This policy explains what personal data invokwik collects about its customers, why, who it is shared with, how long it is kept, and what rights you have over it. Personal data you enter about your own clients is covered by the Data Processing Agreement instead.
1. Who is responsible for your data
The controller of the personal data described in this policy is Mirko Zagami, trading as invokwik. You can reach the controller at support@invokwik.com. A postal address is available on request.
This policy covers the data invokwik holds about its customers and the people who use the Service on their behalf. When you enter personal data about your own clients into the Service, you are the controller of that data and invokwik processes it for you under the Data Processing Agreement, which forms part of the Terms of Service.
2. What we collect
Account data. Your email address and a password, which is stored only as a salted hash. Both are needed to have an account; without them we cannot provide the Service. If you join an account by invitation, the address you were invited at and who invited you.
Business data. The invoices, receipts, statements, credit notes, clients, senders, templates, schedules, logos and settings you create in the Service, and a record of the emails the Service sends for you.
Billing data. If you subscribe, Stripe collects your payment details on its own pages. invokwik receives a customer reference, the state of your subscription, and the add-ons and email credits you buy. It never receives your full card number.
Technical data. Our hosting and database providers log the IP address, browser and time of requests to the Service. Vercel Web Analytics and Speed Insights record which pages are visited and how quickly they load, with device and browser details, without cookies. Page addresses are recorded without their query string or fragment, and with the token removed from share links.
3. Why we use it, and on what legal basis
- To provide the Service you signed up for: your account, your documents, sending them, and support. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).
- To bill you and keep the records tax law requires. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).
- To keep the Service working and secure, and to understand which pages are used. The legal basis is our legitimate interest in running a reliable service (Article 6(1)(f) GDPR).
- To send you emails about your account and subscription, such as a failed payment. The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR).
We do not sell personal data, use it for advertising, or send marketing emails.
4. Who we share it with
invokwik uses the following services to run. Each receives only what it needs for its part.
Supabase hosts the database, sign-in and file storage, in its Frankfurt (Germany) region of the European Union.
Resend delivers the emails the Service sends, including documents you send to your clients. It processes data in the United States.
Vercel hosts the web application and the share pages, and provides Web Analytics and Speed Insights, which use no cookies. It processes data in the United States.
Stripe handles subscription payments, on its own pages and under its own privacy policy, as a controller in its own right.
jsDelivr, a public content delivery network, serves the software that displays the API reference, at /docs and in the app's own API page, so it receives the IP address and browser details of anyone who opens either, under its own terms. No other page of the Service loads anything from it. The Service's web fonts are served from its own hosting.
Transfers to Resend and Vercel in the United States rely on the EU–U.S. Data Privacy Framework or on the European Commission's standard contractual clauses. The services that handle your clients' data are listed, with more detail, in the Data Processing Agreement.
5. How long we keep it
Account and business data is kept while the account has a subscription. An account that loses its subscription is deleted no earlier than 90 days after it loses its subscription, or 90 days after sign-up if it never had one. At least 14 days before, we warn by email the account's owner and anyone who handles its billing, or, if there is no one in that role, every member we have an email address for. Subscribing again before then stops it. If you ask us to delete your account sooner, we end any subscription still running on it and delete its data within 30 days of the request. After deletion we keep only a record of the subscription and of any email credits bought, with no names or email addresses, and Stripe keeps the billing records we are required to keep, for as long as tax law requires. Log data is kept by our hosting and database providers for a limited period under their own retention settings.
6. Security
Data is encrypted in transit using TLS and at rest using AES-256. Access to data is restricted by row-level security in the database to the members of the account it belongs to, and a document to anyone you give its share link to. Passwords are stored as salted hashes, and API keys are stored only as hashes. The full list of measures is in Annex 2 of the Data Processing Agreement.
No system is completely secure. If a breach of your personal data is likely to put you at risk, we will tell you.
7. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format.
You can correct the business data you keep, and reset your password, yourself in the Service, and download any document as a PDF while your subscription is active. To change the email address you sign in with, or for anything else, including a copy of your data in a machine-readable format or the deletion of your account, write to support@invokwik.com. We answer requests within one month.
You also have the right to lodge a complaint with a supervisory authority. In Malta, that is the Information and Data Protection Commissioner (idpc.org.mt). You may also complain to the authority where you live or work.
8. Cookies and local storage
invokwik does not set cookies. To keep you signed in and to remember your theme, the Service stores your session, your theme choice and the time of your last activity in your browser's local storage, and a few short-lived flags, such as whether your session has just expired, in session storage. None of it is used to track you, and none of it is used by anything but the Service.
Vercel Web Analytics and Speed Insights do not use cookies. Stripe's checkout and billing pages open on Stripe's own site and set Stripe's own cookies, under Stripe's policy.
9. Changes to this policy
When this policy changes, the date at the top of this page changes with it. If a change materially affects how your data is used, we will tell account owners by email before it takes effect.