Privacy Policy
Last updated: 16 October 2026
This policy explains what personal data InvoiceFlow collects, why, who it is shared with, how long it is kept, and the rights you have over it.
1. Who we are
InvoiceFlow is operated by Infraforge Consulting Private Limited, 05/306, Ram Nagar Street, Mohammadi, Uttar Pradesh, India ("we", "us"). For the personal data described in this policy we act as the data fiduciary / controller, except where section 2 says we act as a processor.
Privacy contact and Grievance Officer: see section 14. Email hello@infraforgeconsulting.com.
2. Our two roles
- Your account data (who you are, your business, your subscription): we decide why and how it is used — we are the controller.
- Your customer data (your clients' names, emails and addresses, the invoices, quotes and documents you create or upload): you decide why and how it is used — you are the controller (or data fiduciary) and we are your processor, acting only on your instructions under our Data Processing Addendum. If you are a client of one of our users and want to see or delete your data, ask that user first; we will help them respond.
3. What we collect, why, and our legal basis
| Data | Why we use it | Basis |
|---|---|---|
| Identity and sign-in: name, email, profile photo, sign-in method (via Clerk) | Create and secure your account, contact you about the service | Contract; legitimate interests (security) |
| Business profile you enter: business name and address, GSTIN, PAN, LUT number, phone, logo, signature, bank account name/number/IFSC/SWIFT, UPI ID | Print on your invoices and payment pages, tax and compliance features | Contract (you instruct us to use it) |
| Customer data you enter: clients, invoices, quotes, payments, expenses, projects, time entries, contracts, Vault documents | Provide the invoicing, reminders, analytics, exports and storage you asked for | Contract (we process on your instructions) |
| Subscription and payments: plan, billing period, Razorpay customer/subscription IDs, payment status. Card/UPI details are entered with Razorpay and never reach us | Billing, refunds, tax records, fraud prevention | Contract; legal obligation (tax records) |
| Expense receipts you upload (PDF or image) | Keep a record of the expense and let you attach it when billing a client | Contract (we process on your instructions) |
| AI inputs: prompts, receipt files and invoice context you submit to AI features | Return the AI result you requested (sent to OpenAI) | Contract; your request for the feature |
| Activity and usage: actions in your account (activity log), AI credit usage, notifications, referral and partner records | Run the product, enforce plan limits, support, show you an audit trail | Contract; legitimate interests |
| Technical data: IP address, browser/device type, request logs, error logs, security events | Keep the service secure, diagnose problems, prevent abuse | Legitimate interests |
| Client interaction records: when a client opens an invoice or quote page, accepts or declines a quote | Tell you the status of what you sent (e.g. "opened by client") | Contract; legitimate interests |
| Marketing preference (opt-in) and the date you gave or withdrew it | Send you product news only if you opt in | Consent |
| Legal acceptance: which version of our Terms/Privacy you accepted and when | Keep proof of what you agreed to | Legal obligation / legitimate interests |
We do not knowingly collect sensitive personal data (health, biometrics, religion, etc.) and ask you not to enter any. We do not sell personal data and we do not show advertising.
4. Consent (India's DPDP Act) and your choices
Where we rely on your consent — currently only optional product-news emails — it is a separate, unticked choice, specific to that purpose, and you can withdraw it at any time in Settings → Privacy & data or by contacting us; withdrawing is as easy as giving it. Other processing is necessary to provide the service you signed up for or to meet legal duties; you can stop it at any time by deleting your account.
5. Who we share data with
- Service providers (sub-processors) that host, secure, pay, email and analyse for us, bound by data-protection terms — the current list, locations and purposes are on our Sub-processors page.
- Your clients, when you send them an invoice, quote or reminder: they receive the information you put in it, your business details, and a link to a payment page.
- Your team members, CA and API keys that you invite or create, with the access level you choose.
- Referrers and partners: someone who referred you sees only a masked email and whether you sent a first invoice or subscribed; a CA partner sees a masked client email and payment amounts to calculate commission.
- Authorities, where required by law, court order or to protect rights, safety and security — we share the minimum needed and tell you where we are allowed to.
- A successor, if we merge or sell the business, with the same protections for your data.
We do not sell or rent personal data, and we do not share it for third-party advertising.
6. Transfers outside India
Our application and database run in India (Mumbai). Some providers process data elsewhere — notably Clerk, Resend and OpenAI in the United States, and Cloudflare globally (see the Sub-processors page). We transfer only what each provider needs, to providers that commit to data-protection terms (including standard contractual clauses where EU/UK data is involved), and in line with the DPDP Act and any restrictions the Government of India may notify.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account, customer data and documents | While your account is open; erased when you delete it (a few residual backups expire within 35 days) |
| Invoices moved to Trash | 30 days, then permanently deleted |
| Activity log | 12 months |
| Webhook delivery logs | 30 days |
| Notifications | Read: 90 days · all: 180 days |
| AI usage log | 13 months |
| Revoked API keys | 90 days |
| Server and security logs | Up to 30 days (longer only for an active security investigation) |
| Our own tax invoices and payment records for your subscription (held with Razorpay and our accountants) | The period tax law requires — generally 8 years — even after you delete your account |
| Record that an erasure request was completed (a one-way hash, no personal data) | 7 years |
| Marketing preference and legal-acceptance records | While your account is open; deleted with it |
As a user you may also have your own legal duty to keep tax and invoice records (for example under the GST law). Before you delete your account, export your data from Settings → Privacy & data.
8. Your rights
Under India's DPDP Act, 2023 and, where it applies, the GDPR / UK GDPR, you can:
- Access and portability — download a copy of your data (JSON) in Settings → Privacy & data.
- Correction — edit it in the app, or ask us.
- Erasure — delete your account and data in Settings → Privacy & data (permanent, subject to section 7).
- Withdraw consent — for marketing, in Settings → Privacy & data.
- Object or restrict processing based on legitimate interests, where the GDPR applies.
- Nominate another person to exercise your rights if you die or cannot (DPDP Act, s.14).
- Complain to us (section 14), to the Data Protection Board of India once it is operational, or to your local data-protection authority.
We respond within 30 days. We may need to verify your identity first. Requests about a client's data held for one of our users are passed to that user.
9. Automated decisions and AI
AI features generate drafts (invoices, contracts, reminders, receipt reading, follow-up emails) that you review before using. The collections "risk score" is a simple calculation from payment history and is advisory only; it does not decide anything about a person on its own. Content you submit to AI features is sent to OpenAI under its API terms, under which API inputs are not used to train its models unless the customer opts in — we do not opt in. Do not put information into AI features that you are not allowed to share with a processor.
10. Cookies and similar technologies
We use only the cookies and browser storage needed to sign you in and remember your preferences, and no advertising or analytics cookies. Details and a full list are on our Cookie Policy.
11. Security and breaches
We protect data with encryption in transit (TLS) and at rest at our database and storage providers, access controls and role-based permissions, rate limiting, signed short-lived file links, hashed API keys, audit logging, and least-privilege access for staff. See our Security page. No system is perfectly secure.
If a personal-data breach affects you, we will notify you without undue delay and, where the law requires, the authorities — including CERT-In (within 6 hours of becoming aware of a reportable cyber incident), the Data Protection Board of India, and EU/UK supervisory authorities within 72 hours where the GDPR applies.
12. Children
InvoiceFlow is a business tool for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
13. Changes to this policy
When we make material changes we update the date above and the policy version, and ask you to review and accept the new version the next time you sign in. Earlier versions are available on request.
14. Contact and Grievance Officer
Priyanshu Yadav, Grievance Officer
Infraforge Consulting Private Limited, 05/306, Ram Nagar Street, Mohammadi, Uttar Pradesh, India
Email: hello@infraforgeconsulting.com
We acknowledge complaints within 2 working days and aim to resolve them within 30 days.
If you are in the EU or UK and cannot reach us, you may also contact your local supervisory authority. We do not currently have an establishment or appointed representative in the EU/UK; write to the address above.