Este documento é disponibilizado apenas em inglês. A versão inglesa é a única versão juridicamente vinculativa.
1. Who controls your personal data
For the purposes of the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”) and other applicable data-protection law, the controller responsible for personal data processed in connection with Invoice Easy is Northstar Digital Solutions Ltd, a company registered in England and Wales, trading as Invoice Easy (“Invoice Easy”, “we”, “us” or “our”).
- Company number: 17374788
- Registered office: 61 Bridge Street, Kington, United Kingdom, HR5 3DJ
- Privacy contact: hello@invoiceeasyapp.com
2. The short version
Your invoice records are local-first. Your business profile, client records, invoices, line items and saved payment methods are stored in the App’s database on your device. We do not operate an Invoice Easy account or cloud database containing a copy, and we cannot see or recover those records.
Limited information leaves the device when you choose to share or export something, manage a subscription, contact us, or when the App sends product analytics or crash diagnostics. We do not sell personal data, use third-party advertising SDKs or use your invoice content to train artificial-intelligence models.
3. Information kept on your device
The following information is stored locally in the App:
- Business profile: business name, address, email, phone number, logo, tax identifiers, country, currency and invoice defaults.
- Client records: names, businesses, email addresses, phone numbers, postal addresses and tax identifiers you enter or import.
- Invoices: numbers, dates, descriptions, quantities, rates, currencies, discounts, taxes, surcharges, withholding, totals, notes and payment status.
- Payment methods: payment instructions and bank-account details you choose to display on invoices.
- Preferences: appearance, language, template and other App settings.
This information remains under your control on the device unless you use a feature that exports or shares it. Your operating system may include the App’s data in a device backup or migration under your Apple or Google settings and their privacy terms.
4. Information processed outside your device
| Category | What may be processed | Purpose | Legal basis |
|---|---|---|---|
| Subscription data | Anonymous App User ID, device and platform information, product, purchase history, receipt or purchase token, entitlement and renewal status | Validate purchases, provide Pro access, restore purchases, prevent fraud and support subscription issues | Performance of our contract and legitimate interests in protecting purchases |
| Product analytics | Pseudonymous installation ID, screen views, interactions, App lifecycle and device metadata, approximate country, invoice currency, totals and status flags, and feature events | Understand use, find problems and improve the App | Legitimate interests in understanding and improving the App, balanced by data minimisation and a persistent in-App opt-out |
| Crash diagnostics | Crash stack traces, App and operating-system version, device model, technical diagnostics and limited diagnostic breadcrumbs | Detect, investigate and fix crashes, security issues and reliability problems | Legitimate interests in maintaining a secure and reliable App |
| Support communications | Your email address, message, attachments and any diagnostic or purchase identifiers you choose to provide | Respond to you, investigate a problem and keep a record of the resolution | Performance of our contract and legitimate interests in customer support |
| Website technical logs | IP address, browser, device, requested page, timestamp and security logs collected by the website host | Deliver and secure this website, prevent abuse and diagnose faults | Legitimate interests in operating a secure website |
The legal bases above refer to Article 6 of the UK GDPR and EU GDPR. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that they are not overridden; you can ask us for more information about this assessment. We do not use solely automated decision-making that produces legal or similarly significant effects about you.
5. Product analytics
Invoice Easy uses PostHog’s EU-hosted service to measure how the App is used. Analytics is enabled by default and is not required to use paid features. We rely on our legitimate interests in understanding product usage, finding problems and improving the App.
Analytics may include screen views, taps on identified controls, App lifecycle and technical information, and events such as onboarding completion, creating or updating an invoice, adding a client, sharing a PDF, marking an invoice paid, and purchasing a subscription. Some events may contain an invoice’s currency, total, status and country code. We do not send your business display name to PostHog.
These records use a pseudonymous installation identifier. “Pseudonymous” does not mean anonymous: an IP address or distinctive activity may still relate to an identifiable person. We do not intentionally send client names, client contact details, invoice line descriptions, tax identifiers or saved bank details to PostHog.
Your right to object: you can stop future PostHog collection at any time by turning off Settings → Privacy → App analytics. The setting is stored on your device and opting out does not restrict paid features. You may also object by contacting us.
PostHog’s privacy information is available at posthog.com/privacy.
6. Subscriptions, payments and crash diagnostics
RevenueCat processes subscription and entitlement information on our behalf. The App uses a randomly generated App User ID rather than an Invoice Easy login. RevenueCat may receive device and platform information, activity timestamps, store receipt data or a Google purchase token, product and entitlement information, and purchase history even where no purchase is completed.
Apple or Google processes the payment through your store account. We do not receive your full card number. These companies also act under their own privacy notices where they control payment and store activity.
Sentry is enabled by default in production builds and processes crash reports and technical diagnostics so we can detect and fix reliability and security problems. Default PII collection is disabled, and we do not deliberately attach invoice, client, payment or concrete route-parameter data to crash reports.
7. Device permissions
The App requests a permission only when you use the related feature. You can refuse or later revoke it through device settings, though the feature may then stop working.
- Contacts: lets you select a contact and copy chosen details into a client form. Contact lookup happens on the device. We do not upload your address book.
- Photo library or media storage: lets you choose a logo or save an invoice image or document. The App accesses only what the operating system permits for that action.
- Files, mail, print and share services: let you export a backup or send, save or print an invoice using an application you choose.
8. Exporting, emailing and sharing
When you create an export, backup, PDF or invoice image, the file may contain personal and financial information. If you use the system share sheet, mail composer, printer, cloud drive or another application, that service receives the file and any recipient information under its own privacy terms.
We do not receive a copy merely because you used the App to generate or share it. You are responsible for selecting the correct recipient, protecting exported files and deleting copies you no longer need.
9. Who receives personal data
We limit access to personal data to service providers and people who need it for the purposes described above:
- PostHog: EU-hosted product analytics, enabled by default with an in-App opt-out;
- Sentry: production crash reporting and technical diagnostics;
- RevenueCat: subscription validation and entitlement management;
- Apple and Google: app distribution, payments, subscription management and device services;
- Website hosting and security provider: delivery and protection of this website;
- Professional advisers and authorities: where reasonably necessary for legal advice, claims, compliance or a binding legal request;
- A buyer or successor: if all or part of the Invoice Easy business is reorganised, financed or sold, subject to appropriate confidentiality and data-protection safeguards.
Processors acting for us must handle personal data under contract, use it only for authorised purposes and apply protections appropriate to the data.
10. International transfers
PostHog analytics is configured for its EU cloud. Sentry, RevenueCat, Apple, Google and hosting providers may process information in the United States and other countries.
Where UK or EEA data-protection law restricts a transfer, we will rely on an applicable adequacy regulation or decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You may contact us for information about the safeguard relevant to your data.
11. How long information is kept
- On-device records: until you delete individual records, restore over them, or uninstall or erase the App. We do not control operating-system backups.
- PostHog analytics: normally no more than 12 months from collection, after which events are deleted or irreversibly aggregated.
- Sentry crash diagnostics: normally no more than 90 days from receipt of a crash report.
- RevenueCat and store records: for as long as required to manage subscriptions, prevent fraud, resolve disputes and satisfy financial or legal retention duties, under the providers’ documented policies and our configuration.
- Support messages: normally for up to 24 months after the issue closes, unless a longer period is needed for a dispute, security investigation or legal duty.
- Website logs: normally for up to 30 days, unless retained longer to investigate abuse or a security incident.
We may retain information that has been irreversibly aggregated or anonymised because it can no longer identify you.
12. Your choices and rights
You can view, correct, export and delete most App records directly because they are stored on your device. You can object to and stop future analytics in the App’s privacy settings and revoke device permissions through operating-system settings.
Depending on where you live, you may have rights to:
- be informed about processing and obtain a copy of personal data;
- correct inaccurate or incomplete data;
- request deletion or restriction;
- object to processing based on legitimate interests;
- receive certain data in a portable format;
- withdraw consent at any time, without affecting earlier lawful processing;
- complain to a data-protection authority.
Send a request to hello@invoiceeasyapp.com. We will respond within one month of receiving a valid request, or tell you if we need to extend that period as the law allows. Exercising these rights is free of charge unless a request is manifestly unfounded or excessive. We may need information to verify the request and find pseudonymous records, such as a PostHog distinct ID or RevenueCat App User ID. We will not ask for more information than reasonably needed.
Because your invoice records are stored only on your device, we usually hold no copy of them: most access, correction, export and deletion requests concerning those records can only be fulfilled by you, using the App itself.
In the UK, you may complain to the Information Commissioner’s Office. If you are in the EEA, you may complain to your local supervisory authority. We would appreciate the opportunity to address the issue first.
13. Security
The App uses the operating system’s application sandbox and the security available on your device. Data sent to service providers is encrypted in transit using HTTPS/TLS. Access to provider dashboards is restricted to authorised people.
You should use a strong device passcode, enable device encryption and biometric protection where available, install operating-system updates, protect exported files and maintain secure backups. No storage or transmission method is completely secure, so we cannot guarantee absolute security.
14. Children
Invoice Easy is a business tool intended for adults and is not directed to children. You must be at least 18 to use the App. If you believe a child has provided personal data through analytics or support, contact us so we can investigate and take appropriate action.
15. Sale, advertising and artificial intelligence
We do not sell or rent personal data. The App does not contain third-party behavioural advertising SDKs and does not use personal data for cross-context behavioural advertising. We do not use invoice, client or payment-method content to train generative artificial-intelligence models.
16. Changes to this policy
We may update this policy when the App, our providers or the law changes. We will change the “Last updated” date and, where a change materially affects your rights or how data is used, provide a more prominent notice before the change takes effect where reasonably practicable.
17. Contact
Questions, requests or complaints about privacy may be sent to hello@invoiceeasyapp.com or by post to Northstar Digital Solutions Ltd, 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.