Privacy policy

theHinvoicer is made by theHoracle Studio, which is responsible for your personal data as the “controller” under data protection law. You can reach us about anything in this policy at hello@thehinvoicer.app.

For the details of your clients that you put into theHinvoicer, you are the controller and we process them for you (see Your clients' information).

Your account: your name, email address and password (stored only as a secure hash), or your Google account's name and email if you sign in with Google.

Your business details: business name, email, phone, address, logo, brand colours, payment instructions and settings such as your timezone and email templates.

Your clients and invoices: the client names, emails, phone numbers and addresses you add, and your invoices, line items, notes and their history.

Email and activity records: for each email we send for you, who it went to and whether it was delivered, bounced, opened or reported as spam; when a client views an invoice page; and the notifications we show you.

Billing: your plan, its status and renewal date, and a record of each subscription payment. Card details are handled by our payment providers and never reach us.

Push notifications: if you turn them on, the address your browser gives us to deliver notifications to that device.

Technical data: like any website, our hosting provider receives your IP address and browser details when you visit, to deliver the site and protect it from attacks. We use your country only to decide whether to ask about cookies.

We don't ask for, and you shouldn't put into theHinvoicer, sensitive data such as health information or government ID numbers.

When you add clients and send them invoices, you decide what information is used and why. You are its controller, and we are your processor: we use it only to provide theHinvoicer to you, following your instructions in the app, and we keep it confidential and secure. These terms and this policy are our data processing terms; if you need a separate data processing agreement, email hello@thehinvoicer.app.

Make sure you have a lawful reason to invoice the people you add and to email them through theHinvoicer, and that your own privacy notice tells them about it where the law requires.

When your client opens an invoice email, it contains a small image that tells us it was opened, and the invoice page records when it is viewed. We show this to you so you know your invoice was seen. If you turn on payment reminders, we email your clients reminders on your behalf, and each reminder lets them tell you they've already paid.

Where laws such as the GDPR and the UK GDPR require a legal basis, these are ours:

• To provide the service (your account, creating, sending, tracking and reminding about invoices, push notifications you turn on): necessary to perform our contract with you.
• To take payment for Pro and keep your plan in step with your payments: performing our contract, and our legal obligations for financial records.
• To keep theHinvoicer secure and working, prevent abuse (for example, stopping emails to addresses that bounce or report spam), fix problems and improve it: our legitimate interests in running a safe, reliable service. You can object to this (see Your rights).
• To send service emails about your account, billing and the notifications you've turned on: performing our contract.
• To remember your light or dark mode where the law requires consent: your consent, which you can change any time.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use a small number of providers (sub-processors), each only for its part of the service:

• Cloudflare: hosting, the database, email sending, and protecting the site.
• Paystack (payments in naira) and Bachs (payments in US dollars): subscription payments.
• Google: only if you choose to sign in with Google.
• Your browser's push service (Google, Apple or Mozilla): delivering push notifications, if you turn them on. The content is encrypted, so the push service can't read it.

We may also disclose data where the law requires it, or to protect people from harm or fraud. If theHinvoicer changes ownership, your data would move with it under this policy, and we'd tell you.

theHinvoicer is run from Nigeria, and our providers operate around the world, so your data may be processed in countries other than yours, including Nigeria, the United States and the European Union. Where data from the EU, UK or Switzerland goes to a country without an adequacy decision, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses and the UK's transfer addendum. Ask us at hello@thehinvoicer.app for details.

We use only:

• Essential cookies: one to keep you signed in, and one that remembers your cookie choice. The site can't work without them, so they don't need consent.
• A preference cookie that remembers whether you chose light or dark mode. If you're in the EU, the EEA, the UK or Switzerland, we only set it if you agree.
• A few settings kept in your browser's storage that the app needs, such as a checkout you've started or a message you've dismissed.

No advertising or tracking cookies. Change your choice any time: Cookie preferences.

We keep your account, clients and invoices while your account is open, because invoices are business records you may need later. Emails scheduled for later are stored with their PDF only until they're sent or cancelled. If you ask us to delete your account, we delete your data within 30 days, except what the law requires us to keep (for example, records of payments to us, which we keep for as long as tax law requires).

Wherever you are, you can ask to see, correct, export or delete your personal data. You can do much of this yourself: edit your details in the app, and download a full backup from Settings. For anything else, email hello@thehinvoicer.app. We'll reply within 30 days (or sooner where your law says so), and we may need to confirm it's you. We won't treat you differently for using your rights.

EU, EEA, UK and Switzerland: under the GDPR, the UK GDPR and Swiss law you have the rights of access, rectification, erasure, restriction, data portability and objection (including to processing based on our legitimate interests), and you can withdraw consent at any time. You can complain to the data protection authority where you live or work.

Nigeria: under the Nigeria Data Protection Act 2023 you have the same rights to access, correct, delete, port and object, and you can complain to the Nigeria Data Protection Commission.

California and other US states: under the CCPA as amended by the CPRA, and similar laws in other states, you can ask to know what personal information we collect, use and disclose, and ask us to correct or delete it. We don't sell personal information or share it for cross-context behavioural advertising, and we don't use sensitive personal information. An authorised agent can make a request for you. The categories we collect are the ones listed in What we collect, for the purposes in How we use it.

If you're the client of a business that uses theHinvoicer, contact that business first: they control your information, and we'll help them respond.

theHinvoicer is a business tool and isn't meant for anyone under 16. We don't knowingly collect children's data; if you think we have, email hello@thehinvoicer.app and we'll delete it.

Your data is encrypted in transit, passwords are stored only as secure hashes, invoice links are long and unguessable, and push notifications are encrypted end to end. No system is perfectly secure; if a breach puts your data at risk, we'll tell you and the authorities as the law requires.

If we change this policy in a way that matters, we'll update the date above and tell you by email or in the app before it takes effect. Questions or requests: hello@thehinvoicer.app. See also our terms.