Privacy Policy

1. Controller and processor — who is responsible for what

Two different relationships run in parallel, and it matters which one you are asking about.

• Invco is the controller of your account data — your name, email address, login, security settings, subscription and billing records. This policy governs that.
• Invco is a processor for the data you put in about your own clients. You decide what to record about them and why; we act on your instructions. Our Data Processing Agreement sets out those terms.
• SumUp is an independent controller for payment data when your customer pays an invoice. Card details are entered on SumUp's own checkout and never reach Invco. Their privacy notice governs what they do with them.

2. Information we collect

We collect the following to provide the service:

• Account information — your name, email address, and a securely hashed password when you register, plus two-factor settings if you enable them.
• Business and invoice data — the business details, clients, invoices, line items, and templates you create in your workspace.
• Email settings and mail content — if you send from your own address, the SMTP/IMAP details you provide, the messages Invco sends for you, and replies received back into your Invco mailbox.
• Payment settings and records — the API key for the payment account you connect, and for each payment the reference, amount, currency, status, method type and timestamp. Never a card number, CVV or expiry date.
• Subscription records — which plan you are on, what you have paid, and when the current period ends.
• Usage and device data — basic analytics such as pages visited, collected via Google Analytics only after you accept analytics cookies.
• Cookies — see our Cookie Policy for the full list.

3. How we use your information

We do not sell your personal data, and we do not use the contents of your invoices or mailbox to train any AI model.

• To provide and operate Invco — creating, storing, rendering, sending and collecting payment on your invoices.
• To authenticate you and keep your account secure, including rate limiting and abuse investigation.
• To send you essential account emails — verification codes, password resets, billing notices and important service notices. These are not marketing and cannot be opted out of while your account is active.
• To bill you for your subscription and keep the records the law requires us to keep.
• To understand how the product is used and improve it.
• To respond to your support requests.

4. Legal bases (UK/EU GDPR)

• Performance of a contract — operating your account and delivering the service you have paid for.
• Legitimate interests — keeping the service secure, preventing abuse, and improving the product, balanced against your rights.
• Consent — analytics cookies, which stay off until you accept, and which you can withdraw at any time.
• Legal obligation — retaining billing and tax records for the period the law requires.

5. How invoice emailing works

When you connect your own email and send an invoice, Invco uses the credentials you provide solely to deliver that message from your address to your recipient, and to read replies back into your Invco mailbox so they appear against the right invoice. Those credentials are encrypted at rest and are never displayed back to you or to anyone else. We do not use your mailbox for anything other than the sending and reply-matching you have asked for.

6. How payments work

Invco never holds your money and never receives card details. When a client pays, Invco asks your connected SumUp account to open a checkout, and the client enters their card on a page hosted by SumUp. We record the checkout reference, the amount, the status and the payment method type so your invoice can mark itself paid and appear correctly in your statements. Settlement is between SumUp and you.

7. AI and the MCP integration

If you connect Invco's built-in MCP server to an AI assistant such as Claude, the assistant can act on your account using a per-user API key that you generate and can revoke at any time. The assistant only performs the actions you request, scoped strictly to your own workspace, and the data it receives is whatever those actions return. Anthropic's own terms govern what the assistant does with it. This integration is off unless you turn it on.

8. Sub-processors and service providers

We rely on a small number of providers to run Invco. Each processes data only to provide its service to us, under contract.

• Vercel Inc. — application hosting and content delivery (United States).
• Supabase — PostgreSQL database and file storage, hosted on AWS in us-east-1 (United States).
• Google LLC — Google Analytics, only after you accept analytics cookies (United States).
• Anthropic PBC — only if you connect an AI assistant to your workspace (United States).
• Your own email provider — the SMTP/IMAP service whose credentials you supply.
• SumUp — payments. Acting as an independent controller rather than our sub-processor.

9. International transfers

Invco's infrastructure is located in the United States, so if you are in the UK or the EEA your data is transferred outside it. Where required, we rely on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.

Our personnel are based in Pakistan and access production systems in the course of running and supporting the service. That access is covered by the same safeguards and by a confidentiality obligation. We would rather state this plainly than leave it for you to discover.

10. Data retention

We keep your data for as long as your account is active. If you delete your account or ask us to delete your data, we remove your personal data and workspace content within 90 days, except where we are required to keep limited records — principally billing and tax records — to comply with legal obligations.

Encrypted backups age out on their own retention cycle (30 daily archives plus month-start archives) and are deleted with it rather than edited in place. While they remain they stay encrypted and are used for nothing but restoring the service.

11. Security

Passwords are stored only as salted bcrypt hashes, never in plain text. Payment and mail credentials are encrypted at rest with AES-256-GCM using a key held outside the database. Each business operates in its own isolated workspace that other customers cannot query. Backups are encrypted, integrity-checked and restore-tested nightly. Our security page describes all of this in detail, including what we do not claim.

No system is perfectly secure, but if a breach affects your personal data we will notify you without undue delay and, where the law requires it, the relevant supervisory authority within 72 hours.

12. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a portable copy. You can access and update your account information at any time from your settings, and export your workspace data yourself — including after a subscription has lapsed. For anything else, email privacy@invco.pro and we will respond within one month.

If you are in the UK and believe we have handled your data improperly, you can complain to the Information Commissioner's Office at ico.org.uk. If you are in the EEA, you can complain to your local supervisory authority. We would appreciate the chance to put it right first.

13. Cookies and analytics

Invco uses a strictly necessary session cookie to keep you signed in. Google Analytics is wired to Google Consent Mode and stays off until you accept — declining costs you nothing in the product. Our Cookie Policy lists every cookie and what it does.

14. Children

Invco is intended for businesses and is not directed to individuals under 18. We do not knowingly collect data from children.

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you by email.

16. Contact

Data protection enquiries and requests: privacy@invco.pro. General support: support@invco.pro. Security reports: security@invco.pro.