Privacy Policy

This Privacy Policy explains what we collect and why. It applies to the invoicemaster.org website and the Invoice Master app. We follow GDPR and other applicable laws.

For account, billing, support, and website data, the controller is Enrique Moreno Tent (sole proprietor), operating Invoice Master, Trachauerstraße 5, 01139 Dresden, Germany. Email: support@invoicemaster.org.

For personal data customers add to their workspaces, the customer generally acts as controller and Invoice Master acts as processor under the Data Processing Agreement.

• Account data — name, email, password hash, company details, billing info.
• Workspace content — invoices, quotes, contacts, items, and files you upload.
• Support data — messages you send to our support channels (e.g., chat or email).
• Technical data — IP address, device, browser, and basic event logs.

• Provide and secure the service (contract).
• Billing, taxes, and account notices (contract and legal duty).
• Fraud prevention and service integrity (legitimate interests).
• Product analytics and experience improvements in the app (consent where required).
• Pricing currency personalization on the website (consent).
• Support and troubleshooting (contract and legitimate interests).

We use trusted providers to run the service:

• Supabase (EU) — database, storage, authentication.
• Stripe (EU/US) — payments.
• SendGrid / Twilio (US) — transactional email.

We also use tools on the website and in the app for analytics and support: Google Analytics, Hotjar, Crisp chat and ipapi.co for optional pricing currency personalization. Service providers that process customer content to run Invoice Master are covered by the DPA. Website-only analytics, support, and currency-personalization tools are documented here.

We show a consent banner where optional third-party services are used. We only run Google Analytics, Hotjar, and ipapi.co after you accept optional services.

• Essential — login, security, and load balancing.
• Analytics (consent) — Google Analytics and Hotjar.
• Support — Crisp chat may set cookies when you open chat.
• Currency personalization (consent) — ipapi.co may receive your IP address when we estimate local pricing currency.

We do not sell personal data. We share data with our providers listed above only to deliver the service.

We use TLS encryption in transit and role‑based access control for admin access. We monitor for abuse. Never share your password or 2FA codes with anyone.

• We keep account data while your account is active.
• Cancellation does not delete data. Use the export before deletion guide to download records you need before deleting the account.
• After you confirm account deletion, we delete your sign-in account and remove most active workspace records from the primary application database. Uploaded files and some technical or workspace records may remain in active systems.
• Billing records, security logs, provider backups, transactional email records, and data held by service providers may also remain under applicable retention settings or where retention is legally required.

• Access your personal data and ask us to correct or delete it.
• Ask us to restrict certain processing or object to it where these rights apply.
• Receive personal data you provided in a structured, commonly used, machine-readable format where data portability applies.
• Withdraw consent for optional third-party services at any time in the banner or by contacting support.
• Complain to your local data protection authority.

Some providers are outside the EEA. Where needed we rely on Standard Contractual Clauses approved by the European Commission (e.g., SendGrid in the US).

Questions: support@invoicemaster.org. We update this page as needed and change the date above.