Privacy Policy

1. Who we are

InvOnline ("we", "us") is an online tool that helps individuals and small businesses create and send invoices. We do not process payments — we only generate invoice documents based on information you enter.

InvOnline is a service operated by 9451-0468 Québec Inc., a corporation registered in Québec, Canada.

For any privacy question or to exercise your rights, contact our privacy officer at privacy@invonline.co.

2. What we collect

We collect only what we need to run the service:

• Account data — your email address, and, if you sign in with Google, your name and profile picture provided by Google.
• Invoice content you create — your business profile, your customers' names and contact information, invoice line items, prices, and related notes. This is data you input.
• Technical data — IP address, browser type, and a session cookie used to keep you signed in. We do not use third-party analytics or advertising trackers.
• Feedback data — messages you submit, your contact email if you allow us to contact you, screenshots you choose to attach, the relevant application page and version, and browser or operating-system information for problem reports.

3. How we use your information

• To create and store your invoices and let you re-open them.
• To authenticate you (sending one-time codes by email, or via Google).
• To send service-related messages (security alerts, account changes).
• To keep the service secure and prevent abuse.
• To review feedback, troubleshoot reported problems, and improve the Service.

We do not use your information for advertising. We do not sell or rent your data to anyone.

4. Your invoice data and your clients

When you create an invoice, you may enter personal information about your own clients (name, address, email). Under Canadian privacy law, you remain the controller of that information. We act on your behalf to store and render it, and we will not use it for any purpose other than providing the service to you.

5. Where your data is stored

All account and invoice data stored by InvOnline is located on servers we operate at DigitalOcean's Toronto, Canada data centre. Content transmitted for email delivery may be processed outside Canada as described in Section 6.

Guest Trial: When you use Guest Trial without signing in, your invoice content is stored locally on your device rather than on our servers. It is removed after you download the PDF or when you return after 24 hours. The downloaded PDF remains on your device.

6. Who else processes your data

The only third parties that receive any of your data are the ones strictly required to operate the service, provide sign-in and email delivery, and load the optional signature fonts:

• DigitalOcean, LLC (servers located in Toronto, Canada) — provides the cloud infrastructure where our application and your data are hosted.
• Google LLC (United States) — if you choose to sign in with Google, Google receives the sign-in request and returns identity information to us. If you use address autocomplete, your browser sends your address search to Google Places so it can return suggestions. When you open the typed-signature feature, your browser also connects to Google Fonts to download the selected font. Google may receive technical request data such as your IP address, browser information, and the requested address or font resource. Google Fonts is not used for advertising or analytics.
• Resend or SendGrid — used to deliver transactional emails, including verification codes, invoices, template requests, and feedback. Depending on the action you request, the provider may process recipient email addresses, email content, delivery metadata, attached invoices, and screenshots. The provider may temporarily retain this information for delivery, security, abuse prevention, and troubleshooting in accordance with its own retention policy.

These providers are bound by their own privacy commitments. We do not sell or rent your data. Email content and attachments are transmitted to the configured email provider only when you request that an email be sent or submit feedback through the Service.

7. How long we keep your data

• Account data — kept while your account is active. If you ask us to close your account (see below), we remove your account data within 30 days, except minimal records we may retain to handle legal requests or prevent abuse.
• Invoice and customer content — kept while your account is active. When you delete an invoice or customer, it is removed immediately and cannot be recovered. We recommend downloading any records you wish to keep before deleting them. You may also request deletion of all your data by emailing privacy@invonline.co; we will process the request within 30 days.
• Server logs — kept for up to 90 days for security and troubleshooting.

Note: InvOnline is only a tool to generate invoices. If your country requires you to keep invoice copies for tax purposes (typically 6-7 years), you are responsible for downloading and archiving your own copies.

8. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and the data tied to it.
• Withdraw your consent and stop using the service at any time.
• Lodge a complaint with a privacy regulator — the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'acces a l'information (Quebec), or your provincial regulator.

To exercise any of these, email privacy@invonline.co. We will respond within 30 days.

9. Security

We use technical and organizational safeguards to protect your information, including HTTPS and restricted server access. Account passwords are not stored because we use email or Google sign-in. As no online system is completely risk-free, we regularly review and improve our security practices.

If we discover a security breach that affects your personal information, we will notify you and the relevant privacy regulator as required by law.

10. Cookies

We use a single session cookie to keep you signed in. We do not use marketing, analytics, or third-party tracking cookies.

11. Children

InvOnline is intended for adults running a business. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it.

12. Quebec privacy law (Law 25)

Because 9451-0468 Québec Inc. is registered in Québec, we are subject to Québec's Act respecting the protection of personal information in the private sector (commonly referred to as Law 25). This applies to all users of the Service, not only those who reside in Québec.

Under Law 25, you have the right to:

• access and obtain a copy of the personal information we hold about you;
• have inaccurate, incomplete or out-of-date information corrected;
• have your personal information de-indexed or deleted in the cases provided by law;
• request portability of your computerized personal information;
• be informed of any automated decision-making — we do not use any.

Our designated person in charge of the protection of personal information (privacy officer) is the Privacy Officer, 9451-0468 Québec Inc., reachable at privacy@invonline.co.

In the event of a confidentiality incident presenting a risk of serious injury, we will notify affected users and the Commission d'acces a l'information du Quebec, as required by Law 25.

13. Changes to this policy

We may update this policy as the service evolves. If we make material changes, we will notify you by email or through the application. The "Last updated" date at the top tells you when the current version took effect.

14. Contact

Questions, requests, or complaints: privacy@invonline.co