Privacy Policy
This policy explains what information Invoqly handles, why we use it, who may receive it, how long it may be kept and the choices available to you.
Effective 2 October 20261. Scope and who we are
This Policy explains how Invoqly (“Invoqly,” “we,” “us”) handles personal information when you visit our website, join the beta, create an account, use invoicing features or contact support. Invoqly determines how information is used for operating the service. Business customers may separately be responsible for personal information they place in invoices.
2. Account and identity information
We collect information you provide, including your name, work email, authentication information handled by our authentication provider, language preference, business name, logo and account settings. If you join a waitlist or request support, we also collect the information contained in that request and our response history.
3. Sign-in and account security
Invoqly uses Supabase for passwordless email-code and Google sign-in, session management and optional authenticator verification. Supabase processes account identifiers, authentication codes, provider identity information, recovery requests and session tokens on our behalf. Authentication credentials are handled by the provider rather than displayed to other users. We use authentication information only to identify your account, secure sessions, prevent misuse and provide support.
4. Business, client and invoice data
To provide invoicing features, we may process business contact details, tax or registration identifiers, client names and addresses, invoice numbers, line items, currencies, prices, taxes, payment instructions, payment options you configure (such as bank details, PayPal, Wise or other payment links), due dates, notes, logos and invoice status. You decide what information to enter and must ensure you are permitted to process and share it. Avoid entering sensitive information that is not necessary for invoicing.
5. Technical and usage information
When you use Invoqly, we and our infrastructure providers may automatically receive IP address, browser and device type, operating system, approximate location derived from IP, page visits, referring pages, timestamps, language, cookie or local-storage identifiers, diagnostic events and security logs. We use this data to deliver pages, troubleshoot problems, prevent abuse and understand product performance.
6. Purposes and legal bases
We process information to perform our agreement with you by creating accounts and delivering invoicing features; for legitimate interests such as securing, maintaining and improving the service, preventing fraud and communicating about the beta; with consent where required; and to comply with legal obligations or protect legal rights. Where local law recognizes other legal bases, we rely on the basis appropriate to the activity.
7. How we share information
We do not sell or rent personal information. We disclose it to service providers acting for us; to another user or client when you intentionally send or share an invoice; to professional advisers under confidentiality; in connection with financing, restructuring, acquisition or sale, subject to appropriate safeguards; or where reasonably necessary to comply with law, enforce agreements, investigate fraud or protect people, rights and systems.
8. Service providers
Cloudflare hosts, delivers and protects the website. Supabase provides authentication, database and private storage services. We may add providers for email delivery, error monitoring, product analytics or customer support as the beta develops. We require providers to process information for defined services and apply appropriate safeguards.
9. International data transfers
Invoqly is intended for businesses in multiple countries. Information may be processed in the United Arab Emirates, the United States, the European Economic Area and other locations where we or our providers operate. Where required, transfers are supported by contractual protections, adequacy decisions or other lawful safeguards.
10. Retention
We keep account and service information while your account is active and for a reasonable period afterward to support restoration, security, dispute resolution and legal compliance. Invoice and transaction-related records may need to be retained longer where tax, accounting or legal rules apply. Security logs and backups are retained for limited operational cycles. We delete or de-identify information when it is no longer reasonably needed, unless law requires retention.
11. Security
We use practical administrative, technical and organizational safeguards designed for an early-stage cloud service, including HTTPS, managed authentication, access controls, provider security features and separation of public and secret credentials. No online service can guarantee absolute security. Invoqly uses email sign-in codes or Google sign-in. Protect your email and Google accounts and devices, never share sign-in codes, enable optional authenticator two-factor authentication, and notify us promptly of suspected misuse.
12. Cookies and local storage
We use essential cookies or browser storage to maintain authentication sessions, protect accounts, remember interface preferences and recover invoice drafts on your device. We record first-party operational events such as invoice saves, issuance, link-copy actions and export requests to understand reliability and adoption. These event records exclude invoice contents, client details, payment instructions and share tokens. Coarse campaign source codes, when present in a signup link, may be retained for source reporting; we do not use third-party advertising tracking. Infrastructure providers may set security or load-balancing cookies. We do not currently use third-party advertising cookies or sell browsing profiles. If optional analytics or marketing technologies are introduced, this Policy and any consent controls will be updated first.
13. Your privacy rights
Depending on your location, you may have rights to access, correct, export or delete personal information; object to or restrict processing; withdraw consent; and complain to a data-protection authority. These rights may be limited by identity verification, legal exceptions and record-retention duties. To make a request, email hello@invoqly.ae from the address associated with your account. We will respond within the period required by applicable law.
14. Account deletion and authentication data
You may request deletion of your Invoqly account and associated personal information by emailing hello@invoqly.ae. Deleting an account ends future sign-in and removes or de-identifies eligible profile information after we verify the request. It does not automatically remove records that must be retained for security, tax, dispute resolution or other legal purposes. Authentication logs and backups may remain for limited operational periods before being overwritten.
15. Children
Invoqly is a business invoicing service and is not directed to children. Users must be able to enter a binding agreement in their country. We do not knowingly collect personal information from children below the minimum legal age. If you believe a child has provided information, contact us so we can investigate and delete it where appropriate.
16. Changes and contact
We may update this Policy as the product, providers or laws change. The effective date above shows the latest version. For material changes, we will provide reasonable notice through the service or by email where appropriate. For questions, privacy requests or complaints, contact hello@invoqly.ae.
17. Information about invoice recipients
A business user may enter information about clients, contacts and invoice recipients. In that situation, the business user normally decides why the information is used and is responsible for giving required notices and having a lawful basis to provide it to Invoqly. We process the information to create, display, translate, store, export or deliver the invoice as instructed. Recipients may contact the issuing business about invoice accuracy and may contact us about how Invoqly processes their information.
18. Email and service communications
We may use your email address for account verification, sign-in, security alerts, invoice activity, support replies, important beta notices and changes to this Policy or the Terms. These operational messages are necessary to provide and protect an account. Optional announcements or marketing messages, if introduced, will identify an unsubscribe method. Unsubscribing from optional messages does not stop security, legal or transactional communications.
19. Public links, exports and downloads
If you choose to create a shareable invoice link, download a file or send an invoice, the selected information leaves the private account view and becomes available through the channel you choose. Anyone who receives a public or forwarded link may be able to view its contents. Use recipient restrictions when offered, share links carefully and remove access when it is no longer needed. Files downloaded to a device are controlled by the person or organization holding that device.
20. Aggregated and de-identified information
We may combine usage information or remove details that reasonably identify a person or business to understand service performance, measure feature adoption, plan capacity and improve reliability. We do not attempt to re-identify information that has been properly de-identified. Aggregated statistics may be retained longer because they no longer describe an identifiable user, provided they remain in that form.
21. Automated formatting and calculations
Invoqly may use software rules to format invoices, calculate displayed totals, select layouts or flag incomplete information. These functions support document preparation and do not make legal, credit, employment or other decisions that produce similarly significant effects about you or an invoice recipient. Users must review output before sending it. If future features materially change this position, we will update this Policy and provide any controls required by law.
22. Browser signals and advertising
Invoqly does not currently sell personal information, serve behaviourally targeted advertising or build advertising profiles from invoice content. Because there is no consistent industry standard for browser “Do Not Track” signals, the service does not currently respond to them as a separate control. If advertising or cross-site tracking is introduced, we will update this Policy and provide notices and choices required for affected users.
23. Business changes and legal requests
If Invoqly is financed, reorganized, merged, acquired or transferred, information may be reviewed or transferred as part of that transaction under confidentiality and appropriate safeguards. We may preserve or disclose information when we reasonably believe it is required by valid legal process, necessary to protect rights or safety, or needed to investigate fraud and abuse. Where lawful and practical, we will direct requests to the relevant business customer or notify the affected user.
24. Questions, complaints and contact
For privacy questions, access or deletion requests, authentication questions or complaints, email hello@invoqly.ae from the address associated with your account where possible. Describe the request and the account or invoice involved without emailing unnecessary sensitive information. We may ask for information needed to verify identity and protect the account. If you are not satisfied with our response, you may have the right to complain to the privacy or data-protection authority where you live.
25. Google sign-in
If you choose Google sign-in, Google provides your account identifier, email, name and profile image to Supabase for authentication. Invoqly uses this information to create or identify your account and display your profile. Basic sign-in does not request Gmail, Drive, Calendar or contacts. We do not sell Google-derived data or use it for advertising. You may revoke access in your Google Account settings; revocation and deletion of your Invoqly account are separate actions. Use and transfer of Google API data is subject to the Google API Services User Data Policy, including its Limited Use requirements.