Privacy Policy

This policy explains what invoiso collects, why we use it, which companies receive it, how long it is kept, and the choices and rights available to you. It covers the public website, the no-account invoice maker, signed-in workspaces and documents sent to signers.

The short version

• Without an account, the contents of your invoice stay in your browser. Visiting the site still creates an ordinary hosting request and the limited site measurements described below.
• With an account, your records are stored on our servers so they work across devices and so the assistant can answer questions about them.
• Some features send your data to other companies to work at all — reading a document sends it to a model provider, connecting a mailbox lets us read that mailbox, sending an e-invoice sends it across a network. Every one of them is listed below, with what leaves and when.
• We do not sell workspace data or use it for advertising, and we do not use your invoices or documents to train our own models. We and our service providers process their contents only to provide the features you use, secure the service, meet legal obligations, or help you when you ask for support.

Who is responsible for the data

The controller for that data is Moorio, UAB, a company registered in Lithuania, company number 305786688, registered at Mindaugo 1A-103, Vilnius, Lithuania. You can reach us about anything on this page at privacy@invoiso.com.

invoiso is responsible for the personal data used to operate the site, accounts, billing, security, support and product analytics. When you put personal data about customers, suppliers, employees or signers into a workspace, your business decides why that data is used and is responsible for having a lawful reason to use it. invoiso processes it on your instructions to provide the service. The exact legal labels may differ by jurisdiction, but that division of responsibility does not.

Why we use it

• To provide the service you request: create, store, sync, send and export records; read documents; answer questions; run connected services; administer accounts and subscriptions; and provide support.
• To operate and protect invoiso: diagnose failures, measure performance, prevent abuse, enforce usage limits and keep an audit trail where the feature requires one.
• With your consent: load optional Google Analytics, and send you product news by email where you have asked us to. You can refuse either, or withdraw at any time, without losing the service.
• To comply with law: respond to valid legal requests, keep records the law requires, and establish or defend legal claims.

Where data-protection law requires a legal basis, these purposes rely as applicable on performing our contract with you, our legitimate interests in operating and securing the service, your consent, and compliance with legal obligations. We do not use workspace content for direct marketing or targeted advertising.

What we collect

What you type and upload

Issuer and customer names, addresses, email addresses, tax identifiers, invoice and credit-note lines, expenses, products, stock movements, notes. Plus the files themselves when you upload one: a receipt, a supplier bill, a bank statement, a PDF to be signed. A bank statement in particular contains your account activity, including counterparties and references.

Without an account this content lives in your browser’s local storage and is not uploaded to the invoiso database. With an account it is stored in our database and scoped to your workspace. It may be processed by the service providers below when a feature needs them.

Your conversations with the assistant

Messages you send and the answers, including the results the assistant’s tools returned from your own records, are stored so a conversation can be reopened. Deleting a conversation removes it.

Signed documents

A document sent for signature records each signer’s name and email address, the time they opened and signed it, and the IP address the signature came from. Those details are written into a certificate of completion attached to the finished PDF, and into an audit trail you can read on the document. That is the point of the feature — a signature nobody can evidence is not worth much — but it means a signer’s IP address is recorded, and anyone you send the completed PDF to can see it.

Mail you send to your customers, and whether it was opened

When you email an invoice or invoiso sends a payment reminder on your behalf, we keep a record of it against that invoice: the address it went to, any address you copied, the subject, the message as it was sent, the time, and whether the provider accepted it or refused it and why. That record is what lets you answer “did this go out?” months later, and it is visible to you and to nobody else.

Open tracking is off unless you switch it on. When it is on, an invoice email carries a one-pixel image hosted by us, and fetching it tells us the message was displayed. Two things are worth knowing before you turn it on. It puts a request to our servers into a message sent to someone who did not choose that — your customer, not you. And it is a weak signal in both directions: most mail clients block remote images by default, and Gmail fetches them through Google’s cache whether or not a person read anything. So we show “opened” when the pixel fires and we say nothing at all when it does not, because the absence means nothing. We never record that a message was not opened, and you can switch the whole thing off in Settings at any time; existing records keep what they already have.

Product news, if you asked for it

If you tick the box on the sign-up page, on the setup screen or in Settings, we record that you agreed: the date and time, the exact wording you were shown, and which of those screens you were on. Turning it off later records that in the same way. We keep both, because consent only means something if we can show what was agreed to — the record of a withdrawal is what evidences that you withdrew. The address used is the one on your account. We never send marketing to your customers, and we do not sell or share your address for anyone else’s marketing.

Account information

Sign-in is handled by Clerk: your email address and the sign-in method you choose. We receive and store the user and organisation identifiers, and the email address on the active session.

What your workspace has spent

Reading documents and asking the assistant cost money per use, so we record, per call: which capability it was, which model, how many tokens, what it cost, and the plan you were on. No message content and no document content is stored in those records — they are counters, and they are what the allowance on your plan is measured against.

Technical logs and analytics

Our hosting provider keeps short-term request logs — URL, status, response time, IP address and browser information — for operations and security. Vercel Web Analytics and Speed Insights also receive cookieless, aggregated page and performance measurements on deployed versions of the site. Google Analytics loads only if you accept it and then collects page and interaction data, approximate location, browser/device information and a pseudonymous cookie identifier. Declining leaves Google Analytics unloaded, and you can change your mind from the footer at any time.

PostHog, our product analytics service, hosted in its EU cloud, receives two kinds of data. From your browser, it counts page visits without cookies, from a value that is not stored on your device. If you accept analytics, it also keeps an identifier in a cookie and local storage, links your visits to your account once you sign in, and records your sessions in the app with everything you type masked. From our servers, whichever you chose, it receives your workspace's milestones — for example that you signed up, created or sent an invoice, connected a bank or started a trial — with your account and workspace identifiers, your workspace's country and plan, and how you first found invoiso. It never receives the content of an invoice, an expense, a document or a message.

We also keep our own record of activity inside a signed-in workspace. When somebody in your workspace opens a page in the app, we store which workspace, which user, which page and when. Record identifiers are replaced before the page is stored, so we keep /app/income/:id rather than the address of a particular invoice — we can see that invoices were opened, not which ones. Nothing you type is stored: no search terms, no form contents, no customer names. This is not consent-gated the way the analytics above are, because it records activity in an account rather than tracking a visitor, and it is what tells us which parts of the product are worth keeping.

These records outlive your account, without your name on them. We keep your identity against them for 180 days after you were last active. After that — and immediately if you delete your account, or if your workspace is deleted — the identifiers are replaced with a random surrogate and we do not keep any record of what it replaced. That is not encryption and it is not a code we could look up: the link is destroyed, so we cannot turn those rows back into you, and neither could anyone who obtained them. The exact times are rounded to the day at the same moment, so they cannot be lined up against other records to work out who you were.

We keep the rows themselves because they are how we know how many people used the product in a past month, and deleting them would change what we know about a period that has already ended. What survives is that somebody — one person, consistently, across those days — opened these pages. What does not survive is which person.

Who else receives it

Each of these is a company that processes some of your data so a feature can work. Most only apply if you use the feature they belong to.

We also fetch data from the following, without sending anything about you: European Central Bank — Published daily reference rates, fetched on a schedule. The request contains no information about you or your workspace.

Anthropic states that standard commercial API inputs and outputs are not used to train its generative models by default and are automatically deleted from its backend within 30 days, subject to its stated exceptions for law, safety-policy enforcement or a different agreement. That provider-side period is separate from the conversation or document record you choose to keep in invoiso.

The mailbox connection, specifically

If you connect a Google account, invoiso requests one scope: gmail.readonly. It can read messages and attachments; it cannot send, delete, or modify anything in your mailbox. It looks for supplier documents and files them as expenses, and the documents it finds are read the same way an upload is — which means their contents reach the model provider named above.

invoiso’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use that data only to provide the document-filing feature you connected it for, we do not transfer it except as needed to provide or secure that feature (which includes the model that reads the documents), and we do not use it for advertising. Human access is limited to cases you affirmatively request for support, security or abuse investigation, or a legal obligation.

The refresh token that keeps the connection alive is encrypted before it is stored. You can disconnect the mailbox in Settings at any time, which deletes the token, and you can revoke access independently from your Google account permissions.

The Google Drive connection, specifically

If you connect Google Drive, invoiso requests one scope: drive.readonly. It can see and download files in your Drive; it cannot create, change, move, share or delete anything there. Google does not offer a narrower scope that can see what is inside a folder, so the limit to the folder you choose is invoiso’s own: it reads the list of changes in your Drive, discards everything outside that folder and the folders inside it before downloading anything, and reads the files that remain the same way an upload is read — which means their contents reach the model provider named above.

The same Google API Services User Data Policy and Limited Use commitments above apply to Drive data. The refresh token is encrypted before it is stored; disconnecting Google Drive in Settings revokes it at Google and deletes it, and you can also revoke access from your Google account permissions. Only files added after you choose a folder are read, unless you ask invoiso to read what is already there.

Decisions made without a person

invoiso can act on your records unattended, and you decide how far. Each area below has 4 settings, from “prepare it and wait for me” to “act on everything it safely can”. The areas, and what acting means in each, are read from the module that enforces them:

• Recognising expenses from documents — Every document is read and filed either way. This decides which of them are clear enough to count without you checking first. Confirming an expense puts its figures into your reports and its quantities into stock.
• Reconciling bank transactions — Every transaction is matched to the document it most likely settles — money in against an invoice, money out against a supplier's bill. This decides which of those matches are recorded without you. A bill with no reference of its own can only be identified by its supplier and its amount, so those wait for a higher position. Recording a receipt settles the invoice and takes it out of the overdue list; recording a payment out reduces what is owed on the bill. At the top position, transactions judged to settle nothing at all are set aside.
• Accepting a change to where a supplier is paid — Every account a bill prints is read and compared with the supplier's card either way. This decides which of those changes go onto the card without you. A first account is never held — the fraud this guards against is a change, not an arrival — and an account that replaces every one on file waits for a higher position than one that arrives alongside them. Accepting a change moves where a payment file sends this supplier's money. Nothing is dismissed silently: the file names every supplier whose account changed since the last one.

Anything done this way is recorded with the reason it was done and can be undone. Automated processing is a convenience here rather than a judgement about a person: it decides what to file and what to match, not anything about you or your customers. You can turn every area back to its most cautious setting at any time, in Settings.

Where the data lives

The database, the file storage and the hosting are each pinned to one region, chosen when the deployment was set up. Several of the companies above operate globally and may process data outside that region — Clerk, Stripe, Google and the model provider in particular. Where cross-border transfer rules apply, we use the contractual and other safeguards offered by those providers. If the exact region or transfer mechanism matters to your business, contact us before you use the affected feature.

How long we keep it

Workspace records stay while the workspace is active unless you delete them or ask us to delete the workspace. We do not currently expire core business records merely because they are old: an invoice from three years ago remains available because businesses often need it for record-keeping. We retain personal data only while it is needed to provide the service, secure it, meet legal or accounting obligations, or resolve claims.

Deleting a workspace is deliberately not instant. The request cancels your subscription immediately and then waits 30 days before anything is destroyed, so an accidental deletion is recoverable by telling us inside that window. Nothing is removed during it.

Two things are worth knowing specifically. A document you delete removes its active record and stored file. A completed signed document is deliberately harder to lose — its certificate exists to be evidence later — so voiding it keeps the signing trail. Backups and logs kept by our hosting, database and storage providers follow those providers’ own deletion schedules, and a deletion request may not cover data we must keep by law or for a legal claim. We will explain any exception that applies.

Some records have no fixed end date today and stay until the workspace is deleted: the record of each email invoiso sent for you, including the message as it was sent; support conversations; the usage records of what reading documents and the assistant cost; and, for mail sent to a forwarding address and held back, who it claimed to be from, its subject and its attachment names — never the message itself. Two kinds of record belong to running the service rather than to a workspace and have no fixed end date either, including after a workspace is deleted: the notifications our sign-in and payment providers send us, which can include your name and email address, and the log of scheduled jobs.

What you can ask for

• A copy of your data. Settings › Your archive makes one zip, built in the background and emailed to you when it is ready: every report for every year as a spreadsheet, every invoice as a PDF, every bill and receipt as it was uploaded, signed documents, your contacts, and CSV files other software can read of your invoices and their lines, bills and their lines, and payments and how they were allocated — with products, stock movements, bank statement lines and the chart of accounts if you can see the whole workspace. It holds what you can see; an owner or administrator can ask for the whole workspace. One archive every 30 days, kept for 7 days. It does not include your settings, recurring schedules, cost centre and split rules, bank account details, approval rules, e-invoicing messages, support tickets, conversations with the assistant or the activity log. For those, or anything else we hold about you, email us.
• Deletion. Deleting your organisation ends the service and starts a 30-day grace period: your subscription is cancelled straight away, nothing is removed yet, and telling us within those 30 days restores everything untouched. After that the workspace is destroyed — its records, its stored files, and the access it granted to any connected accounting package or mailbox. A limited record that the deletion happened is kept, and we may keep more where a legal, security or claims-related reason requires it. If you would rather we did it for you, or you want it done sooner, email us.
• Correction of anything wrong — most of it you can edit directly.
• Withdrawal of product-news consent, from Settings or the unsubscribe link in any message we send you. It takes effect immediately, and nothing else about your account changes.
• Withdrawal of Google Analytics consent, from the “Cookie settings” link in the footer.

Depending on where you live and why the data is processed, you may also have rights to restrict or object to processing, receive portable data, withdraw consent, and complain to a data-protection authority. These rights have legal exceptions: for example, deletion is not available for data we must retain by law. Send requests to privacy@invoiso.com. We may need to verify your identity, and we aim to respond without undue delay and normally within 30 days. If applicable law permits or requires a different period, we will tell you.

Cookies, local storage and similar technologies

• Essential — local storage for your in-progress invoice, your saved invoices and your settings on the guest tier, plus your currency and country preferences on the public pages. The app cannot work without them.
• Authentication — Clerk’s session cookie, set when you sign in.
• Analytics — Google Analytics’ cookies and PostHog’s cookie and local storage, set only after you accept. Before that, and if you decline, Vercel Web Analytics, Speed Insights and PostHog count visits without cookies.
• Home page version and first visit — two first-party cookies on the public pages, kept for 90 days. invoiso_lv remembers which version of the home page you were shown, so that it stays the same between visits. invoiso_ft remembers the page and campaign that first brought you to invoiso, such as a newsletter link or a referring site; if you sign up, that is stored with your workspace. Neither holds an identifier.

Children

invoiso is a business tool and is not directed to children. Do not create an account or use the service on behalf of a business unless you have the legal capacity and authority to do so.

Contact

Questions, rights requests, deletion requests, or anything we have got wrong: privacy@invoiso.com.

Changes

If we change this policy, we will update the “Last updated” date at the top. For a material change, we will provide additional notice where reasonably possible, and ask for consent where the law requires it. See our Terms for the rest.