Privacy Policy

This Privacy Policy explains how Invoyr Limited, trading as Invoyr, of 128 City Road, London, United Kingdom, EC1V 2NX, company number 17502051 (“Invoyr”, “we”, “us”) handles personal data in connection with the Invoyr website, web application and related services (the “Service”).

Invoyr is a business-to-business service. It should be read together with our Terms & Conditionsand, where Invoyr processes personal data on a Customer’s behalf, our Data Processing Addendum.

1. The two roles Invoyr plays

This is the most important thing to understand about how we handle data.

We are a controller for the information we decide how to use: your account details, your subscription and billing records, your use of the Service, support correspondence and marketing preferences. This policy governs that data.

We are a processorfor the data you put into the Service about your own clients — their names, contact details, invoices, payments and related records (“Customer Data”). You decide why and how that data is used; we act on your instructions. Our Data Processing Addendum governs that processing, and your own privacy notice — not this one — is what your clients should be given.

2. Personal data we collect as a controller

• Account data: your name, email address and a securely hashed password, or the basic profile returned by Google if you sign in that way.
• Business data: your business name, address, VAT number, logo, bank details shown on your invoices, and the contact details you publish to your clients.
• Subscription and billing data: your plan, trial and renewal dates, and payment records. Card details are handled by Stripe — we never receive or store complete card numbers.
• Usage and technical data: log data, IP address, device and browser information, and records of actions taken in your account (our audit log).
• Email delivery data: records of the transactional emails we send on your behalf, including whether they were delivered and opened.
• Communications: messages you send us through the contact form or support email, and your marketing preferences.

3. Why we use it, and our lawful basis

• To provide the Service — creating your account, hosting your data, sending invoices you ask us to send, processing payments. Lawful basis: performance of a contract.
• To take payment and manage subscriptions, including starting trials, converting them and handling failed payments. Lawful basis: performance of a contract.
• To keep the Service secure — authentication, rate limiting, anti-bot checks, fraud prevention and audit logging. Lawful basis: legitimate interests in protecting the Service and its users.
• To support and improve the Service, and to respond to your questions. Lawful basis: legitimate interests in running and improving our business.
• To send service messages you need to receive, such as trial reminders, billing notices and security alerts. These are not marketing and cannot be opted out of while you hold an account. Lawful basis: performance of a contract.
• To send marketing email about Invoyr. Lawful basis: consent, given by opting in — you can withdraw it at any time using the unsubscribe link or in your settings.
• To meet legal obligations, including tax, accounting and responding to lawful requests. Lawful basis: legal obligation.

4. Customer Data: what we do and do not do with it

We host and process Customer Data to provide the Service to you, to keep it secure, to back it up, and to support you when you ask.

We do not sell Customer Data, we do not use it to advertise to you or to anyone else, and we do not use it to train machine-learning models.

Where you enable automated invoice reminders, you are instructing us to email your clients on your behalf. You remain responsible for having a lawful basis to contact them, as set out in the Terms.

5. Sub-processors and sharing

We use a small number of providers to run the Service. Each is bound by contract to protect the data it handles and to use it only for the purpose below.

• Supabase — Database, authentication and file storage — where Customer Data is held at rest. Processed in: European Union (Frankfurt).
• Vercel — Application hosting and content delivery — processes requests in transit. Processed in: United States, with global edge network.
• Resend — Sending transactional and marketing email. Processed in: United States / European Union.
• Stripe — Subscription billing, and card payments collected by Customers from their clients. Processed in: United States / European Union.
• PayPal — Payments collected by Customers from their clients, where enabled. Processed in: United States / European Union.
• TrueLayer — Open Banking connections and bank transaction data, where a Customer connects an account. Processed in: United Kingdom / European Union.
• Cloudflare — Turnstile anti-bot checks on sign-up and contact forms. Processed in: Global edge network.
• Upstash — Rate limiting — stores short-lived counters keyed to IP addresses. Processed in: European Union.

We may also share personal data with professional advisers, or where required by law, a regulator or a court. If Invoyr is involved in a merger, acquisition or sale of assets, data may transfer to the acquiring party, and we will notify you before that happens.

6. International transfers

Customer Data is stored at rest in the European Union (Frankfurt). Some of our providers, including our hosting and email providers, process data in the United States or across a global network, which means personal data may be processed outside the UK and EEA.

Where that happens, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement or Addendum, and the European Commission’s Standard Contractual Clauses — together with the provider’s own technical protections.

7. How long we keep it

• Customer Data: for as long as your account is active. Following termination or account deletion, it is ordinarily scheduled for deletion from active systems within 7 days, as set out in the Terms.
• Backups: data may persist in encrypted backups after deletion and is overwritten on our normal backup cycle.
• Billing, tax and contractual records: retained for as long as required by law, typically six years.
• Security, fraud-prevention and suppression records: retained where necessary — for example, an unsubscribe record must be kept so we do not email you again.

Export your records before deleting your account if you are required to keep them. You can do this from Account settings, which stays available even if your subscription has lapsed.

8. Your rights

Under UK and EU data protection law you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it.

To exercise any of these, email support@invoyr.io. We will respond within one month.

If your data was given to Invoyr by one of our Customers — for example, because you are a client being invoiced through Invoyr — please contact that business directly, as they control that data. We will pass on any request we receive.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority.

9. Cookies

Invoyr uses only the cookies it needs to work. We do not use advertising cookies and we do not run third-party analytics.

• Authentication cookies — keep you signed in and maintain your session.
• Active organisation cookie — remembers which business you are working in when you belong to more than one.
• Cloudflare Turnstile — sets a short-lived token to confirm sign-up and contact form submissions are not automated.

These are strictly necessary for the Service, so they do not require consent. Blocking them will prevent the Service from working.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, row-level database access controls that isolate each business’s data, encryption of stored banking tokens, rate limiting, anti-bot checks and audit logging of account activity.

No internet service can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and notify you without undue delay where the risk is high.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means alone.

12. Children

Invoyr is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18.

13. Changes to this policy

We may update this policy as the Service, our providers or the law change. Where a change materially affects you we will give reasonable notice before it takes effect. The date at the top of this page shows when it was last updated.

14. Contact

Questions, requests or complaints about privacy can be sent to:
Email: support@invoyr.io
Business: Invoyr / Invoyr Limited
Address: 128 City Road, London, United Kingdom, EC1V 2NX