Privacy Policy

This Privacy Policy applies to the Invoice Aura website, web and mobile applications, customer-facing document pages, support, and related services (together, the Service). “Invoice Aura,” “we,” “us,” and “our” refer to the operator of the Service in Ontario, Canada.

For account, subscription, website, and support information, Invoice Aura decides why and how personal information is processed. For the client, contact, team, and transaction information that a business places in its workspace, that business decides what to enter and how to use it. Invoice Aura processes that information to provide the Service on the business’s instructions.

Depending on how you use Invoice Aura, we may handle:

• Account and profile information: login email, name, optional contact and company details, tax identifier, account preferences, authentication records, and the time and policy versions you confirmed. Invoice Aura uses one-time email codes and does not store an account password.
• Business and team information: business names, branding, addresses, contact information, tax settings, team member details, roles, invitations, and preferences.
• Client and business records: client and contact names, email addresses, phone numbers, addresses, tax identifiers, notes, custom fields, and related account balances.
• Documents and work records: invoices, estimates, bills, receipts, statements, line items, payment records, recurring profiles, time, expense and mileage entries, comments, files, attachments, links, tags, and email templates.
• Delivery and recipient activity: document delivery attempts, send status, public-link access, view status, estimate responses, and related timestamps. This lets a business know, for example, whether an invoice was delivered or viewed.
• Subscription and integration information:subscription status and identifiers from our billing provider, plus payment-provider account identifiers, public keys, and encrypted or access-controlled credentials that a business chooses to connect. Invoice Aura does not store complete payment-card numbers for its own subscriptions.
• Support and communications: messages, attachments, and contact details you send to us or that are needed to deliver transactional email.
• Essential technical information: authentication sessions, security and rate-limit events, error information, and routine server records such as IP address, browser or device type, request time, and requested page that our infrastructure providers may generate to operate and protect the Service.

We receive information:

• directly from you when you sign in, configure a business, create records, connect a provider, upload a file, or contact us;
• from authorized team members who use a shared business workspace;
• from document recipients when they open a public document link, respond to an estimate, or otherwise interact with a document;
• from service providers, such as authentication, email, hosting, storage, billing, app-store, and payment-integration providers; and
• automatically through essential service operations and security controls.

We use personal information only as reasonably necessary to:

• create and authenticate accounts and maintain secure sessions;
• provide invoicing, estimates, bills, tracking, reporting, file storage, document delivery, reminders, receipts, and team features;
• display public documents and record the delivery or document activity requested by the business using Invoice Aura;
• administer subscriptions, prevent unauthorized access, detect misuse, and protect the Service;
• record your agreement to the Terms of Service and confirmation that you read this policy;
• respond to support, privacy, and account-deletion requests;
• diagnose errors, maintain reliability, and improve Service functionality without creating advertising profiles; and
• comply with law, enforce our Terms of Service, and establish or defend legal claims.

Depending on where you live, these activities are based on performing our contract with you, your consent, our legitimate interest in operating and securing the Service, or compliance with legal obligations. Where consent is required, you may withdraw it, subject to legal and contractual limits.

Invoice Aura does not sell or rent personal information. We do not use advertising networks, behavioural analytics, tracking pixels, or cross-site tracking to follow people across unrelated apps or websites. We do not use customer content to target advertising.

The Service may use essential browser or device storage for security, authentication, and preferences such as light or dark theme. These technologies are needed to provide a requested feature and are not used for advertising. Document delivery and view status are functional records for the business that sent the document, not advertising analytics.

We disclose information only in the following circumstances:

• Service providers. Providers that support hosting, databases, authentication and file storage (including Convex), web delivery (including Vercel and Cloudflare), transactional email (Resend), and subscription billing (Stripe) process limited information for us under contractual and confidentiality obligations. We require providers that receive personal information from the Service to protect it consistently with this policy and applicable law.
• Your chosen payment services. If a business enables Stripe, PayPal, Authorize.Net, Mollie, or another integration, information needed for that connection or a customer-initiated payment may be sent to or received from that provider. Its own terms and privacy policy govern its independent processing.
• People you direct us to reach. We share invoices, estimates, statements, receipts, files, and messages with recipients and team members chosen by the business. Anyone with an enabled public document link may be able to view the information on that page, so links should be shared carefully.
• App stores. Apple, Google, or another distributor may independently process download, device, purchase, and subscription information under its own privacy policy.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law or valid legal process, prevent fraud or harm, protect rights and security, or enforce our agreements.
• Business changes. Information may transfer as part of a merger, financing, acquisition, reorganization, insolvency, or sale of all or part of the Service, subject to appropriate confidentiality and continued privacy protections.

Invoice Aura is operated from Canada, and our providers may process information in Canada, the United States, and other countries. Laws in those places may differ from those where you live, and information may be available to courts, law enforcement, or national-security authorities where legally required. We use contractual, technical, and organizational measures appropriate to the information and the transfer.

We keep account and workspace information while the account or business remains active and for only as long as reasonably needed for the purposes described in this policy. Short-lived authentication records expire or are replaced as part of normal security operations.

After deletion, information is removed from active Invoice Aura systems through our deletion process. Limited information may remain temporarily in protected backups or provider systems until their ordinary deletion cycles complete. We or an independent provider may retain a narrow record when required for tax, accounting, chargeback, fraud-prevention, security, dispute, or other legal obligations. Such retained information is restricted to that purpose and deleted when the obligation ends.

Copies already delivered to clients or other recipients, records kept by another workspace owner, and records held independently by payment providers or app stores are not under Invoice Aura’s sole control.

Subject to applicable law, you may ask to access, correct, export, or delete personal information; withdraw consent; object to or restrict certain processing; or receive information about our use and disclosure of personal information. Many records can be viewed or corrected directly in Invoice Aura. You may also contact our Privacy Lead using the details below.

We may need to verify your identity and authority before acting on a request. If your request concerns information that an Invoice Aura customer entered about you, contact that business first; we will assist the business as required. You may complain to the privacy or data-protection authority where you live, including the Office of the Privacy Commissioner of Canada where applicable.

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information, including encrypted network connections, access controls, authentication protections, service-provider review, and deletion controls. No internet service can promise absolute security. Keep access to your email account and public document links secure, review team access, and contact us promptly if you suspect unauthorized use.

Invoice Aura customers decide what client, contact, employee, contractor, and recipient information to place in the Service. If you provide personal information about another person, you are responsible for having a lawful basis and giving any notice or obtaining any consent required to let Invoice Aura process and deliver that information as described here. Do not enter sensitive information that is unnecessary for invoicing or business administration.

Invoice Aura is a business service and is not directed to children under 18. We do not knowingly create accounts for children or collect their personal information for their own use of the Service. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.

We may update this policy to reflect changes to the Service, providers, or law. We will post the revised version here and update the effective date. If a change materially affects how we use personal information, we will provide additional notice in the Service or by email when reasonably required.

Questions, privacy requests, and complaints may be directed to the Invoice Aura Privacy Lead at support@invoiceaura.com. Account-deletion requests may be sent to deleteme@invoiceaura.com.