Your privacy matters to us. This policy explains what data we collect, why we collect it, and what we do with it. We don't sell your data. We don't share it with advertisers. We only use it to run the service. If you have questions, email us at privacy@invorce.com.
We collect the information you give us (like your email and the invoices you create), plus some technical stuff (like your IP address) to keep the service running smoothly and securely.
We use Stripe for payments, so they'll have your payment info (but we don't store your card details). We'll never sell your data or use it for advertising.
We use the collected information to:
We may share your information with:
We do not sell your personal information to third parties.
We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet is 100% secure, and like every other website in the world, we cannot guarantee absolute security. But we strive to protect your information and regularly review our security practices, in line with industry standards.
We retain your personal information for as long as necessary to provide our services and comply with legal obligations.
You have the right to:
Note: Some data, particularly tax-related records, cannot be deleted before the 7-year retention period expires due to UK legal requirements.
We use cookies and similar tracking technologies to track activity on our service. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service.
We use the following third-party services:
Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us.
We store your data securely on servers located in Finland (EU/EEA), operated by Hetzner. Finland provides an adequate level of data protection under UK GDPR.
All sensitive data, including HMRC OAuth tokens, is encrypted at rest using AES-256-GCM encryption. We maintain comprehensive audit logs for tax compliance purposes.
For HMRC integration services, Invorce acts as the data controller. We are responsible for protecting your HMRC data under UK GDPR and complying with Making Tax Digital requirements.
We process your HMRC data under the legal basis of contract performance - we need this data to provide you with automated tax submission services. When you connect to HMRC, you explicitly consent to this processing.
HMRC-related data is retained for a minimum of 7 years after the end of the tax year to comply with UK tax record-keeping requirements. This includes audit logs of all tax submissions, even after you disconnect from HMRC or delete your account.
You are solely responsible for the accuracy of all tax data submitted to HMRC through Invorce. While we provide the tools and secure infrastructure, you must verify all figures before submission.
In the unlikely event of a data breach affecting your personal information, we will notify you and the ICO within 72 hours as required by UK GDPR. We maintain comprehensive security monitoring and incident response procedures.
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically.
If you have any questions about this Privacy Policy, please contact us at:
privacy@invorce.com
Company
INVORCE LTD (Company No. 16850379)
Registered Office
128 City Road, London, EC1V 2NX, United Kingdom