Privacy Policy

1. Introduction

Inkvoice ("we", "us", "our") is an open-source invoicing platform. This Privacy Policy explains how we collect, use, and protect your information when you use Inkvoice Cloud at cloud.inkvoice.app and the Inkvoice mobile app. If you self-host Inkvoice, your data stays entirely on your own infrastructure and this policy does not apply to it.

2. Who is the controller

The data controller for Inkvoice Cloud is Barış Çelik. For data protection enquiries, contact support@inkvoice.app. We have not appointed a statutory Data Protection Officer because the scale of processing does not require one under GDPR Article 37; the address above reaches the person accountable for privacy decisions.

3. Information we collect

We collect the minimum information necessary to provide the service:

• Account information: your email address and name when you sign up, plus either a password (stored only as a bcrypt hash) or the account ID of the sign-in provider you chose (Google, Microsoft, or Apple).
• Invoice data: customer details, line items, and amounts you enter.
• Payment information: subscription payments are processed by Paddle, our merchant of record. We never see or store card numbers.
• Usage data: page views and feature usage, collected with our self-hosted, cookieless Umami analytics to improve the product. IDs and tokens are removed from page addresses, and customer-facing portal and payment pages are not tracked.
• Technical data: your IP address, which we use to deliver the Service and to rate-limit sign-in and sign-up attempts, and which we keep with an unverified sign-up until it is verified or its 24-hour link expires. If you send feedback from inside the app, we store your browser's user agent with your message.

Plugin votes. When you click "I want this" on a planned plugin at inkvoice.app/plugins, we process your IP address to record one vote per voter and to prevent duplicate votes and abuse. We store only keyed one-way hashes (HMAC-SHA256), never the raw address; for IPv6 we use the network prefix instead of the full address. Votes sent from inside an Inkvoice installation use a hash of an opaque per-user token created by that installation instead of your IP address. To limit abuse, we also keep hashed per-network counters that only cover a short time window. The legal basis is our legitimate interest in an accurate, abuse-resistant demand signal, and the data is stored with Netlify, which hosts this website.

4. The Inkvoice mobile app

The Inkvoice app for iPhone and Android ("Inkvoice: Invoice Maker") works with Inkvoice Cloud or with a self-hosted Inkvoice server. It talks only to the server you choose. When that server is Inkvoice Cloud, this policy applies; when it is a self-hosted server, the data goes to that server and its operator, and we receive none of it.

• Sign-in: when you sign in, the app sends your device's name and model, its operating system version, and the app version to the server, so the signed-in device can be identified and signed out later. The sign-in token is kept in the iOS Keychain or the Android Keystore on that device only. Signing out deletes it from the device and ends the session on the server.
• Workspace data: invoices, customers, and other workspace data are loaded from your server and kept in the app's memory while you use it; the app does not save a copy to the device. The demo workspace is sample data that stays on the device and is never sent anywhere.
• Camera and photos: used only when you attach a receipt to an expense. The photo you pick or take is uploaded to your server with that expense.
• Face ID, Touch ID, and fingerprint: the optional app lock is checked by the phone's operating system. The app only learns whether the check passed, and no biometric data reaches the app, your server, or us.
• No tracking: the app contains no analytics, advertising, or crash-reporting SDKs. Each request tells your server the app version and platform so it can stay compatible.
• Feedback: "Send feedback" opens your email app with a message to support@inkvoice.app. We receive only what you choose to send.

5. How we use your information

• To provide and maintain the Inkvoice Cloud service.
• To process subscription payments.
• To send account emails, such as sign-up verification, password resets, data export links, failed payment notices, and deletion notices, and to send the invoices and reminders you choose to send through the SMTP server you connect.
• To improve the product based on aggregate usage patterns.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with legal obligations (tax records, lawful requests from authorities).

6. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases under Article 6(1):

• Contract (Art. 6(1)(b)): to deliver the Service you signed up for, including hosting your invoices and processing your subscription.
• Legitimate interests (Art. 6(1)(f)): securing the platform, preventing abuse, and improving product quality through aggregate usage analysis.
• Legal obligation (Art. 6(1)(c)): retaining records required by tax and accounting law, and responding to lawful requests.
• Consent (Art. 6(1)(a)): any optional processing, such as opt-in marketing emails, where we ask first. You may withdraw consent at any time.

7. Data sharing and sub-processors

We do not sell your data. We share information only with the providers we need to run the platform (hosting, DNS and email delivery, billing, error monitoring, and internal notifications) and, if you choose to use them, with the sign-in providers Google, Microsoft, and Apple. Paddle, our merchant of record, and the sign-in providers act as separate controllers under their own terms. The current list, with each provider's role, location, and data protection terms, is published at /subprocessors. Our processor-side terms are available at /dpa.

8. International transfers

Inkvoice Cloud is hosted in the European Union (Vienna, Austria). Some providers operate outside the EU/EEA; transfers to them rely on an adequacy decision (such as the EU-US Data Privacy Framework or the EU adequacy decision for the United Kingdom) or on the European Commission's Standard Contractual Clauses (2021/914) in their data protection terms. The provider, location, and transfer mechanism for each is listed on the subprocessors page.

9. Cookies and tracking

Inkvoice Cloud uses only strictly-necessary cookies (session and OAuth-state) to keep you signed in. For analytics we use self-hosted, cookieless Umami, which sets no cookies and stores no personal data. There is no advertising or cross-site tracking. Full detail is in the Cookie Policy.

10. Data retention

Your data is retained for as long as your account is active. The workspace Owner can export the workspace's data at any time from Settings → Danger zone, as a ZIP of CSV and JSON files. The download link is emailed, works for 24 hours, and the file is deleted from our server after 7 days. When the Owner deletes the workspace, it becomes read-only, its shared links and client portal go offline immediately, and it is scheduled for deletion 30 days later; we email the Owner a confirmation and a final notice about 7 days before that date. Until the deletion date the Owner can sign in to export the data or restore the workspace, or ask us at support@inkvoice.app. After 30 days the workspace database, including its audit log, is moved to a quarantine area and permanently erased 7 days later. Paddle, as merchant of record, keeps its own payment and tax records under its own legal obligations. Records we must keep by law, such as accounting records, are kept for as long as the law requires.

11. Security

The Service is served only over HTTPS (TLS), with HSTS enabled. Each workspace has its own separate database, passwords are stored only as bcrypt hashes, and the SMTP passwords and Stripe keys you save with us are encrypted with AES-256-GCM using a per-workspace key. Access inside a workspace follows roles (Owner, Admin, Accountant, Viewer), and changes to invoices, customers, products, and users are recorded in the workspace's audit log. Our support tool for signing in to a workspace requires a stated reason, limits each session to 15 minutes, and records the access in that workspace's audit log. Production secrets are kept in server configuration, not in source code. The open-source code the Service is built on is public on GitHub. Suspected vulnerabilities can be reported to support@inkvoice.app.

12. Your rights

Subject to applicable law (including the GDPR and UK GDPR), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Export your data in a portable format.
• Erase your data, subject to retention obligations above.
• Restrict or object to certain processing.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with your local supervisory authority.

Most rights are exercisable directly from your account settings. For anything else, email support@inkvoice.app and we will respond within 30 days.

13. Children's data

Inkvoice Cloud is a business tool not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact support@inkvoice.app and we will delete it.

14. Changes

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current revision.

15. Contact and jurisdiction

Questions about this policy? Reach us at support@inkvoice.app. This policy is governed by the laws of England and Wales, without prejudice to any mandatory consumer or data-protection rights you have under your local law.