Privacy Policy

1. Introduction & scope

1.1. Invoizify is committed to processing your personal and business data strictly within the parameters of necessity, fairness, and transparency.

1.2. This Privacy Policy details how we collect, process, store, disclose, and safeguard information when you use our WhatsApp-first intelligent invoicing software, visit our website at invoizify.com, or utilize our web dashboards.

1.3. Indian Statutory Framework: This policy is prepared in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Digital Personal Data Protection Act, 2023 (“DPDPA 2023”), and the operational guidelines issued under the Digital Personal Data Protection Rules, 2025 (as notified and enforced across India).

2. Core privacy principles

• Data Minimisation: We collect only the personal information strictly required to register your account, generate your invoices, calculate totals, and process service subscriptions.
• No Sale of Data: We do not sell, rent, monetize, or trade your personal data, customer rosters, or financial figures to third-party data brokers or advertisers.
• No Advertising Use: We never use your invoice contents, line items, or customer details to build advertising profiles or deliver targeted advertisements.
• No Covert AI Training: We do not use your customer invoices or confidential business pricing to train public artificial intelligence models without separate, explicit consent.
• Transparent Retention: We do not claim “zero storage” because maintaining your account, billing history, and legal logs requires controlled, secure retention.

3. Categories of data collected

3A. What this website collects today (pre-launch waitlist)

Before launch, the only personal data this website collects is what you enter in the “Join the waitlist” form:

• your name, your WhatsApp number and, if you choose to add it, a short description of your business;
• the country your request came from (derived by our hosting provider from your IP address), your browser’s user-agent string, and the time you signed up.

We use this only to contact you on WhatsApp about your invite. It is stored in a database hosted by Cloudflare, Inc., and each signup is also emailed to our team inbox through Cloudflare’s email service. We do not use it for advertising and do not share it with anyone else. To have your waitlist entry deleted, write to Privacy / grievance email.

4. Purposes and grounds for processing

Under Indian data protection jurisprudence (including DPDPA 2023 provisions and the SPDI Rules), we process personal data under the following legitimate grounds:

4.1. Provision of Contractual Services (Performance of Contract):

• To register, verify, and maintain your Invoizify account via your mobile number;
• To process conversational prompts into formatted, downloadable, and shareable PDF invoices, estimates, and receipts;
• To transcribe audio voice notes into structured invoice text;
• To manage customer subscriptions, renewals, upgrades, and payment confirmations.

4.2. Consent of the Data Principal:

• Where you provide specific consent for non-mandatory features, such as optional marketing notifications, feedback surveys, or optional product analytics. You maintain the right to withdraw this consent at any time.

4.3. Legitimate Uses & Legal Compliance:

• To prevent fraud, abusive bot attacks, fake invoice creation, or security breaches;
• To maintain accounting and financial books of accounts as mandated by the Indian Companies Act, 2013 and applicable tax statutes;
• To comply with lawful orders, summonses, or investigative warrants issued by Indian courts, police agencies, or regulatory bodies (e.g., CERT-In, GST authorities).

5. Third-party data processors & service providers

Invoizify works with vetted infrastructure partners to provide the Service. These processors are contractually bound to process data solely pursuant to our instructions:

• WhatsApp / Meta Platforms (Messaging Layer): Messages, media, voice notes, and bot responses travel via the WhatsApp Business API / Meta infrastructure. Meta processes transmission metadata in accordance with its business privacy terms.
• Cloud Hosting & Database Infrastructure: Hosted on secure servers provided by Cloud host and region. Primary database storage is configured within the territory of India where possible.
• AI & Machine Learning Model Providers: Used for conversational interpretation, OCR (optical character recognition), and voice transcription (AI / transcription providers). These providers process transient data via zero-data-retention or enterprise API terms where enabled, and do not use our payload data to train foundational models.
• Payment Aggregators: Subscription payments are handled by RBI-authorized payment aggregators (Payment gateway (e.g. Razorpay)). Invoizify does not store full credit/debit card numbers or net banking passwords.
• Transactional Email & Communication: Providers such as Email delivery provider to deliver password resets, system alerts, and PDF invoice copies.
• Technical Error Monitoring: Crash reporting tools (Error-monitoring tool) configured to log application errors while masking sensitive payload content.

6. Cross-border data transfers

Primary personal data and invoice records are targeted for storage within cloud server regions located in India. However, certain third-party SaaS infrastructure tools (such as specific AI inference endpoints or communication APIs) may route transient requests through servers located overseas (such as in the United States or European Union). Any cross-border transmission is executed in compliance with the transfer provisions of the DPDPA 2023, ensuring that destination jurisdictions are not on any prohibited transfer list notified by the Central Government of India.

7. Data retention, archival, and deletion

7.1. We do not claim zero retention. We retain your profile data, business records, and generated invoice history for the duration of your active account to allow you to search, review, export, and manage your billing history.

7.2. Temporary Processing Files: Raw audio voice notes sent to WhatsApp are transcribed and scheduled for automated deletion within Voice-note retention (e.g. 7 days) after successful transcription.

7.3. Statutory Exceptions: Certain financial records, subscription invoices issued by Invoizify, and operational audit logs are retained for statutory retention periods (e.g., up to eight (8) financial years under Indian corporate and GST legislation), even following an account deletion request.

7.4. Detailed timelines are codified in our Data Retention & Deletion Policy.

8. Reasonable security practices

We implement reasonable technical, operational, and organizational security measures conforming to the requirements of Section 43A of the IT Act, 2000, the SPDI Rules, and Section 8(5) of the DPDPA 2023. These controls include encryption in transit (TLS 1.3), encryption at rest on storage volumes, role-based internal access controls, audit logging, and automated vulnerability monitoring. Please refer to our Security & Data Protection Statement for comprehensive details.

9. Data principal rights (under Indian law)

In accordance with the DPDPA 2023 and applicable privacy principles, you possess the following rights regarding your personal data:

• Right to Access & Summary: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Updating: You can review and update incorrect, outdated, or incomplete business details and personal information directly through your dashboard or by notifying our Grievance Officer.
• Right to Erasure / Account Deletion: You may request the deletion of your account and associated personal data, subject to mandatory legal and tax retention requirements.
• Right to Grievance Redressal: You have the right to register complaints regarding data processing directly with our Grievance Officer, with an escalation route to the Data Protection Board of India once fully functional.
• Right to Nominate: You may nominate an individual who, in the event of your death or incapacity, shall exercise your privacy rights under applicable law.

To exercise any of these rights, email our designated Grievance Officer at Privacy / grievance email.

10. Minors and children’s privacy

Invoizify is exclusively designed for lawful commercial use by adults and businesses. We do not knowingly collect, process, or track personal data belonging to individuals under eighteen (18) years of age. If we discover that personal data of a minor has been collected inadvertently, we will take immediate steps to delete that data.

11. Amendments to this privacy policy

We may revise this Privacy Policy periodically to reflect technological changes, product updates, or statutory directives. We will alert you to material changes via a WhatsApp broadcast message, an email, or an in-product alert at least fifteen (15) days prior to the changes taking effect.