Privacy Policy

This policy describes how the InvoiceFlow service processes personal data. The controller is the operator identified at the end of this page. The service is intended for business sellers and their authorized team members, not for consumer use.

Different processing activities can involve different roles. For seller account and workspace data, the operator generally acts as controller. For buyer and order data processed on a seller’s instruction through marketplace integrations, the seller may be the controller and InvoiceFlow may act as a processor. A DPA template is available at /dpa for review.

Account data: name, email, password hash, locale, timezone, authentication sessions, verification and reset tokens, and security metadata such as IP address and user agent.

Company and billing data: legal/company name, address, tax identifiers, invoice settings, subscription plan, Stripe customer/subscription identifiers and payment status. InvoiceFlow does not receive raw card numbers.

Marketplace and invoice data: marketplace identifiers, order identifiers, customer name/email/address/tax identifiers where authorized, order items, amounts, tax data, invoices, credit notes, PDFs and audit events.

Support data: name, email, topic and message submitted through the contact form.

We process account and workspace data to provide the service (contract), secure the service and prevent abuse (legitimate interests and legal obligations), comply with accounting/tax obligations where applicable, and respond to support or legal requests. Optional analytics or marketing technologies are activated only with consent where required.

We do not use customer invoice data to train advertising profiles. Automated decision-making with legal effect is not implemented.

When a seller authorizes Amazon, eBay or eMAG, InvoiceFlow receives order and related data through the official API. Availability of buyer name, address, email and tax data depends on the marketplace and the seller’s approved roles. The connector imports non-PII order data where PII is unavailable and flags orders requiring additional authorization rather than inventing data.

Recipients may include the operator’s hosting provider, Stripe for paid subscription billing, and an email provider if configured by the operator. The current production subprocessor list is maintained at /subprocessors. We do not list providers that are not actually enabled.

Access is limited by company membership and role. Marketplace credentials are encrypted at rest and are not returned to the browser.

The operator must document any third-country transfer and applicable safeguard before enabling a provider outside the EEA. Stripe and hosting/email providers may process data in other countries under their applicable terms and safeguards. This template does not assert that a transfer mechanism is in place until the operator verifies it.

Account and session data are retained while the account is active and for a reasonable security period afterwards. Financial records, invoices and audit events may be subject to statutory accounting and retention obligations and are not deleted by generic account-deletion logic. Marketplace buyer data is retained only as needed for the seller’s invoicing and legal obligations. Support messages are retained for handling and legal defense. The operator must set concrete retention periods and review them with counsel.

Necessary authentication cookies and workspace/consent local storage are used to operate the service. Optional analytics and marketing categories are off by default and are only enabled after consent where required. See the cookie notice and the “Cookie settings” control in the footer.

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing; withdraw consent; and lodge a complaint with a supervisory authority. Financial records may be exempt from erasure where retention is legally required. Requests can be sent to the operator privacy contact.

InvoiceFlow uses company-level isolation, role permissions, encrypted marketplace credentials, revocable sessions, HTTPS in production and audit logging. No security measure is absolute. We may update this policy and will publish the updated date; material changes may require renewed consent where applicable.