Privacy Policy

1. Introduction

InvoiceFlow ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our invoicing platform at invoiceflow.com.ng (the "Service").

We comply with the General Data Protection Regulation (GDPR), the Nigeria Data Protection Regulation (NDPR), and other applicable data protection laws. By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

InvoiceFlow is the data controller responsible for your personal data. For any questions about this policy or our data practices, contact:

3. Information We Collect

3.1 Information You Provide

• Account Information: Name, email address, password (hashed), company name, business address
• Invoice Data: Client names, addresses, email addresses, invoice items, payment information
• Payment Information: Billing address, payment method details (processed by our payment providers)
• Communications: Messages sent through our contact forms or support channels

3.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on the Service
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies: See our Cookie Policy section below

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our invoicing services to you
• Legitimate Interests: Improving our services, fraud prevention, security
• Consent: Marketing communications, analytics cookies (where required)
• Legal Obligations: Compliance with tax, accounting, and legal requirements

5. How We Use Your Information

• Provide, maintain, and improve our invoicing platform
• Process transactions and send transaction notifications
• Send administrative emails (account updates, security alerts)
• Respond to your inquiries and provide customer support
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations and enforce our terms

6. Data Sharing & Third Parties

We do not sell your personal data. We may share data with:

6.1 Service Providers (Subprocessors)

• Hosting: Render.com / Replit (cloud infrastructure)
• Email: SendGrid (transactional emails)
• Error Tracking: Sentry (application monitoring)
• Payment Processing: Stripe (payment transactions)

All subprocessors are bound by Data Processing Agreements (DPAs) that comply with GDPR requirements.

6.2 Legal Requirements

We may disclose your information if required by law, court order, or to protect our rights and safety.

7. Cookies & Tracking Technologies

7.1 Essential Cookies (Always Active)

These cookies are necessary for the website to function:

• csrftoken: Security token to prevent cross-site request forgery
• sessionid: Session management for logged-in users
• invoiceflow_cookie_consent: Stores your cookie preferences

7.2 Analytics Cookies (Optional)

With your consent, we may use analytics cookies to understand how visitors interact with our website. These are only set after you provide explicit consent.

7.3 Managing Cookies

You can manage your cookie preferences at any time using the cookie banner or by clicking the button below:

8. Data Retention

We retain your personal data only as long as necessary:

• Account Data: Until account deletion + 30 days for backup recovery
• Invoice Data: 7 years (legal/tax requirements in most jurisdictions)
• Contact Form Submissions: 2 years
• Log Files: 90 days

9. Data Security

We implement industry-standard security measures:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Regular security audits and penetration testing
• Access controls and authentication requirements
• Incident response procedures

10. Your Rights Under GDPR

As a data subject, you have the following rights:

Exercising Your Rights

To exercise your rights, please log in to your account or contact us at privacy@invoiceflow.com.ng with proof of identity.

We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all subprocessors
• Adequacy decisions where applicable

12. Children's Privacy

Our Service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "last updated" date. For significant changes, we will send an email notification.

14. Contact Us

For any questions about this Privacy Policy or to exercise your data rights, please contact: