Privacy Policy

Innvois Solutions Limited (“Innvois”, “we”, “us”, or “our”) is committed to protecting personal data and maintaining transparency regarding how information is collected, used, and safeguarded.

This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights regarding your information.

1. Scope of This Policy

This Policy applies to:

• Merchants using the Innvois Platform
• Merchant users (owners, administrators, staff)
• Customers whose data appears on invoices
• Visitors to our website

2. Roles in Data Processing

2.1 Merchant as Data Controller

For customer data uploaded or entered into the Platform (such as invoice recipients), the Merchant acts as the Data Controller.

Innvois acts solely as a Data Processorin relation to such customer data.

The Merchant is responsible for:

• Ensuring lawful collection of customer data
• Providing required privacy notices
• Obtaining necessary consent where applicable

2.2 Innvois as Data Controller

Innvois acts as Data Controller for:

• Merchant account registration information
• Subscription billing data
• Platform usage and technical logs
• Website visitor data

3. Personal Data We Collect

3.1 Merchant Account Information

• Name
• Business name
• Email address
• Phone number (if provided)
• Business address (if provided)
• Encrypted authentication credentials

3.2 Business & Invoice Data

• Invoice details and line items
• Customer names and contact information (as entered by Merchant)
• VAT configurations and tax settings
• Transaction references

3.3 Payment & Billing Information

• Subscription plan details
• Billing history
• Transaction references from Payment Service Providers (PSPs)
• Payment confirmation status

Innvois does not store full card details. Payment processing is handled by licensed third-party PSPs.

3.4 Technical & Usage Data

• IP address
• Device and browser information
• Session logs
• Error reports

4. How We Use Personal Data

We use personal data to:

• Provide and operate the Platform
• Authenticate users
• Process subscription billing
• Verify payment confirmations
• Maintain financial audit trails
• Monitor fraud and abuse
• Improve system performance and reliability
• Comply with legal and regulatory obligations

We do not sell personal data.

5. Legal Basis for Processing

Depending on jurisdiction, processing may rely on:

• Contractual necessity (providing Platform services)
• Legitimate interests (security, fraud prevention, system integrity)
• Legal obligations (tax and regulatory compliance)
• Consent (where required)

6. Data Sharing & Disclosure

6.1 Payment Service Providers

Payment transaction data is shared with licensed PSPs to facilitate payment processing. PSPs operate under their own privacy policies.

6.2 Infrastructure & Subprocessors

We may engage third-party providers for hosting, email delivery, security monitoring, and analytics. These providers process data under contractual obligations.

6.3 Legal Requirements

We may disclose data where required by court order, law enforcement, or regulatory authorities.

7. International Transfers

Where data is transferred outside your jurisdiction, appropriate safeguards are implemented in accordance with applicable data protection laws.

8. Data Retention

We retain personal data only as long as necessary to:

• Provide services
• Fulfill contractual obligations
• Comply with tax and regulatory requirements
• Maintain audit and financial records

Certain financial records may be retained for extended periods where required by law.

9. Security Measures

We implement technical and organizational safeguards including:

• Encryption in transit
• Role-based access control
• Organization-level data isolation
• Audit logging of critical actions
• Monitoring for suspicious activity

While no system is completely secure, we take reasonable measures to protect data.

10. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion (subject to legal retention obligations)
• Restrict or object to processing
• Request data portability

11. Data Breach Notification

In the event of a data breach affecting personal data, we will investigate promptly and notify affected parties where required by law.

12. Children’s Data

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

13. Changes to This Policy

We may update this Privacy Policy periodically. Continued use of the Platform constitutes acceptance of updates.

14. Contact

Privacy inquiries: privacy@innvois.com