Privacy Policy

1. Who we are

InvoiceOnline ("we", "us") is an online tool that helps individuals and small businesses create and send invoices. We do not process payments — we only generate invoice documents based on information you enter.

The operator of this service is 9451-0468 Quebec Inc., a corporation registered in Quebec, Canada.

For any privacy question or to exercise your rights, contact our privacy officer at privacy@invonline.co.

2. What we collect

We collect only what we need to run the service:

• Account data — your email address, and, if you sign in with Google, your name and profile picture provided by Google.
• Invoice content you create — your business profile, your customers' names and contact information, invoice line items, prices, and related notes. This is data you input.
• Technical data — IP address, browser type, and a session cookie used to keep you signed in. We do not use third-party analytics or advertising trackers.

3. How we use your information

• To create and store your invoices and let you re-open them.
• To authenticate you (sending one-time codes by email, or via Google).
• To send service-related messages (security alerts, account changes).
• To keep the service secure and prevent abuse.

We do not use your information for advertising. We do not sell or rent your data to anyone.

4. Your invoice data and your clients

When you create an invoice, you may enter personal information about your own clients (name, address, email). Under Canadian privacy law, you remain the controller of that information. We act on your behalf to store and render it, and we will not use it for any purpose other than providing the service to you.

5. Where your data is stored

All account and invoice data is stored on servers we operate at DigitalOcean's Toronto, Canada data centre. Your invoice content stays in Canada.

If you are located in the United States, please note that your data is stored and processed in Canada. Canada has been recognized by many jurisdictions as providing an adequate level of data protection.

6. Who else processes your data

The only third parties that receive any of your data are the ones strictly required to make sign-in and email delivery work:

• DigitalOcean, LLC (servers located in Toronto, Canada) — provides the cloud infrastructure where our application and your data are hosted.
• Google LLC (United States) — only if you choose to sign in with Google. Google receives the sign-in request and returns identity information to us.
• SendGrid (Twilio Inc., United States) — used to deliver one-time verification codes to your email. They process only your email address and the code.

These providers are bound by their own privacy commitments. We do not share your invoice content with them or with anyone else.

7. How long we keep your data

• Account data — kept while your account is active. If you ask us to close your account (see below), we remove your account data within 30 days, except minimal records we may retain to handle legal requests or prevent abuse.
• Invoice and customer content — kept while your account is active. You can delete any individual invoice or customer directly from the Service; deletion is immediate and permanent with no ability to restore. You may also request deletion of all your data by emailing privacy@invonline.co; we will process the request within 30 days.
• Server logs — kept for up to 90 days for security and troubleshooting.

Note: InvoiceOnline is only a tool to generate invoices. If your country requires you to keep invoice copies for tax purposes (typically 6-7 years), you are responsible for downloading and archiving your own copies.

8. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and the data tied to it.
• Withdraw your consent and stop using the service at any time.
• Lodge a complaint with a privacy regulator — the Office of the Privacy Commissioner of Canada (priv.gc.ca), the Commission d'acces a l'information (Quebec), or your provincial regulator.

To exercise any of these, email privacy@invonline.co. We will respond within 30 days.

9. Security

All connections to InvoiceOnline use HTTPS. Account passwords are not stored (we use email or Google sign-in). Access to our servers is restricted and authenticated. While we take reasonable measures, no online service can be guaranteed 100% secure.

If we discover a security breach that affects your personal information, we will notify you and the relevant privacy regulator as required by law.

10. Cookies

We use a single session cookie to keep you signed in. We do not use marketing, analytics, or third-party tracking cookies.

11. Children

InvoiceOnline is intended for adults running a business. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it.

12. Quebec privacy law (Law 25)

Because 9451-0468 Quebec Inc. is registered in Quebec, we are subject to Quebec's Act respecting the protection of personal information in the private sector (commonly referred to as Law 25). This applies to all users of the Service, not only those who reside in Quebec.

Under Law 25, you have the right to:

• access and obtain a copy of the personal information we hold about you;
• have inaccurate, incomplete or out-of-date information corrected;
• have your personal information de-indexed or deleted in the cases provided by law;
• request portability of your computerized personal information;
• be informed of any automated decision-making — we do not use any.

Our designated person in charge of the protection of personal information (privacy officer) is the Privacy Officer, 9451-0468 Quebec Inc., reachable at privacy@invonline.co.

In the event of a confidentiality incident presenting a risk of serious injury, we will notify affected users and the Commission d'acces a l'information du Quebec, as required by Law 25.

13. Changes to this policy

We may update this policy as the service evolves. If we make material changes, we will notify you by email or through the application. The "Last updated" date at the top tells you when the current version took effect.

14. Contact

Questions, requests, or complaints: privacy@invonline.co