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

6. Retention

We keep account and content data for as long as your account is active. After you delete your account, data is deleted or anonymised within 90 days, except records we must retain for legal, tax or accounting purposes (typically up to 7 years). Backups are purged on a rolling schedule.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive it in a portable format, and to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection supervisory authority. Contact us using the details below and we will respond within one month.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, encryption at rest with our hosting provider, row-level access controls that isolate each account’s data, hashed credentials and least-privilege access for administrators. No system is perfectly secure, but we work to protect your data and to notify you of incidents where required by law.

9. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember preferences; these cannot be switched off without breaking the Service. Any analytics cookies are used only to understand aggregate usage. You can clear or block cookies in your browser settings, and checkout cookies are governed by Paddle.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

11. Changes

We may update this notice. Material changes will be announced in the app or by email before they take effect.

12. Contact

LEPETUKHA KYRYLO (trading as InvoiceFlow). For any privacy request, write to us via the support contact inside your account or reply to any email you have received from us. See also our Terms & Conditions and Refund Policy.