Privacy policy

This policy applies to the Invoist ("we," "us," "our") marketing website, the product application, and the underlying API (together, the "Service"). For privacy questions or to exercise any of the rights described below, contact [email protected] or use our Support page.

This distinction matters, so we are explicit about it. When you create an account and use Invoist, we are the controller of your own account data (your email, name, workspace details, and billing state), meaning we decide how and why it is used, subject to this policy.

The invoices and receipts you upload belong to you and your business, and so does the data extracted from them. Those documents routinely contain information about other parties: vendor names, addresses, bank details, contact people. For that data you are the controller, and we process it only on your behalf and by your instructions, as a processor, so that Invoist can read, check, and organize your documents. You are responsible for having a lawful basis to hold and process your documents and the personal data they contain. If you run a bookkeeping firm, the same applies to your clients' documents, and you are responsible for your authority to process them. A data processing agreement covering this relationship is available on request.

• Account information. Your name, email address, password (stored as a salted hash, never in plain text), and workspace details you provide.
• Documents you submit. The invoice and receipt files you upload, email in, or send through the API, the data extracted from them, the corrections you make, categories, notes, and the review history around them.
• Email-in messages. If you use your workspace's inbound email address, we process the messages sent to it, including the sender address and attachments, and log each message with what happened to it. Email from a sender you have not approved, or that arrives while your plan does not cover reading it, is kept with its attachments and its text until you approve it, read it, or delete it, and at most 14 days, so you can look at it before you decide. For each message we also record technical details of its delivery: the sending mail server and its IP address, the sender authentication results (SPF, DKIM and DMARC), and the message headers. We use them to spot forged senders, to recognise email forwarded by you, and to trace delivery problems.
• Suppliers' logos. To show a supplier's logo next to its bills, our servers fetch the public icon from the website or email domain printed on the bill and keep one copy of it. Your browser loads the logo from us, never from the supplier, so the supplier doesn't learn that you looked at your bills. The copy is shared by everyone whose bills come from that supplier and holds nothing about you.
• Payment information. Subscription billing is handled by Stripe. We receive and store your subscription status and plan, not your full card number.
• Support communications. Anything you send us by email or through the Support page, used to help you and to improve the Service.
• Technical and log data. IP address, browser and device information, timestamps, request logs, and an append-only audit log of actions taken in a workspace, collected to operate, secure, and troubleshoot the Service.

Reading a document is performed with the help of a third-party AI service provider: the pages of a document you submit are sent to that provider to extract the structured data, and the result comes back to your workspace. That is the only purpose documents are sent for. We do not use your documents or extracted data to train AI models, and anything the Service learns from your corrections, such as a vendor's usual category or amount range, stays inside your own workspace and is never shared with other customers.

The Invoist marketing website you are reading now sets no cookies and runs no analytics or advertising scripts. The product application uses exactly one cookie: a session cookie that keeps you signed in. It holds an opaque random token, is restricted to secure connections in production, and is removed when you sign out. We do not use third-party advertising or cross-site tracking cookies anywhere. See the Cookie policy for detail.

We use the information above to operate the Service: authenticating you, reading and organizing your documents, running the checks and flags the product is built around, processing subscription billing, sending the transactional and digest emails you have chosen, responding to support requests, keeping the Service secure, and improving it. We do not sell personal data to anyone.

We do not sell your data. We share information only with the service providers who help us run Invoist, each bound by their own data protection terms, and only with the data needed for what they do:

• AI document processing provider. Reads the documents you submit, as described in section 4.
• Stripe. Subscription billing and card handling.
• Resend. Delivery of our transactional email (verification, password resets, invites, digests) and support messages.
• Postmark. Receiving the messages sent to workspace email-in addresses.
• OVHcloud. Our hosting provider, running our servers, database, and uploaded-file storage in Canada.
• Cloudflare. DNS and network protection in front of our servers.

A current list of the providers we use, by name, is available on request at [email protected].

If you connect an accounting platform such as QuickBooks or Xero, we send it the document data needed for the sync you configured; that connection exists only if you set it up, and you can disconnect it at any time. We may also disclose information if required by law, to protect the rights, property, or safety of Invoist, our users, or others, or as part of a merger, acquisition, or sale of assets, in which case this policy would continue to apply to your information under the new owner.

Invoist lets you optionally connect other tools to your workspace or household: AI assistants such as Claude, ChatGPT or Cursor through our MCP server, accounting platforms, OAuth apps from the marketplace, or your own software through an API key. None of these connections exist until you set one up yourself, and each is scoped to only the permissions you approve. You can review and revoke any connection at any time from Settings.

When a connected AI assistant uses one of our tools, what the tool returns, for example a bill's sender, amount and due date, is sent to the company that runs the assistant. We record which assistant used which tool and when. We never receive your conversation with the assistant.

Once you connect a third-party app, anything it reads or writes is also subject to that app's own privacy policy and terms, which we do not control. We recommend reviewing them before connecting anything to data you consider sensitive.

Our servers, database, and uploaded files are hosted by OVHcloud in Canada, in Beauharnois, Quebec. If you are in the European Economic Area, the United Kingdom, or another place with its own rules on sending personal data abroad, your information is transferred to and stored in Canada. The European Commission and the United Kingdom both recognise Canada as protecting personal data handled by businesses to an adequate standard.

Some of the service providers listed in section 7, such as our AI document processing provider, Stripe, and Resend, may process information in other countries, including the United States. Where required, we rely on Standard Contractual Clauses or another lawful transfer mechanism with those providers to protect that transfer. Contact us if you would like more detail about the safeguards in place.

We retain account and document data for as long as your account is active, plus a limited period afterward as needed for legal, tax, security, and billing obligations. You can also set a retention window per workspace, after which documents older than the window are purged automatically. You can delete individual documents, whole workspaces, or your entire account yourself from Settings; deletion removes the stored files and extracted data, and we keep only what we are legally required to retain.

Email waiting for your approval is deleted, with its attachments and text, after 14 days if nobody approves or reads it. The sending server, its IP address, the envelope sender and the headers of every email sent to your inbound address, and the text of email that was approved, are cleared after 30 days; the record that the message arrived, and whether its sender was verified, stays in your workspace's email log.

We take reasonable technical and organizational measures to protect your information, including encrypted connections (TLS) for all traffic, salted password hashing, hashed API keys and session tokens rather than plain-text storage, encryption at rest for connected-platform tokens, per-workspace access controls, role checks enforced on the server, and an append-only audit log. Our Security page describes this in plain language. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep the Service safe and will notify affected users as required by applicable law if a breach affects your personal data.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy of it in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent. You can access and correct most account information yourself in Settings, export your document data yourself as CSV or JSON, delete your account yourself, or contact [email protected] for anything else. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, or a resident of another U.S. state with its own privacy law, you may have the right to know what personal information we hold about you, request its deletion, correct inaccurate information, and not be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of on that front. To exercise any of these rights, contact [email protected].

Invoist is a business tool intended for businesses, bookkeepers, and developers. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy as the Service changes. If a change is material, we will notify you by email or through the product before it takes effect. The date at the top of this page always reflects the current version.

Questions about this policy, or requests to exercise any right described above: [email protected].