Privacy Policy

1. Introduction

Welcome to Invoverge (“Company”, “we”, “our”, or “us”). This Privacy Policy explains how we collect, use, disclose and safeguard your personal information when you use our invoicing platform available at https://invoverge.com (the “Service”).

This policy is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25), and the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) in the United States.

2. Privacy Officer & Accountability

As required by PIPEDA Principle 1 (Accountability) and Quebec Law 25, we have designated a Privacy Officer responsible for our compliance with this policy and applicable privacy laws:

You may contact the Privacy Officer for any privacy-related question, access request, correction request, deletion request, or complaint. We respond to all substantive requests within 30 days.

3. Information We Collect (Categories)

We collect the following categories of personal information (CCPA §1798.140):

• Identifiers: name, email, business name, IP address, session/CSRF cookies.
• Commercial information: invoices, estimates, expenses and time entries you create; the clients you invoice.
• Financial information: your Stripe customer ID and subscription plan. We do not receive or store card numbers — Stripe handles all payment credentials directly.
• Internet/network activity: login history (email, IP, user-agent, timestamp) retained for 12 months for security.
• Audit records: security-relevant actions retained for 24 months.
• Inferences: AI-generated invoice insights derived from your invoice history to help you get paid faster.

We do not knowingly collect sensitive personal information (health, biometric, precise geolocation, religion, etc.) or the personal information of minors under 16.

4. Why We Collect It (Purposes)

Per PIPEDA Principle 2, we collect personal information only for these identified purposes:

• To provide, maintain and secure the Service (contract performance).
• To process subscription payments through Stripe.
• To send transactional email (invoices, receipts, verification, security alerts).
• To comply with legal obligations, including Canadian tax and record-keeping law.
• To prevent fraud and unauthorized access.
• To improve product quality and support (aggregated, non-identifying analytics only).

5. Consent (Meaningful Consent)

Per PIPEDA Principle 3 and Quebec Law 25 §12, we capture explicit consent at the time you create your account. You acknowledge this Privacy Policy and our Terms of Service by ticking the consent checkbox on the signup form. We record the date, time, IP address and the policy version you accepted.

You may withdraw consent at any time by deleting your account (Settings → Security → Delete account). Withdrawing consent terminates your Service access.

6. How We Share Information (Sub-Processors)

We share personal information only with the following sub-processors, each bound by contractual and legal safeguards:

We do not sell or share your personal information for cross-context behavioural advertising, and we do not use targeted advertising. This means the CCPA “Do Not Sell or Share My Personal Information” right is honoured by default for all users.

7. Cross-Border Transfers

Some sub-processors process data in the United States. Under PIPEDA and Quebec Law 25 §17, we assess each cross-border transfer for adequacy and require contractual safeguards. Canadian data-protection authorities may access this data if a US court so orders. By using the Service, you acknowledge this transfer.

8. Retention (Limiting Retention)

PIPEDA Principle 5 requires us to keep personal information only as long as necessary. We apply the following schedule:

• Live invoices, clients, expenses, projects: for the life of your account, plus 7 years after deletion to meet Canadian tax record obligations (Income Tax Act, s. 230).
• Audit logs: 24 months (automatic deletion via database TTL).
• Login history: 12 months (automatic deletion via database TTL).
• Session tokens (revoked): 7 days.
• Password-reset tokens: 1 hour.
• Backups: rolling 7 days.
• Deleted account traces: anonymized within 30 days.

9. Your Rights

Depending on where you live, you have the following rights over your personal information:

Canada — PIPEDA & Quebec Law 25

• Access — obtain a copy of your data (Settings → Security → Export data).
• Rectification — correct inaccurate data (Settings → Profile).
• Deletion — delete your account (Settings → Security → Delete account).
• Portability (Quebec Law 25) — receive your data in a structured, commonly-used, machine-readable format (JSON export).
• De-indexing (Quebec Law 25) — request removal of specific data from search results if applicable.
• Object to automated decisions — none of our automated processing produces legal effects on you.
• Complain — to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information.

United States — CCPA / CPRA (California residents)

• Right to know what personal information we collect, use, and disclose about you.
• Right to delete personal information you provided to us.
• Right to correct inaccurate personal information.
• Right to opt out of sale/sharing — we do not sell or share personal information; nothing to opt out of.
• Right to non-discrimination — we will not deny service, charge different prices, or provide lesser quality if you exercise a CCPA right.
• Right to limit use of sensitive personal information — we do not collect sensitive PI within the CCPA definition.

To exercise any of the above rights, email support@invoverge.com. We verify the request against your account and respond within 30 days (PIPEDA) or 45 days (CCPA), extendable when justified.

10. Safeguards (Security)

Per PIPEDA Principle 7, we protect personal information with physical, organizational and technical safeguards:

• TLS 1.2+ in transit; MongoDB storage with encryption at rest.
• Bcrypt-hashed passwords; HttpOnly & SameSite session cookies; CSRF protection.
• Optional two-factor authentication (TOTP).
• Audit logging of security-relevant actions.
• Signed Stripe webhooks and rate-limited authentication.
• Least-privilege access to production systems.

11. Breach Notification

If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada without unreasonable delay, as required by PIPEDA §10.1. In Quebec, we will also notify the Commission d’accès à l’information. For California residents, we comply with California Civil Code §1798.82 breach-notification obligations.

12. Cookies

We use only strictly necessary cookies: a session cookie (HttpOnly, for login), a CSRF token cookie (for protection against cross-site request forgery), a theme preference (localStorage), Stripe.js cookies (when you visit checkout), and Sentry cookies (when an error occurs). We do not use advertising, analytics or cross-site tracking cookies. See our Cookie Policy for details.

13. Children’s Privacy

The Service is not intended for and not directed to individuals under 16. We do not knowingly collect personal information from minors. If we learn that we have collected information from a child under 16, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to the address on your account and posted on this page with a new “Last Updated” date. Continued use of the Service after a material change constitutes acceptance.