Privacy Policy

1. Who we are and our role

• For account holders (businesses and their team members), we are the controller of your account information.
• For our customers' clients (people who receive invoices, quotes or receipts), the business that sent the document is the controller and we process your information on its behalf under our Data Processing Addendum. Please contact that business first about your data; we'll help them respond.

2. What we collect

Information you give us

• Account details: name, email address, password (stored hashed), phone number, and two-factor authentication settings.
• Business details: business name, address, country, currency, tax registration numbers, logo, bank and payout details (entered with Stripe, not stored by us).
• Content you create: clients, products, invoices, quotes, notes, time entries, expenses, receipts and attachments.
• Messages you send to our support team.

Information about your clients

• Names, email addresses, phone numbers, postal addresses and tax IDs that you add.
• Document activity: when an invoice is emailed, delivered, opened, viewed, paid or bounced.
• Payment status and the last digits and brand of the card used. Full card and bank details are collected directly by Stripe and never reach our servers.

Information collected automatically

• Log and security data: IP address, browser and device type, sign-in times, and active sessions, used to secure accounts and prevent fraud.
• Mobile push notification tokens, if you allow notifications.
• We do not use advertising trackers or third-party analytics cookies. See our Cookie Policy.

Information from others

• Stripe: connected account status, payouts, payments and disputes.
• Services you connect (Xero, QuickBooks, Sign in with Apple, Google Sign-In): the profile or accounting data needed to sign you in or sync records.
• Email providers: delivery, bounce and complaint notifications.

3. How we use it

AI features. If you use the AI assistant, the text or images you submit (and your client names, to match them) are sent to Anthropic to generate a draft. Under our agreement with Anthropic, this data is not used to train its models.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

4. Who we share it with

• Service providers who process data for us under contract, listed on our Subprocessors page.
• Stripe, to process payments and run your connected account. Stripe handles that data under its own privacy policy.
• The people you send documents to. Your business details appear on the documents you send.
• Anyone who verifies a document. The verify page confirms a document's seal and shows its key details (such as the sender, client name, total and dates) to anyone who has its verification ID or QR code.
• Services you connect, when you choose to.
• Authorities and advisers, when the law requires it or to protect rights, safety and property.
• A buyer or successor, if we are involved in a merger, acquisition or sale of assets, with notice to you.

5. International transfers

We are based in Australia. Our servers and backups are hosted by Amazon Web Services in the United States (us-east-1), and our other providers mainly process data in the United States. This means personal information is disclosed to recipients outside Australia, chiefly in the United States. We take reasonable steps, including contractual commitments, to ensure those recipients handle it consistently with the Australian Privacy Principles. Where UK, EU or other law requires it, we protect transfers with the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or another approved mechanism.

6. How long we keep it

• Account and business data: while your account is open. When you delete a business, we delete it 30 days after your request.
• Sent invoices, payments and related records: retained for as long as tax and accounting laws require (typically 6–7 years), even after you delete your account, in a restricted state.
• Security logs: up to [12 months].
• Backups are overwritten on a rolling basis, within [35 days].

7. Security

We use encryption in transit, hashed passwords, optional two-factor authentication, session management, role-based access for team members, and audit logs. No system is perfectly secure; if a breach affects your data we'll notify you and regulators as the law requires, including under Australia's Notifiable Data Breaches scheme.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy (account owners can export business data from Settings);
• correct inaccurate information;
• delete your information (from Settings, or by asking us);
• object to or restrict certain processing, and withdraw consent;
• receive your data in a portable format;
• not be discriminated against for using these rights (California).

Email privacy@invoiceturbo.com. We'll verify your identity and respond within the time the law requires (usually 30 days). You can also complain to your local regulator: the ICO (UK), the Data Protection Commission (Ireland), the Office of the Privacy Commissioner of Canada, the OAIC (Australia), the Office of the Privacy Commissioner (New Zealand) or your state attorney general (US).

Complaints in Australia. If you think we have breached the Australian Privacy Principles, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9. Children

InvoiceTurbo is a business tool and is not for children under 16. We don't knowingly collect their information.

10. Changes

We'll post updates here and change the date above. For material changes we'll notify account holders by email or in the app.

11. Contact

Nexora Futureworks Pty Ltd, Berwick, Victoria, Australia. Privacy questions: privacy@invoiceturbo.com.