Privacy Policy

Invoicely ("we", "us", "our") is operated by Zentix Pty Ltd, an Australian company. We are committed to protecting your privacy and handling your personal information in an open and transparent manner. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you use our website, application, and services (collectively, the "Service"). This Policy is designed to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) and the General Data Protection Regulation (GDPR) where applicable.

We collect information that you provide directly to us, information generated when you use the Service, and information from third-party sources. **Information you provide:** • Account details: email address, name, password • Business information: business name, ABN, address, contact details • Customer and invoice data: names, addresses, ABNs, email addresses of your clients • Payment information: processed by Stripe — we never store your card details • Communications: messages you send us via contact forms or email **Information collected automatically:** • Usage data: pages viewed, features used, time spent, actions taken • Device information: browser type, operating system, screen resolution • Log data: IP address, access times, referring URLs **Information from third parties:** • Authentication providers (if you sign in via OAuth) • Stripe (payment status, subscription details)

We use your personal information for the following purposes: **To provide the Service:** • Create and manage your account • Process invoices and store your data • Process payments via Stripe • Provide customer support **To improve the Service:** • Analyse usage patterns and trends • Develop new features and functionality • Debug errors and improve performance **To communicate with you:** • Send service-related announcements • Respond to your enquiries • Send marketing communications (only with your consent) **To comply with legal obligations:** • Maintain financial records as required by Australian law • Respond to lawful requests from authorities

Your data is stored on secure servers provided by Supabase, hosted on Amazon Web Services (AWS) infrastructure. We implement industry-standard security measures: • All data is encrypted in transit using TLS 1.3 • Data at rest is encrypted using AES-256 • Database access is restricted via row-level security policies • Access to production systems is logged and monitored • We do not store credit card details — all payment processing is handled by Stripe While we take reasonable steps to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

We retain your personal information for as long as your account is active or as needed to provide the Service. **Account data:** Retained until you delete your account, after which it is removed within 30 days. **Invoice data:** Retained for as long as you maintain your account. If you delete your account, invoice data is permanently deleted within 30 days. **Backup data:** Removed from backups within 90 days of deletion. **Legal obligations:** Some data may be retained longer where required by Australian law (e.g., financial records for tax purposes). **Guest data:** Stored locally in your browser. We have no access to guest data and it is never transmitted to our servers.

We use the following third-party services that may collect information: **Supabase** — Database and authentication infrastructure • Provider: Supabase Inc. • Data stored: All application data (accounts, invoices, business information) • Privacy policy: https://supabase.com/privacy **Stripe** — Payment processing • Provider: Stripe, Inc. • Data processed: Payment details, subscription status, billing information • We do not store credit card numbers • Privacy policy: https://stripe.com/privacy **Vercel** — Hosting and deployment • Provider: Vercel Inc. • Data processed: Request logs, IP addresses • Privacy policy: https://vercel.com/legal/privacy-policy We do not sell your personal information to any third party.

We use cookies and similar technologies to maintain your session and remember your preferences. See our [Cookie Policy](/cookies) for detailed information. **Essential cookies:** • Authentication session cookies (managed by Supabase) • CSRF protection tokens **Local storage:** • Invoice draft data (guest mode) • Language/locale preference • UI preferences We do not use advertising cookies or third-party analytics that track you across websites.

Under the Australian Privacy Act and applicable laws, you have the right to: • **Access** the personal information we hold about you • **Correct** any inaccurate or incomplete information • **Request deletion** of your personal information • **Opt out** of marketing communications at any time • **Lodge a complaint** with the Office of the Australian Information Commissioner (OAIC) To exercise any of these rights, please contact us at the details below. We will respond to your request within 30 days.

Your data may be processed on servers located outside Australia, including in the United States (where our infrastructure providers operate). By using the Service, you consent to the transfer of your information to these locations. We ensure that any international transfers of personal information are handled in accordance with the Australian Privacy Principles, including taking reasonable steps to ensure the overseas recipient complies with the APPs.

The Service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date at the top. We encourage you to review this Policy periodically.

If you have any questions about this Privacy Policy or our data practices, please contact us: **Email:** privacy@zentix.app **Address:** Zentix Pty Ltd, Australia For privacy-related complaints, you may also contact the Office of the Australian Information Commissioner (OAIC): **Website:** https://www.oaic.gov.au