Privacy Policy

InvoiceOS ("InvoiceOS", "we", "us") is an invoicing and tax computation platform built for Indian freelancers and small agencies. This policy explains what personal data we collect through the InvoiceOS application, why we collect it, and the choices you have.

We collect the following categories of data:

• Account data — name, email address, and profile details, collected via our authentication provider (Clerk) when you sign up or sign in.
• Business & financial data you enter — invoices, client details, currencies and FX rates, income and expense records, GST and TDS details, capital gains transaction imports, and tax computation inputs you provide while using the product.
• Billing data — subscription plan and payment status, processed through Razorpay. InvoiceOS does not store your card, UPI, or bank account credentials directly.
• Usage & technical data — device and browser information, IP address, and application error/performance data (collected via Sentry) used to diagnose and fix issues.

• To provide the core invoicing, tax computation, and reporting features you use.
• To process subscription payments and manage your plan.
• To send transactional notifications you've enabled — invoice emails, payment confirmations, and compliance deadline reminders (via email and, where enabled, WhatsApp/SMS).
• To detect, investigate, and fix bugs and security issues.
• To comply with applicable legal and tax record-keeping obligations.

We do not sell your personal or financial data to third parties.

Your data is stored in a PostgreSQL database hosted in AWS's Mumbai (ap-south-1) region, encrypted at rest with AES-256 and in transit with TLS 1.3. Every database query is scoped to your workspace at the application layer, so your data is never returned to another account.

We rely on the following subprocessors to operate InvoiceOS:

• Clerk — authentication and account management.
• Neon — managed PostgreSQL database hosting (AWS Mumbai region).
• Razorpay — subscription payment processing.
• Resend — transactional email delivery (invoices, notifications).
• Twilio — WhatsApp/SMS deadline reminders, where enabled.
• Sentry — application error monitoring.
• Upstash — rate-limiting infrastructure.

Each subprocessor only receives the data necessary to perform its function and is bound by its own data protection terms.

We retain audit trail records (edit history on invoices and tax records) for 7 years to align with Indian Income Tax Act record-keeping expectations. Other account data is retained for as long as your account is active, and deleted or anonymized within a reasonable period after account closure, except where we are required to retain it by law.

You can, at any time:

• Access and export your invoicing and tax data from within the app.
• Correct inaccurate account or business information.
• Request deletion of your account and associated data, subject to our legal retention obligations above.
• Revoke a CA's read-only access token at any time.

To exercise these rights, contact us using the details in Section 10.

We use essential cookies for authentication and session management. We do not use third-party advertising or tracking cookies.

InvoiceOS is intended for use by individuals of legal working age operating a freelance or business practice. We do not knowingly collect data from children.

We may update this policy from time to time; material changes will be reflected by updating the "Last updated" date above. For any privacy-related questions, contact us via the support channel listed in your InvoiceOS account.