Privacy Policy

Account data. Name, email address, and a password hash if you sign up with email and password. If you sign in through a third-party provider, we receive the profile details that provider shares (such as name and email). We never store your plain-text password.

Business profile data. Business name, address, tax IDs, bank details, logo, and default invoice settings that you choose to save.

Invoice data. Invoices, line items, clients (names, addresses, emails, tax IDs), products, and notes you create.

AI input. Text or files you paste or upload for AI extraction are read in memory and sent to our AI provider to extract the invoice data. We do not store the files or the pasted text. We keep only the structured draft you choose to save, plus a job record (input type, status, duration) to enforce usage quotas. Your AI provider processes the content under its own terms.

Technical and security data. IP address, device and browser information, session records (for example when you sign in or change security settings), and rate-limit counters.

Email logs. When the app sends email (such as password resets or invoice emails), we log delivery status and the provider's message ID. If a sender ticks "Request read receipt on open" when sending an invoice, the email contains a small tracking image, and we record the time it was first loaded and show it to the sender. That image can also load automatically in some mail apps.

Blog comments. If you post a comment on our blog we collect the name, email address, optional website and message you enter, plus a keyed hash of your IP address and your browser's user agent for spam protection. We never store your IP address itself. Your name, website and message are shown publicly once a moderator approves the comment; your email address is used only for moderation and is never shown. Our comment form uses Cloudflare Turnstile, which runs a short check in your browser to tell people from bots and may receive your IP address and browser details.

Guest data. If you use Invoqk without an account, your drafts are stored locally in your browser (IndexedDB). We do not receive them unless you sign in and choose to migrate them to your account.

We do not sell your personal data and do not use your invoices or AI inputs to build advertising profiles.

We use service providers (processors) that process data on our behalf:

• Cloudflare (Workers AI) receives the text you type, paste or dictate on the Free plan or as a guest, to return a draft invoice.
• Google (Gemini API) receives the text or files you submit for AI extraction, to return a draft invoice.
• Hosting and infrastructure (Vercel) serves the application.
• Database hosting (MongoDB, on AWS in Mumbai, India) stores account and invoice data.
• Upstash (Redis) stores rate-limiting counters.
• Cloudflare (Turnstile) checks that blog comments come from people, not bots.
• Email delivery provider sends transactional email.

Where invoices are sent to your clients, that recipient receives the content you chose to send. We may also disclose data if required by law or to protect rights and safety. If we are involved in a merger or sale, data may transfer to the successor, which must honor this policy.

Do not submit sensitive personal data (such as health data) in AI inputs unless necessary for the invoice.

Our application servers run in Frankfurt, Germany, but our database is hosted in Mumbai, India (AWS ap-south-1), and other providers (such as Cloudflare or Google for AI extraction) may process data outside your country, including outside the EEA/UK. Where required, we rely on safeguards such as Standard Contractual Clauses or an adequacy decision.

• Account, profile, and invoice data: kept while your account is active, then deleted after account deletion, except where law requires longer retention (for example accounting records).
• AI extraction records: kept as needed for quota and history, and removed when you delete your account.
• Blog comments: approved comments stay online until you ask us to remove them. Rejected comments are deleted automatically after 30 days. To have your comment or your stored name and email deleted, write to contact@invoqk.com.
• Security and email logs: kept for a limited period, generally no longer than 12 months.
• Backups roll off on their normal cycle after deletion.

Note: invoices you issue may be subject to statutory retention rules in your jurisdiction. You are responsible for keeping your own copies.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your data, to object to processing, and to withdraw consent. You can edit most data and delete your account in account settings, or contact contact@invoqk.com. We respond within 30 days. You can also complain to your local data protection authority.

We use strictly necessary cookies for authentication sessions and security, and a cookie or local storage for preferences such as language and theme. Guest drafts use browser IndexedDB. We do not use advertising cookies. If we add analytics, we will update this policy and request consent where required.

We use measures including password hashing, encrypted connections (HTTPS), session management with re-authentication for sensitive actions, access controls, and rate limiting. No system is fully secure, and we cannot guarantee absolute security. Report vulnerabilities to contact@invoqk.com.

Invoqk is not intended for anyone under 16, and we do not knowingly collect their data. Contact us if you believe a child has provided data, and we will delete it.

We may update this policy. For material changes we will notify you in the app or by email before they take effect. The "Last updated" date shows the latest version.

Invoqk, Sylhet, Bangladesh
contact@invoqk.com