Privacy Policy

This policy explains how [Your full legal name], trading as InvoiceShark and operator of InvoiceShark (“we”, “us”), handles personal data. For data about account holders we are the controller. For data about their customers we act as a processor on the account holder’s behalf — see section 5.

Account data. When you sign up, our authentication provider Clerk collects your name, email address, and login credentials. We store a copy of your name and email, plus your business name and reply-to address if you provide them. We never receive or store your password.

Invoice and client data. Information you enter about invoices and the customers you bill — client names, email addresses, amounts, due dates, and any notes you add — together with the reminder wording and schedule you configure.

Billing data. If you subscribe to Pro, Stripe processes your payment details. We do not see or store full card numbers; we retain a Stripe customer identifier, your subscription status, and the current period end.

Email send records. For each reminder we send we record the recipient address, the stage, the time, and the provider’s message identifier, so that the same reminder is not sent twice and delivery questions can be answered.

Usage and technical data. Standard server logs — IP address, user agent, timestamps, and error traces — used to operate, debug, and secure the Service.

We do not use third-party analytics, advertising, or tracking services.

• To provide the Service — storing invoices, calculating what is overdue, and sending the reminder emails you configure.
• To process Pro subscription payments and manage your plan and usage limits.
• To send you transactional messages about your account, billing, and material changes to the Service.
• To monitor, secure, debug, and improve the Service, including investigating abuse and spam complaints.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

Where data-protection law such as the UK GDPR or EU GDPR applies to our processing, we rely on:

• Performance of a contract — to provide the Service you signed up for and to bill you for it.
• Legitimate interests — to secure and improve the Service, prevent abuse, and defend legal claims, balanced against your rights.
• Legal obligation — to keep tax and accounting records and respond to lawful requests.
• Consent — where we ask for it, which you can withdraw at any time.

When an account holder adds a customer’s details, we process that customer’s name, email address, and invoice information on the account holder’s behalf. The account holder decides why and how that data is used and is responsible for having a lawful basis to contact the recipient. This section, together with our Terms, forms the data-processing terms between us.

As processor, we commit to:

• Process that data only on the account holder's instructions, which means their use of the Service's features, and as required by law.
• Keep it confidential and restrict access to those who need it to run the Service.
• Apply the security measures described in section 11.
• Use only the sub-processors listed in section 6, under written terms no less protective than these, and give notice before adding a new one.
• Assist the account holder, so far as is reasonable, in responding to data-subject requests and in meeting their security and breach-notification obligations.
• Notify the account holder without undue delay after becoming aware of a personal-data breach affecting their data.
• Delete or return the data on request or on account closure, as set out in section 8, except where law requires us to keep it.
• Make available the information reasonably needed to demonstrate compliance with these commitments.

If you received a reminder from a business. The business that sent it decides what happens to your data, so contact them first to have it corrected or removed. You can also reach us at [privacy@invoiceshark.app] and we will pass the request on to them and help them action it.

We share data with the following processors only as needed to run the Service:

We may also disclose data where required by law or valid legal process, to enforce our Terms, to protect the rights and safety of users or the public, or to a buyer or successor in a merger, acquisition, or sale of assets — in which case we will notify you before your data becomes subject to a different policy.

We and all of the providers listed above process data in the United States. If you or your customers are in the UK or the EEA, using the Service involves transferring personal data out of your country.

Where required, those transfers are covered by appropriate safeguards — the UK International Data Transfer Addendum and the European Commission’s standard contractual clauses, as incorporated into our agreements with each provider. You can ask us for details of the safeguards that apply at [privacy@invoiceshark.app].

Backups are kept on a rolling cycle and are overwritten within 30 days, so deleted data may persist in a backup for a short period after it is removed from the live system. We may keep data longer where we need it to comply with a legal obligation or to resolve a dispute.

To close your account and have your data deleted, email [support@invoiceshark.app]. We action deletion requests within 30 days.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. Exercise any of these by emailing [privacy@invoiceshark.app].

We respond within 30 days, and will not charge you or treat you differently for making a request. We may need to verify your identity first, which for account holders normally means emailing from the address on the account.

If you are in the UK or the EEA you also have the right to complain to your data-protection authority — the Information Commissioner’s Office in the UK, or your national authority in the EEA.

Residents of California and of other states with comprehensive privacy laws have the right to know what personal information we collect and why, to access and delete it, to correct inaccuracies, to obtain a portable copy, and not to be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law. We do not process sensitive personal information for the purpose of inferring characteristics. Because we do not sell or share, we do not offer a “Do Not Sell or Share My Personal Information” link.

To exercise a right, email [privacy@invoiceshark.app]. You may use an authorised agent, in which case we will ask for proof of their authority. If we decline a request you may appeal by replying to our response; we will tell you the outcome and why.

Data is encrypted in transit with TLS, and our database provider encrypts data at rest. Passwords are held by Clerk and never reach our systems; card numbers are held by Stripe and never reach our systems. Access to production data is restricted to those who need it.

No system is perfectly secure. We take reasonable technical and organisational measures to protect personal data and will notify affected users and regulators of a breach where the law requires it.

Each invoice has a payment page at a hard-to-guess address, which we include as a link in reminder emails so your customer can pay without creating an account. That page is not indexed by search engines, but it is not behind a login either: anyone who has the link can see the business name, the customer name, the amount, the due date, and any description on the invoice.

Treat the link as confidential and avoid putting sensitive information in the invoice description. Account holders should bear this in mind when deciding what to record against an invoice.

The Service automatically works out which invoices are overdue and which reminder to send, based on the due date and the schedule the account holder configures. This is a scheduling calculation. It does not profile recipients, score them, or make any decision that produces a legal or similarly significant effect on them.

We use only cookies that are necessary for the Service to function: those set by Clerk to keep you signed in, and those set by Stripe on the payment pages for fraud prevention. We do not use advertising or non-essential analytics cookies, so we do not show a cookie consent banner.

The Service is not directed to children and is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact [privacy@invoiceshark.app] and we will delete it.

We may update this policy from time to time. Material changes will be notified through the Service or by email before they take effect. The “last updated” date above shows the current version.

[Your full legal name], [Business address].

Privacy enquiries and data requests: [privacy@invoiceshark.app].