Privacy Policy

The data we collect

Depending on how you use the Service, we collect:

• Account data: your name, email address, phone number and profile picture, and the companies, users and approval settings you set up.
• Documents and their content: invoices, receipts and other files you upload, forward to your InvProc email address or send over WhatsApp, and the data read from them, such as vendor names, VAT and company numbers, addresses, amounts, line items and bank details.
• Messages: the text and audio messages you exchange with the WhatsApp assistant, and the emails (sender, subject, body and attachments) sent to your InvProc address.
• Payment data: the payments you prepare, their status and receipts, and the credentials you give us to connect a payment provider such as Wise. We never ask for or store card numbers.
• Vendor data: when a vendor uses the vendor portal, their email address and the invoice details they submit or correct.
• Technical data: IP address, browser and device information, and logs of requests and errors, kept to secure and operate the Service.

Google user data

If you sign in to InvProc with a Google account, Google shares your name, email address and profile picture with us. We use them only to create your account, sign you in and show who you are inside InvProc. We do not request access to your Gmail, Google Drive, Calendar or any other Google data.

We do not sell Google user data, use it for advertising, or share it with anyone except the service providers listed below that help us run the Service, when the law requires it, or with your consent. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.

InvProc’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can remove InvProc’s access to your Google account at any time at https://myaccount.google.com/permissions. To delete the data we already hold, see “Your rights” below.

How we use your data, and on what legal basis

• To provide the Service: receive your documents, extract their data, route approvals, prepare payments, and send you confirmations and notifications. Legal basis: performing our contract with you or your company.
• To keep the Service secure: authenticate users, prevent fraud and abuse, and investigate errors. Legal basis: our legitimate interest in a secure service.
• To improve how accurately documents are read, for example by reviewing and testing against documents that were read incorrectly. Legal basis: our legitimate interest in a service that reads documents correctly.
• To answer you when you contact us. Legal basis: our legitimate interest, or our contract with you.
• To meet legal obligations, such as tax and accounting rules. Legal basis: legal obligation.

Where we rely on your consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object, as described in “Your rights”.

Artificial intelligence

InvProc uses AI models to read documents, transcribe audio, answer messages and suggest cost centers and ledger accounts. To do this, we send the content each task needs to AI providers, which process it on our behalf and return a result: OpenRouter, which forwards each request to the provider of the model it names, and Google and OpenAI directly.

AI output can be wrong. Review extracted data before you rely on it, especially bank and payment details before you approve a payment. No decision with legal or similarly significant effects on you is made by AI alone: a person approves every payment.

Who we share data with

We share personal data only with service providers that help us run the Service, under contracts that limit how they use it, and only as far as each one needs:

• Google Cloud: hosting, databases and file storage, in the European Union (Spain).
• Auth0 (Okta): sign-in and account security.
• OpenRouter, Google and OpenAI: AI processing of documents, audio and messages.
• Meta (WhatsApp Business Platform): delivering WhatsApp messages.
• Google Workspace: sending and receiving email.
• Grafana Labs: monitoring and error logs.

When you pay through Wise, we send Wise the details of the payments you confirm. Wise handles that data under its own terms and privacy policy.

We may also disclose data when the law requires it, to protect our rights or the safety of our users, or as part of a merger or acquisition, in which case this policy continues to apply. We do not sell personal data.

International transfers

Our servers are in the European Union. Some of the providers above process data in other countries, including the United States (OpenRouter among them). When data leaves the UK or the European Union, we rely on the safeguards the law provides for, such as adequacy decisions, the EU standard contractual clauses and the UK International Data Transfer Addendum.

How long we keep data

We keep your data while your account is active. To close your account and delete your data, email support@invproc.com from the address linked to your account; we will do it within 30 days, apart from records the law requires us to keep longer, such as tax and accounting records.

We may keep a copy of some invoices and the data read from them for up to 24 months, to test and improve how InvProc reads documents. An owner can turn this off for their company in its settings, and copies already kept are deleted on request at support@invproc.com. Logs are kept only as long as we need them to operate and secure the Service.

While InvProc is in alpha, data may also be lost or reset, including invoices, approvals, payment history and receipts. Keep your own records of anything you need.

Security

We protect data with encryption in transit (TLS), encryption of payment-provider credentials at rest, access controls and activity logs. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

Cookies

We use only the cookies the Service needs to work: to keep you signed in, to keep a vendor’s portal session, and to remember your language. We do not use advertising or third-party analytics cookies.

Your rights

Under the UK GDPR and the EU GDPR you can ask us to give you a copy of your data; correct it; delete it; restrict how we use it; send it to you or another provider in a portable format; and you can object to processing based on our legitimate interests and withdraw any consent you gave. We answer within one month.

To make a request, email support@invproc.com from the address linked to your account. If a company uses InvProc and you are, for example, one of its vendors, that company is the controller of your data in its invoices, and we may pass your request on to it.

You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (https://ico.org.uk); in the EU, the authority of the country where you live or work.

Users in Brazil

If the LGPD applies to you, you have the rights it gives you, including to confirm whether we process your data, access, correct, anonymize, block or delete it, port it, learn who we share it with, and withdraw consent. Make requests at support@invproc.com. You can also complain to Brazil’s data protection authority (ANPD).

Children

InvProc is a business service and is not meant for anyone under 18. We do not knowingly collect children’s data.

Changes to this policy

When our practices change, we will update this page and the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.

Contact

For questions or requests about privacy, write to support@invproc.com.