Privacy policy
This notice describes the current Invozaar workspace: email/password accounts, invoices stored in your browser, customer approval links for estimates and proposals, and subscription payments through Square.
Who to contact
Our contact for privacy questions and requests to access, correct or delete your information is support@invozaar.com. Do not send your password, recovery link or full payment-card details.
Invozaar is operated by Abouzar Saeed, a UK sole trader trading as Invozaar.
Abouzar Saeed is responsible for deciding how Invozaar uses account, subscription and support information (the data controller). Businesses creating invoices are responsible for the customer information they enter and share.
Information used by the service
- Account and authentication: your email address and password are sent to Supabase to register or sign in. Supabase also processes confirmation and recovery requests and account/session information. The app stores session tokens in your browser to maintain sign-in; its code does not save your password in browser storage.
- Invoice information: business and customer names, addresses, contact details, tax references, invoice items, notes, payment instructions and uploaded logos are stored locally in your browser. The current app does not send these invoice records to a cloud invoice database.
- Your customer memberships: plans, prices, perks, checkout links, member names, email addresses, billing addresses, membership statuses and dates entered in Memberships are saved in a hosted database under your signed-in account. Archived records are retained so you can restore them. Invoice drafts created from memberships are saved locally in your browser.
- Estimate and proposal approvals: when a subscribed user creates an approval link, a copy of that estimate or proposal is stored securely with a random link identifier. If a customer responds, we also store their name, approval or decline, typed or drawn signature where supplied, and server-recorded date and time. The signature itself is not returned by the public status API after it is recorded.
- Payments: information you enter on Square’s checkout is handled by Square. Invozaar’s invoice editor does not receive your full card number or security code. Subscription and transaction information is available to the merchant through Square.
- Subscriber management: the verified Invozaar owner can view subscriber names, email addresses, membership status and relevant membership dates supplied by Square. This owner-only list is requested when opened and is not stored in the browser as an Invozaar customer database.
- Support: if you email us, your address, message and any attachments are processed by the support mailbox provider and people responding to your request. Only send information needed to resolve your question.
- Technical information: hosting, authentication and payment providers may process IP addresses, request details, device/browser information and security logs when you access their services, to deliver and protect those services.
Why information is used
Information is used to provide sign-in, confirm account ownership, recover access, let you prepare invoices and approval requests, record customer decisions, process subscriptions, answer support requests and protect the service from abuse.
We use account and subscription information to perform our contract with you, including steps you request before signing up. We rely on our legitimate interests in answering enquiries and protecting the service for necessary support and security processing, taking your rights into account. We retain necessary tax records to comply with legal obligations. Reading this notice or creating an account is not consent to marketing.
Without the email address and authentication information needed for registration, we cannot provide an account. Payment information is needed to buy a subscription through Square. Do not include sensitive personal information in invoice notes or support messages unless it is necessary.
Browser storage and your invoice records
The app uses local storage for drafts, saved invoices, customers and authentication sessions, and session storage for the password-recovery flow. Invoice records are separated by account ID within the browser. This is not encryption against someone with access to your browser profile.
Signing out does not delete saved invoices. Records are not automatically synchronised to another device. Use Settings → Export backup to keep a copy. Use the app’s deletion controls or clear the site’s browser data to remove local records. Exported PDFs and backups remain wherever you save them and must be managed separately. Older records created before account separation may also remain in the browser until its site data is cleared.
When you choose email, share or export, the information you send is handled by your chosen email application, sharing service or file destination. You are responsible for deciding who should receive your customers’ information.
Customer approval links
Approval links are unlisted bearer links: anyone who receives or is forwarded the link can view the estimate or proposal until the link expires. Send them only to the intended customer. A link accepts a customer response for 90 days. Once a response is recorded, it cannot be replaced through that link.
A customer is asked to confirm their authority and agreement before approval. A typed or drawn signature and timestamp help record the decision, but Invozaar does not independently verify the signer’s identity or legal authority.
Service providers and sharing
- Supabase: provides account authentication, confirmation and recovery services. Its published data processing addendum describes processing on customers’ instructions and its use of sub-processors.
- Square: handles subscription checkout and payment processing. Payment information is subject to Square’s own privacy terms and legal obligations. See Square’s buyer privacy notice.
- OpenAI Sites and Cloudflare: provide the website hosting and delivery infrastructure. See the OpenAI privacy policy and Cloudflare privacy policy for their processing of service and technical information. The invoice editor has no AI feature that submits invoice content for generation.
- IONOS: provides our support mailbox and processes messages and attachments sent to it. See the IONOS privacy policy.
We may also disclose necessary information where required by law or to deal with a legal claim. Provider notices describe their own processing; they do not replace our responsibility for information we control.
The reviewed application code contains no advertising pixel or behavioural analytics integration. Hosting or external payment services may use their own cookies or similar technologies. This is not a claim that every provider is cookie-free.
Where information is processed
Our providers operate internationally, so information may be processed outside the UK, including in the United States. A selected database region does not mean that all support access, logs or backups stay in that region. Supabase’s published data processing addendum includes standard contractual clauses and a UK Addendum for relevant transfers. Other providers explain their transfer arrangements in the notices linked above. You can email support@invozaar.com for information about the safeguards applicable to your data or a copy of relevant safeguards, subject to necessary redactions. This notice does not claim that all information stays in the UK.
How long information is kept
Local invoice records remain until you delete them, clear browser data, or the browser removes them. Session storage is generally limited to the browser session; locally stored authentication details can persist until sign-out or browser-data removal.
Subscription payment and tax records: we retain the records needed for Invozaar’s UK sole-trader tax obligations for at least five years after the 31 January Self Assessment submission deadline for the relevant tax year. This period runs from the filing deadline, not the payment date or the date you request account deletion. Records may need to be retained longer where required by law or an ongoing HMRC enquiry. See GOV.UK’s self-employed record-keeping guidance.
Deleting an account does not remove payment records we must retain for tax purposes. This retention rule applies to necessary tax and transaction information, not every account detail, password or invoice you create in your browser. It does not configure Square’s own retention arrangements or an automatic deletion timer.
Accounts: authentication information is kept while your account is active. When you request deletion, we verify and handle the request manually and delete information no longer needed, subject to legal exceptions. We do not impose a routine three-month waiting period before considering an erasure request.
Customer approvals: approval links stop accepting responses 90 days after creation. The approval record, document snapshot, signer name, decision, signature and timestamp remain stored so the subscribing business can keep evidence of the transaction. The business or signer may request deletion through support; we remove information no longer needed, subject to an unresolved dispute or other legal obligation.
Support correspondence: ordinary support emails are deleted three months after the case closes. Where a message is needed for an unresolved dispute or a legal obligation, only the necessary information is retained for that purpose and reviewed when it ends. Tax evidence follows the tax-record rule above.
Security logs and backups: provider-managed copies follow the relevant provider’s service settings and retention arrangements. Retention depends on security investigations, service recovery needs and legal obligations; deleting an active account does not necessarily remove every provider backup immediately. Contact us for details about records relevant to a request. No automatic account-deletion timer is currently enabled.
Your choices and rights
To request account deletion, open Settings → Request account deletion and send the email from your registered email address. This opens your email app; it does not automatically submit a request or delete your account. If you cannot use the button, email support@invozaar.com directly. Support must verify and process the request before deletion is complete.
We respond to privacy requests without undue delay, normally within one calendar month. We may need information to verify your identity. Where the law permits an extension for a complex request or several requests, we will explain the reason and timing. If we cannot erase particular records, we will explain why and tell you about your complaint rights. We do not charge for ordinary requests.
Depending on the circumstances and applicable law, you may request access, correction, deletion, restriction or portability of your personal information, or object to certain processing. Where processing relies on consent, you may withdraw it. Some rights are subject to conditions or legal record-keeping requirements.
Email support@invozaar.com to make a request. We may need to verify your identity without asking for your password. Local invoice files must also be managed on your device; an account-deletion request does not automatically erase files you have exported or cancel a Square subscription.
If an invoice was issued to you by an Invozaar customer, contact that business about the information it put on the invoice. For UK data-protection concerns, you can also complain to the Information Commissioner’s Office.
Changes to this notice
We update this notice when our data practices change and show the latest revision date above. We will explain material changes, including any future cloud invoice storage or marketing tracking, and obtain consent where required.