Privacy Policy

This policy explains how [Registered business name] (“we”, “us”), operator of InvoiceShark, handles personal data. It covers both people who hold an InvoiceShark account and the customers of those account holders who receive payment reminders sent through the Service.

Account data. When you sign up, our authentication provider Clerk collects your name, email address, and login credentials. We store a copy of your name and email, plus your business name and reply-to address if you provide them.

Invoice and client data. Information you enter about invoices and the customers you bill — client names, email addresses, amounts, due dates, and any notes you add.

Billing data. If you subscribe to Pro, Stripe processes your payment details. We do not see or store full card numbers; we retain a Stripe customer identifier and subscription status.

Usage and technical data. Standard server logs (IP address, user agent, timestamps) and records of reminder emails sent, used to operate and secure the Service.

• To provide the Service — storing invoices, calculating what is overdue, and sending the reminder emails you configure.
• To process Pro subscription payments and manage your plan.
• To send you transactional messages about your account and the Service.
• To monitor, secure, debug, and improve the Service.
• To comply with legal obligations and enforce our Terms.

We do not sell personal data and we do not use it for third-party advertising.

Where data-protection law (such as the UK GDPR or EU GDPR) applies, we rely on: performance of our contract with you; our legitimate interests in operating and securing the Service; your consent where required; and compliance with legal obligations.

When an account holder adds a customer’s details, we process that customer’s name and email address on the account holder’s behalf in order to deliver reminder emails. The account holder determines why and how that data is used and is responsible for having a lawful basis to contact the recipient. If you have received a reminder and want your data corrected or removed, contact the business that sent it, or reach us at [privacy@yourdomain.com] and we will pass the request on.

We share data with the following processors only as needed to run the Service:

• Clerk — Account creation, authentication, and session management.
• Stripe — Payment processing and subscription billing.
• Resend — Delivery of reminder and transactional email.
• MongoDB Atlas — Primary database hosting.
• Vercel — Application hosting and content delivery.

Some providers may process data outside your country. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses.

We keep account and invoice data for as long as your account is active. After you delete your account we delete or anonymise personal data within a reasonable period, except where we must retain it to comply with legal, tax, or accounting obligations or to resolve disputes.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. You can exercise these rights by emailing [privacy@yourdomain.com]. You also have the right to complain to your local data-protection authority.

Data is encrypted in transit. Access to production systems is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect personal data and will notify affected users and regulators of a breach where the law requires it.

We use only cookies that are necessary for the Service to function, including those set by Clerk to keep you signed in and by Stripe on the payment pages for fraud prevention. We do not use advertising or non-essential analytics cookies.

The Service is not directed to children and is intended for use by people aged 18 and over.

We may update this policy from time to time. Material changes will be notified through the Service or by email. The “last updated” date above shows the current version.

[Registered business name], [Registered business address]. Privacy enquiries: [privacy@yourdomain.com].