Privacy Policy

Last updated: 6 June 2026

This Privacy Policy explains how InvoiceURL (the "Service", "we", "us", "our") collects, uses, and protects personal data. The data controller's full legal details are set out in section 12 (Contact Information). We are committed to handling your data transparently and only as needed to run the Service.

1. Data we collect

  • Account data — your name, email address, password (stored hashed), and organization details you provide when registering.
  • Document data — the files and reference links you upload for approval, and their titles and metadata.
  • Recipient data — the email addresses of the people you send approval links to.
  • Activity and audit data — records of views, approvals, and rejections, including IP addresses and timestamps, which form the audit trail that is core to the Service.
  • Billing data — your plan, credit balance, and payment records. Card details are collected and processed by Lemon Squeezy, not by us — we never see or store full card numbers.
  • Technical data — basic log and device information needed to operate and secure the Service.

2. How we use data

We use personal data to: provide and operate the Service; generate and store approval audit trails; process payments and manage credits; send transactional emails (such as approval notifications and receipts); provide support; prevent fraud and abuse; and comply with legal obligations.

3. Legal bases (where GDPR applies)

We process personal data on the bases of: performance of a contract (to provide the Service you signed up for); legitimate interests (to secure, improve, and support the Service); consent (where required, for example optional analytics); and legal obligation (for example, tax record-keeping).

4. Third-party processors (sub-processors)

We share data only with providers that help us run the Service, under appropriate data protection terms:

  • Lemon Squeezy — payments and invoicing (Merchant of Record).
  • Amazon Web Services (SES) — transactional email delivery.
  • Cloudflare (R2) — encrypted document storage.

We do not sell your personal data.

5. Cookies and analytics

We use strictly necessary cookies to keep you signed in and to secure forms. If we use analytics, we aim to use privacy-friendly, cookieless measurement; where any non-essential cookies are used (for example, advertising pixels), we will request your consent first and describe them in a separate Cookie Policy.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, then for any period required to meet legal, tax, or dispute-resolution obligations. You can ask us to delete your account and associated data, subject to those obligations.

7. Security

We protect data with encryption in transit and at rest for stored documents, access controls, and audit logging. No system is perfectly secure, but we take reasonable, industry-standard measures to safeguard your data.

8. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email support@invoiceurl.com. You may also have the right to complain to your local data-protection authority.

9. International transfers

We may process data in countries other than your own. Where we do, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you.

12. Contact Information

This Service and your personal data are controlled by:

Questions about your privacy or this policy? Email legal@invoiceurl.com.