Privacy Policy

Introduction

This Privacy Policy (“Policy”) sets forth the comprehensive and detailed practices employed by Invoice45.com (hereinafter referred to as “we,” “our,” “us,” or “Invoice45.com”) with respect to the collection, receipt, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, and destruction of your personal data arising out of or in connection with your access to, use of, or interaction with our proprietary cloud-based invoicing, proposal management, and professional services automation application (the “Service”). This Policy applies to all users of the Service regardless of geographic location and covers all data processing activities undertaken by Invoice45.com whether directly or through its authorised sub-processors, affiliates, and service providers.

This Policy has been drafted in compliance with the European Union General Data Protection Regulation (Regulation 2016/679) (“GDPR”), the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”), the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados) (“LGPD”), and all other applicable national, federal, state, provincial, territorial, and local data protection and privacy laws and regulations that may be applicable to the data processing activities described herein. We reserve the right to amend or update this Policy at any time and for any reason, and such amendments shall be effective upon posting the revised Policy on the Service unless a later effective date is specified therein.

By creating an account, accessing, browsing, or otherwise using the Service in any manner, you acknowledge that you have carefully read, fully understood, and freely agree to be bound by all terms and conditions of this Privacy Policy. If you do not agree with any provision of this Policy, you must immediately cease all use of the Service and contact us at invoice45@allwebtech.in to request account deletion and data erasure. Your continued use of the Service following the posting of any changes to this Policy constitutes your binding acceptance of such changes.

Identity and Contact Details of the Data Controller

For the purposes of the GDPR and other applicable data protection legislation, the data controller responsible for determining the purposes and means of the processing of your personal data is the following entity, which operates and maintains the Invoice45.com Service and is ultimately accountable for ensuring that your personal data is processed in accordance with applicable law:

Our designated Data Protection Officer and primary privacy contact can be reached at invoice45@allwebtech.in. All privacy-related inquiries, requests, complaints, and communications shall be directed to this email address. We are committed to acknowledging receipt of your inquiry within five (5) business days and providing a substantive written response within thirty (30) calendar days of receipt, extendable by a further sixty (60) calendar days where the complexity or volume of requests so requires, in which case we shall inform you of the extension and the reasons therefor within the initial thirty-day period.

The Data Protection Officer is responsible for monitoring compliance with the GDPR, with other Union or Member State data protection provisions and with the policies of Invoice45.com in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the conduct of audits and reviews. The Data Protection Officer shall report directly to the highest management level of Invoice45.com and shall not receive instructions regarding the exercise of these tasks.

What Personal Data We Collect

We collect and process various categories of personal data through multiple touchpoints, interaction channels, automated means, and user-initiated activities. The specific categories of personal data we collect, the sources from which we obtain such data, the purposes for which we process it, and the legal bases supporting each processing activity are set forth in comprehensive detail below. We collect personal data both directly from you when you interact with the Service and indirectly through automated technical means such as cookies, server logs, and analytics tools. We do not collect personal data that is excessive, irrelevant, or not reasonably necessary for the purposes described in this Policy.

The complete, detailed inventory of all personal data collected at each touchpoint — including the specific data elements, retention periods, and legal basis mapping — is set forth in Annexure 02 (Personal Data Collection Inventory), which is incorporated into this Policy by reference. For a summary of the key data categories, please refer to the table below:

We do not knowingly collect, solicit, or process personal data from any person under the age of sixteen (16) or such other age as may be specified by applicable law in the relevant jurisdiction. If we become aware that we have collected personal data from a child without verification of parental consent, we shall take immediate steps to delete such information from our systems. If you are a parent or guardian and believe that your child has provided personal data to us without your consent, please contact us immediately at invoice45@allwebtech.in and we will expeditiously remove such data.

Purpose and Legal Basis for Processing

Under Article 6(1) of the GDPR, personal data shall only be processed lawfully if and to the extent that at least one of the following legal bases applies. We have carefully assessed and documented the legal basis relied upon for each category of processing activity. Where the legal basis is consent, you have the right to withdraw consent at any time. Where the legal basis is contractual necessity, the processing is a prerequisite for the performance of the contract to which you are a party. Where the legal basis is legitimate interest, we have conducted a balancing test and documented our assessment of your rights and freedoms against our legitimate interests. The following table sets forth the complete mapping of processing activities to their respective legal bases:

Cookies and Tracking Technology

The Service uses cookies, web beacons, pixels, local storage, and similar tracking technologies (collectively, “Cookies”) to operate efficiently, secure your session, remember your preferences, and, only with your explicit consent, collect analytics data about how you interact with the Service. We implement Cookiebot, a Consent Management Platform (CMP) provided by Usercentrics, to provide you with granular, layered, and transparent control over which categories of Cookies are active on your device. All non-essential Cookies and tracking scripts are completely blocked at the network level until you actively and affirmatively consent to their use through the Cookiebot consent banner. No tracking, analytics, or marketing data is collected, transmitted, or processed before consent is obtained. Your cookie consent preferences are stored locally and can be revised at any time.

You may manage, review, update, or withdraw your cookie consent preferences at any time by clicking the “Cookie Settings” link located in the footer of every page on the Service, which will re-open the Cookiebot consent banner and allow you to toggle individual cookie categories on or off. Additionally, most web browsers provide settings that allow you to block or delete all cookies, restrict cookies to specific websites, or receive a notification when a cookie is set. Please note that disabling strictly necessary cookies may impair or prevent the functioning of the Service entirely.

We do not use browser fingerprinting, device fingerprinting, cross-device tracking, or any other covert identification techniques. We do not employ dark patterns, guilt trips, or deceptive user interface designs to manipulate you into providing consent. The Cookiebot consent banner presents all cookie categories equally and allows you to accept or reject each category independently without any pre-selected options.

Third-Party Services and Data Processors

In order to provide, maintain, secure, and improve the Service, we engage a limited number of carefully selected third-party service providers who act as data processors on our behalf. Each third-party processor is bound by a legally binding Data Processing Agreement (DPA) that requires them to implement appropriate technical and organisational measures, to process personal data only on our documented instructions, to ensure the confidentiality of personal data, to implement security measures consistent with Article 32 of the GDPR, to assist us in responding to data subject rights requests, to delete or return personal data upon termination of the agreement, and to submit to audits and inspections. The complete and detailed inventory of all third-party processors — including jurisdiction, transfer mechanisms, and consent requirements — is set forth in Annexure 01 (Third-Party Data Processors), which is incorporated into this Policy by reference. For a summary of the key processors, please refer to the table below:

Data Retention Periods

We adhere to the principle of storage limitation as set forth in Article 5(1)(e) of the GDPR, which requires that personal data be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. We have established the following retention periods for each category of personal data, taking into account the purposes for which the data is processed, applicable legal and regulatory retention requirements, contractual obligations, legitimate interests, and the expectations and reasonable assumptions of our users. The table below sets forth the specific retention periods applicable to each category of data:

Upon receipt of a valid account deletion request or when you delete your account through the Service interface, all personal data associated with your account is permanently and irreversibly removed from our production databases within thirty (30) calendar days. Data within encrypted database backups is purged within the 90-day rolling backup window. You are strongly encouraged to export all of your data using the application's CSV export feature prior to initiating account deletion, as we may be unable to recover data after the deletion process has been completed. Certain anonymised or aggregated data that can no longer be attributed to you may be retained indefinitely for statistical and analytical purposes.

Where data is retained for longer periods to comply with legal obligations (such as tax record retention requirements under the Income Tax Act, 1961 or equivalent legislation in your jurisdiction), such data is restricted from any further processing and is securely deleted upon expiry of the applicable statutory retention period.

Data Subject Rights Under the GDPR

Under the General Data Protection Regulation and other applicable data protection laws, you possess a comprehensive set of rights in relation to your personal data. We are committed to facilitating the exercise of these rights and have implemented procedures, technical capabilities, and in-app tools to enable you to exercise them promptly and without undue burden. The following rights are available to you, and we shall respond to all valid requests within thirty (30) calendar days of receipt, extendable by an additional sixty (60) calendar days where necessary and in accordance with Article 12(3) of the GDPR:

• Right of Access (Art. 15 GDPR) — You have the right to obtain confirmation as to whether or not personal data concerning you is being processed by Invoice45.com, and where that is the case, to access the personal data and the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients, the envisaged retention periods, the existence of your other rights, the source of the data (if not collected directly from you), and the existence of automated decision-making including profiling. You may exercise this right directly through the in-app data export tool or by emailing us.
• Right to Rectification (Art. 16 GDPR) — You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and to have incomplete personal data completed, including by means of providing a supplementary statement. You may exercise this right directly through the in-app profile settings and account management interface.
• Right to Erasure / Right to Be Forgotten (Art. 17 GDPR) — You have the right to obtain the erasure of your personal data without undue delay where one of the following grounds applies: the data is no longer necessary for the purpose for which it was collected; you withdraw consent on which the processing is based and there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds; the data has been unlawfully processed; the data must be erased for compliance with a legal obligation. Please note that this right is subject to exceptions where retention is required for legal obligations, the establishment, exercise, or defence of legal claims, or other grounds specified in Article 17(3) of the GDPR.
• Right to Restriction of Processing (Art. 18 GDPR) — You have the right to obtain restriction of processing where: you contest the accuracy of the data (for a period enabling us to verify accuracy); the processing is unlawful and you oppose erasure; we no longer need the data but you require it for legal claims; you have objected to processing pending verification of whether our legitimate grounds override yours. Where processing is restricted, such data shall only be processed with your consent or for legal claims.
• Right to Data Portability (Art. 20 GDPR) — You have the right to receive the personal data which you have provided to Invoice45.com in a structured, commonly used, and machine-readable format (CSV or JSON), and you have the right to transmit that data to another controller without hindrance where the processing is based on consent or a contract and is carried out by automated means. The in-app CSV export feature supports this right.
• Right to Object (Art. 21 GDPR) — You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on legitimate interests (including profiling). Invoice45.com shall no longer process the data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. You have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3) GDPR) — Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing that occurred before the withdrawal. Withdrawal shall be as easy as giving consent and may be exercised through Cookiebot settings, in-app controls, or by contacting us at invoice45@allwebtech.in.
• Right Not to Be Subject to Automated Decision-Making (Art. 22 GDPR) — You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Invoice45.com does not currently employ any automated decision-making or profiling systems that produce legal or similarly significant effects.
• Right to Lodge a Complaint — Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

Cross-Border Data Transfers

The Service is operated from infrastructure located in India, and certain third-party data processors that we engage are located in jurisdictions outside the European Economic Area (EEA), the United Kingdom, and other jurisdictions that may have different data protection laws than those applicable in your jurisdiction. When personal data is transferred internationally, we ensure that appropriate safeguards and legal mechanisms are in place to protect your personal data to a standard that is essentially equivalent to the protection afforded under the GDPR, in accordance with Chapter V of the GDPR. The following specific transfer mechanisms and safeguards are in place for each cross-border data transfer:

• Google Analytics (Google LLC, United States) — Personal data is transferred from the EEA to the United States under the EU-US Data Privacy Framework (DPF) adequacy decision adopted by the European Commission on 10 July 2023. Google LLC is certified under the DPF. Where the DPF is not available, we rely on the Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). IP anonymisation (truncation of the last octet) is enabled in all Google Analytics configurations, reducing the personal data transferred.
• PostHog (PostHog Inc., United States) — Personal data is transferred under the Standard Contractual Clauses (SCCs) incorporated into our Data Processing Agreement with PostHog. PostHog offers EU-hosted data residency as an option, which we can enable upon request. PostHog implements encryption at rest and in transit for all data.
• Ahrefs (Ahrefs Pte. Ltd., Singapore) — Personal data is transferred under the Standard Contractual Clauses (SCCs) incorporated into our Data Processing Agreement with Ahrefs. Singapore is recognised by the European Commission as providing an adequate level of data protection under the GDPR adequacy framework.
• Payment Processors (Razorpay, Cashfree — India) — Transaction data is processed under the legal basis of contractual necessity (Art. 6(1)(b)) as payment processing is an essential element of the service you have contracted. Both Razorpay and Cashfree operate PCI DSS Level 1 certified payment infrastructure and implement end-to-end encryption of payment data. Card details are tokenised and never stored on Invoice45.com servers.

Data Security Measures

We implement a comprehensive, multi-layered information security programme that includes administrative, technical, and physical safeguards designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security measures are continuously reviewed, tested, and improved in accordance with industry best practices and the requirements of Article 32 of the GDPR. The following is a non-exhaustive summary of the key technical and organisational measures we have implemented:

• Password Security: All user passwords are irreversibly hashed using the bcrypt algorithm with a minimum of 12 salt rounds before storage. Passwords are never stored in plaintext, transmitted in clear text, or accessible to any employee, contractor, or third party of Invoice45.com under any circumstances.
• Authentication and Session Management: User authentication is performed using JSON Web Tokens (JWT) issued upon successful credential verification. JWT tokens are stored exclusively in HTTP-only, Secure, SameSite=Strict cookies that are inaccessible to client-side JavaScript, mitigating cross-site scripting (XSS) attack vectors. Session tokens expire after a configurable period of inactivity and are invalidated upon explicit logout.
• Input Validation and Sanitisation: All user-supplied input undergoes rigorous server-side validation, sanitisation, and encoding before processing. This includes type checking, length restrictions, format validation, character encoding, and HTML entity encoding to prevent injection attacks, cross-site scripting, and data corruption.
• SQL Injection Protection: All database queries are executed using parameterised queries (prepared statements) that strictly separate SQL code from user-supplied data, providing comprehensive protection against SQL injection attacks regardless of the input validation layer.
• Tenant Data Isolation: The Service implements a robust multi-tenant architecture with logical data isolation at the application, API, and database query layers. Every database query is scoped to the authenticated user's tenant context, ensuring that no user can access, view, modify, or delete data belonging to another user under any circumstances.
• Encryption in Transit: All network communication between client devices and our servers, and between our internal services, is encrypted using Transport Layer Security (TLS) 1.2 or higher. HTTP Strict Transport Security (HSTS) headers are deployed to enforce HTTPS and prevent protocol downgrade attacks. HTTP to HTTPS redirection is enforced at the server level.
• Security Headers: The following security headers are deployed on all responses: Content Security Policy (CSP) to restrict resource loading origins; X-Content-Type-Options: nosniff to prevent MIME-type sniffing; X-Frame-Options: DENY to prevent clickjacking; X-XSS-Protection: 1; mode=block for legacy browser protection; Referrer-Policy: strict-origin-when-cross-origin; Permissions-Policy to restrict browser feature access.
• Access Logging and Monitoring: All data access events, authentication events, administrative actions, and API requests are logged with timestamps, source IP addresses, user identifiers, and action details. Logs are monitored for anomalous activity, reviewed during security audits, and retained for ninety (90) days in compliance with our security policies.
• Vulnerability Management: We conduct regular automated vulnerability scans, dependency audits, and periodic penetration testing of the Service. Critical and high-severity vulnerabilities are remediated within documented SLAs based on severity classification.
• Incident Response: We maintain a documented incident response plan that defines procedures for detection, containment, eradication, recovery, and notification in the event of a personal data breach. Where a breach is likely to result in a high risk to your rights and freedoms, we shall notify the relevant supervisory authority within seventy-two (72) hours and notify affected data subjects without undue delay, in accordance with Articles 33 and 34 of the GDPR.

Privacy Contact and Complaints

If you have any questions, concerns, comments, requests, or complaints regarding this Privacy Policy, our data processing practices, or the exercise of your data subject rights, we encourage you to contact us using any of the following channels. We are committed to addressing all privacy-related communications promptly, thoroughly, and in accordance with applicable law:

We will acknowledge receipt of your privacy-related communication within five (5) business days and will provide a substantive written response within thirty (30) calendar days of receipt. Where the complexity or volume of a request requires additional time, we may extend the response period by up to sixty (60) additional calendar days, in which case we will inform you of the extension and the reasons therefor within the initial thirty-day period. All identity verification for data subject rights requests is conducted proportionately and in accordance with the principle of data minimisation.

If you are not satisfied with our response to your privacy concern, or if you believe that our processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with a supervisory data protection authority in your country of habitual residence, your place of work, or the place of the alleged infringement. For users in the European Union, a list of supervisory authorities and their contact details is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For users in India, complaints may be directed to the relevant authority under the Digital Personal Data Protection Act, 2023, once operationalised. For users in California, you may contact the Office of the California Attorney General. We encourage you to contact us first so that we may attempt to resolve your concern directly before you lodge a complaint with a supervisory authority.

Data Controller and Processor Roles

The GDPR distinguishes between data controllers and data processors, each of which carry different legal obligations and responsibilities. Understanding this distinction is important for determining which party is responsible for compliance with data protection obligations in relation to different categories of personal data processed through the Service. The following describes the roles that apply to the different categories of data processed through Invoice45.com:

• You are the Data Controller for all customer data that you enter into Invoice45.com in the course of using the Service, including but not limited to your clients' names, email addresses, physical addresses, phone numbers, billing information, transaction details, and any other personal data relating to third parties that you input, upload, or otherwise provide to the Service. As the data controller, you are responsible for ensuring that you have a valid legal basis for collecting and providing this data to Invoice45.com, for responding to data subject requests from your clients, and for complying with applicable data protection laws in relation to this data.
• Invoice45.com acts as a Data Processor for the customer data described above, processing it solely on your documented instructions and for the purposes of providing you with the invoicing, proposal management, and related functionality of the Service. We process this data in accordance with our Data Processing Agreement and do not use it for any purpose other than providing the Service to you, unless required to do so by applicable law.
• Invoice45.com is the Data Controller for your account data, including your name, email address, company information, payment history, usage data, preferences, and any other personal data that you provide directly to Invoice45.com for the purpose of establishing and maintaining your account and using the Service. As the data controller for this category of data, we determine the purposes and means of processing and are responsible for complying with applicable data protection laws in relation to it.

This dual role structure means that when you use Invoice45.com, you should be aware that we process some data as your processor (on your behalf and under your direction) and other data as an independent controller (for our own purposes as described in this Policy). If you are uncertain about which role applies to a particular category of data, or if you require further clarification about how we handle specific types of data, please contact us at invoice45@allwebtech.in.

Updates to This Privacy Policy

We reserve the right to update, modify, amend, or replace this Privacy Policy at any time and from time to time at our sole discretion to reflect changes in our services, data processing practices, technology, legal requirements, regulatory guidance, judicial decisions, or industry best practices. The “Last updated” date displayed at the top of this page indicates the date of the most recent revision and should be checked periodically for changes. All material changes to this Policy shall be documented with a summary of the changes and the effective date of the revised Policy.

In the event of material changes to this Policy — including, but not limited to, changes in the categories of data we collect, the purposes for which we process data, the legal bases relied upon, or the rights available to you — we shall make reasonable efforts to notify you of such changes via email sent to the address associated with your account, through a prominent in-app notification displayed upon your next login, and/or through a banner on the Service. However, it is your responsibility to review this Policy periodically to stay informed of any updates.

Your continued access to, use of, or interaction with the Service following the posting of any changes to this Privacy Policy, or following notification of such changes (whichever occurs first), constitutes your binding acceptance of and agreement to the revised Policy. If you do not agree with any changes to this Policy, you must immediately cease all use of the Service, delete your account, and contact us at invoice45@allwebtech.in to request deletion of your personal data.

Key Privacy Commitments