Privacy Policy

The data controller is Mykyta Ryzhov, a self-employed individual (autónomo) trading as "Invoister", NIF Z3913016P, C/ de Juan Ramón Jiménez, 17, Escalera 2, Piso 1G, Playa Muchavista, 03560 El Campello (Alicante), Spain. For any privacy question or to exercise your rights, contact privacy@invoister.app.

This Policy covers data about you as an Invoister user, and about visitors to our website. The details you enter about your own clients — and what your clients submit through your onboarding links or see on your shared invoices — are processed by us on your behalf: for that data you are the controller and we are your processor, under the data-processing terms in our Terms of Service (section 6).

If you are a client of an Invoister user (you received an invoice or filled in an onboarding form), the business that sent it is responsible for your data. Please contact them to exercise your rights; we will help them respond.

We collect only what we need to run the Service. The table below sets out each category, why we use it, and the legal basis under GDPR Article 6.

We use your data to provide and secure the Service, to bill you (via our Merchant of Record), to improve the product (using anonymous, cookieless page-view analytics under our legitimate interest, and — only if you consent — Microsoft Clarity, with all text in the app masked, and Google Analytics), and to comply with our legal obligations. We do not sell your personal data.

We share data only with the processors that help us run the Service, each under a data-processing agreement. See the current list on our Subprocessors page.

We host data in the EU where possible (our database runs in an EU region). Where a processor is outside the EU/EEA, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We keep your account data — including your businesses, clients and invoices — for as long as your account exists.

When you delete your account, your access ends immediately and all of your data, including your invoices and your clients’ data, is permanently deleted 30 days later, then removed from backups within a further 90 days. We do not keep your invoices to meet your own tax or accounting obligations — those are yours (for example, Spanish law generally requires you to keep invoices for at least 4 years), so export your data before deleting your account.

Payment and subscription records are kept by Lemon Squeezy, as Merchant of Record, under its own legal obligations. Billing event logs are deleted after 6 months. Page-view analytics are anonymous and aggregated, so they contain nothing that identifies you.

Under GDPR (Articles 15–22) you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. You can export your data and request deletion directly from Settings → Privacy, or email privacy@invoister.app.

You also have the right to lodge a complaint with your data-protection authority. In Spain this is the AEPD (aepd.es).

We use cookies that are strictly necessary to run the Service, and — only with your consent — analytics cookies from Microsoft Clarity and Google Analytics. We use no advertising cookies. See our Cookie Policy for the full list, and Cookie settings (at the bottom of any public page, or in Settings → Privacy) to change your choice.

Data is encrypted in transit and at rest, access is restricted, and our database enforces row-level security so each account can only access its own data. No system is perfectly secure, but we apply industry-standard measures.

The Service is not directed at people under 18, and we do not knowingly collect their data.

We may update this Policy. We will notify you of material changes by email or in-app before they take effect.

Privacy questions: privacy@invoister.app.