Privacy Policy

1. Personal information we collect

We collect the following categories of personal information:

• Account information — your email address, password credentials (stored in hashed form by our authentication provider), display name where you supply one, and, if you sign in with Google, the basic profile information Google returns.
• Uploaded invoices and documents — the files you upload and the data extracted from them, which may include supplier names, contact details, invoice numbers, dates, line items, GST amounts and totals. These documents may contain personal information about you or third parties.
• Payment and billing information — your subscription plan, billing interval, billing status and transaction references. Card details are collected and processed by our payment provider, not by us; we never see or store full card numbers.
• Usage information — pages processed, feature and product events, error reports, timestamps, and technical data such as IP address, browser type and device identifiers.
• Support and feedback — messages, feedback ratings and any information you choose to send us.

2. OCR and AI processing

When you upload a document, its contents are sent to a third-party OCR and language model provider so that text can be recognised and structured into fields. Processing is performed only to produce your extraction results. Extraction is automated and may contain errors, so results should be reviewed before you rely on them.

3. How we use personal information

• Creating and administering your account and authenticating you.
• Providing the service: storing your documents, extracting data, validating results and generating exports.
• Managing subscriptions, page allowances, renewals, upgrades, downgrades and cancellations.
• Security, fraud prevention, abuse detection and enforcing usage limits.
• Diagnosing errors and improving product reliability and accuracy.
• Responding to your support requests and feedback.
• Meeting legal and record-keeping obligations.

Where required by law, we rely on the following legal bases: performance of our contract with you (providing and billing the service), our legitimate interests (security, abuse prevention, product improvement), your consent (where separately requested), and compliance with legal obligations.

4. Service providers and sharing

We share personal information only with:

• Cloud hosting, database, authentication and file storage providers that operate the service on our behalf.
• Our OCR and AI processing provider, to perform document extraction.
• Paddle, our online reseller and Merchant of Record, which handles checkout, payments, subscription billing, taxes, invoicing and refunds. Paddle processes your billing information under its own privacy notice.
• Professional advisers such as legal and accounting advisers, where necessary.
• Public authorities, where we are required to disclose information by law.

We do not sell your personal information or your documents.

5. International transfers

Our providers may store or process information outside New Zealand. Where information is transferred overseas, we take reasonable steps to ensure it is subject to protections comparable to those required under the Privacy Act 2020, including contractual safeguards with our providers.

6. Storage and security

Uploaded documents are held in private storage that is not publicly accessible. Access to your account data is restricted at the database level so that only your account can read it. Data is encrypted in transit, access to production systems is limited, and credentials for third-party services are held as server-side secrets. No online service can be guaranteed to be completely secure, and you are responsible for keeping your login credentials confidential.

7. Retention and deletion

We keep documents and extracted data for as long as your account remains active or until you delete them. You can delete individual documents and projects at any time from within the app, and you can delete your entire account from Settings. When you delete your account, your documents, extracted data and account record are removed. Limited billing and transaction records may be retained where we are required to keep them, and backups are cycled out in the ordinary course.

8. Your rights

Subject to applicable law, you may request access to the personal information we hold about you, ask us to correct it, request deletion, object to or ask us to restrict certain processing, withdraw consent where processing is based on consent, and request a copy of your data. Most of these are available directly in the app through your account settings and export tools. If you are in New Zealand you may also complain to the Office of the Privacy Commissioner; if you are in the UK or EEA you may complain to your local supervisory authority.

To exercise any of these rights, contact us at info@invoicehaven.com. We aim to respond within one month.

9. Cookies and analytics

We use strictly necessary cookies and browser storage to keep you signed in and to operate the service. We also record first-party product events (such as uploads, exports and errors) linked to your account so we can measure reliability and improve the product. We do not use third-party advertising cookies. You can clear or block cookies in your browser, but the service will not function correctly without the essential ones.

10. Children

The service is intended for business use and is not directed at children. We do not knowingly collect personal information from children.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date above shows when it was last revised. Material changes will be notified in the app or by email where appropriate.

12. Contact us

Jack Masih, trading as InvoiceHaven — info@invoicehaven.com — invoicehaven.nz.