Privacy Policy

Who we are

InvoiceStudio (“InvoiceStudio”, “we”, “us”) is the online invoicing service at invoicestudio.cc. For the personal data described in this policy we are the data controller, except for the data about your own clients that you put into your invoices (see Your clients’ data).

To contact us about privacy, use the chat on this site (open the chat, then choose “Talk to a human”) and leave your email address and question, or email us at support@invoicestudio.cc. We reply by email.

What we collect

Account details

Your name, email address and password. We store the password only as a secure hash, never in readable form. We also keep your plan, when it renews or ends, and any plan upgrade you ask for.

Business profile and settings

What you add in Settings: business name, address, phone, tax number, logo, brand colours, invoice defaults, and the payment details you show on invoices (for example a PayPal address, bank details or a wallet address). If you set up email sending, we store your mail server (SMTP) settings, including the username and password, so we can send invoices from your own mailbox.

Invoices, clients and payments

The documents you create (invoices, quotes, estimates, credit notes, purchase orders, delivery notes), their line items, notes and signatures, the clients you save, the payments you record, recurring schedules, and a copy of the invoice emails you send or keep in the outbox. If you import a CSV file, we store the rows you import.

Billing

When you buy a plan, Stripe collects your card or wallet details on its own secure checkout page. We do not receive or store card numbers. Stripe tells us your email address, your name if you gave it, the plan you bought, and Stripe’s own customer and subscription reference numbers, which we keep with your account.

AI, voice and chat

• Voice and typed invoice requests (Pro and above). The sentence you say or type, plus the names of your saved clients and your default currency, so the AI can match the right client.
• Voice recordings (Pro and above). When ElevenLabs listening is on, the short audio clip you record and the language you chose. We pass the clip on for transcription and do not keep it on our server.
• Spoken replies. The text of the assistant’s reply, when you have it read aloud.
• Website chat (Ivy). The messages you type in the chat during that conversation.
• Messages to the team. If you leave a message through the chat, we keep your email address, your message and the page you sent it from.

Security records

For sign-ins, failed sign-ins, password changes and administrator actions we record the time, the event, the IP address and the browser’s user-agent string. We also count failed sign-in attempts to block password guessing.

Page view statistics

We count visits to our public pages and the app with our own simple tool, not with Google Analytics or any other outside service. For each page view we store the date, the page address, the website that referred you (only its domain), any utm_source tag in the link, and whether the device is a phone, tablet or computer. To count unique visitors we store a short code made from your IP address, your browser’s user-agent and a secret value that changes every day. We do not store the IP address itself, and the code cannot be used to follow you from one day to the next. Known bots are not counted.

How we use your data

• To run your account and the features you use: creating, saving, sending and exporting documents, tracking payments, recurring invoices and reports.
• To take payment for paid plans and switch your plan on or off.
• To turn your voice or text into an invoice draft, and to answer questions in the website chat.
• To reply when you contact us.
• To keep the service secure: stopping password guessing, spotting misuse, and keeping backups so data can be restored.
• To understand which pages are useful, using the cookie-free statistics described above.

We do not sell your personal data, we do not use it for advertising, and we do not use your invoices or clients to train AI models.

Legal bases (GDPR)

If you are in the European Economic Area, the United Kingdom or another place with similar law, we rely on these legal bases:

• Contract: to provide the account, the features you ask for, and paid plans you buy.
• Legitimate interests: to keep the service secure, keep backups, count page views without cookies, and improve the site. We have weighed these against your rights and keep the data to a minimum.
• Consent: when you choose to use the voice features, the website chat, or send us a message. You can stop at any time by not using them.
• Legal obligation: where we must keep payment records for tax and accounting law.

Your clients’ data

The invoices, quotes and client records you create often contain personal data about other people, such as your clients’ names, email addresses and addresses. For that data, you are the controller and we act as your processor: we store and process it only to provide the service to you, on your instructions. You are responsible for having a lawful reason to use your clients’ data and for telling them how you use it.

Who we share it with

We share data only with the service providers below, only as much as each one needs, and only to run InvoiceStudio:

• Stripe — payment processing for paid plans. Stripe handles your card details under its own privacy policy.
• Anthropic (Claude AI) — reads voice or typed invoice requests and answers website chat messages.
• ElevenLabs — turns recorded speech into text and reads assistant replies aloud.
• Our hosting provider — runs the server where the website, the database and the backups are stored.
• Your own email provider — when you send an invoice, it goes through the mail server you set up (for example Gmail, Outlook or Zoho), under that provider’s terms.

The free voice option uses your browser’s built-in speech recognition. Some browsers, such as Chrome, process this speech on the browser maker’s servers under its own privacy policy.

We may also share data if the law requires it, to protect our rights or users’ safety, or as part of a sale or merger of the service, in which case this policy will continue to apply to your data.

International transfers

Stripe, Anthropic and ElevenLabs may process data in the United States and other countries. Where data leaves the EEA or the UK, these providers use legal safeguards such as the European Commission’s Standard Contractual Clauses.

Cookies and browser storage

We use one cookie: a session cookie called invstudio_sid. It keeps you signed in and protects forms against cross-site request forgery. It is set only when you sign in, create an account, go to checkout, or send a form or chat message. It is marked HttpOnly and SameSite=Lax, is sent only over HTTPS, and lasts up to 30 days or until you sign out. It is strictly necessary, so it does not need consent. If you just read our public pages, no cookie is set.

We use no advertising, tracking or social media cookies.

The site also keeps a few things in your browser’s own storage (localStorage and sessionStorage) for convenience: an unsaved invoice draft, custom currencies, your voice language settings, the tabs you had open in the app, and whether you closed a tip or the chat greeting. This stays on your device and is not sent to us automatically. You can clear it in your browser settings at any time.

How long we keep data

• Account, settings, invoices, clients and payments: for as long as your account exists. Documents and clients you delete are removed straight away.
• After you delete your account: your data is removed from the live database. Copies remain in our backups until those backups are replaced, which takes about two weeks.
• Backups: we make backups every night and keep the most recent 14.
• Security records: 180 days, then deleted automatically.
• Sign-in session: up to 30 days, or until you sign out.
• Messages you send us: as long as we need them to help you.
• Page view statistics: kept as statistics. They contain no IP addresses and the daily visitor code cannot be traced back to you.
• Billing records: as long as tax and accounting law requires.
• AI and voice requests: we do not store the audio. Anthropic and ElevenLabs keep request data only as their own API terms allow.

Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that is wrong (most of it you can edit yourself in Settings and My plan & account);
• delete your data or your whole account;
• take your data with you: you can download every invoice as a PDF, and on Pro and above export your data as CSV;
• object to or restrict how we use your data;
• withdraw consent at any time, without affecting what was done before;
• complain to your local data protection authority.

To use any of these rights, including deleting your account, message us through the chat or email support@invoicestudio.cc from the email address on your account. We reply within one month.

Security

The whole site runs over HTTPS. Passwords are stored as secure hashes. Each account can only see its own invoices and clients. Forms are protected against cross-site request forgery, repeated wrong passwords are blocked, and pages are served with strict security headers that allow only our own scripts. The database is backed up every night. No system is perfectly secure, so please use a strong password that you do not use anywhere else. If a data breach affects you, we will tell you as the law requires.

Children

InvoiceStudio is a business tool and is not meant for children. You must be at least 16 years old to create an account. We do not knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy when the service changes or the law requires it. We will change the “Last updated” date at the top, and if the changes are important we will tell signed-in users in the app or by email before they take effect.

Contact us

Questions about this policy or your data? Email support@invoicestudio.cc, or open the chat, choose “Talk to a human”, and leave your email address and question. We will reply by email.

See also our Terms of Service.