Privacy Policy

Who we are

Invogi provides invoice risk analysis and pre-payment control software. For privacy questions or requests, contact hello@invogi.com. The contracting business identity shown in your order or customer agreement is the relevant service provider.

Data we collect

• Account and organization data: name, work email, organization, role, authentication identifiers, invitations, and preferences.
• Customer content: AP exports, invoice documents and fields, supplier and bank-account information, purchase orders, payments, findings, review notes, and integration data submitted by authorized users.
• Service and device data: IP address, browser and device information, logs, request IDs, timestamps, usage, security events, and diagnostic data.
• Commercial data: plan, subscription status, transaction identifiers, and billing contact details. Paddle handles payment-card data; Invogi does not receive full card details.
• Communications: contact-form entries, support requests, demo requests, and related correspondence.

Why we use data

We use personal data to provide and secure the service; authenticate users; analyze invoices as instructed by customers; administer accounts, subscriptions, support, and communications; prevent abuse; comply with law; and improve reliability and functionality. Depending on the context, our legal basis is performance of a contract, legitimate interests in operating and securing the service, consent, or compliance with legal obligations.

Customer data roles

For personal data contained in customer-uploaded invoices, supplier records, and connected systems, the customer generally acts as controller and Invogi acts as processor under our Data Processing Agreement. For account, website, billing-administration, and direct communications data, Invogi may act as controller.

Sharing and subprocessors

We share data only as needed with infrastructure, storage, database, authentication, email, document-processing, support, security, analytics, and billing providers; with professional advisers; during a corporate transaction; or when lawfully required. Current categories and named subprocessors are listed in our Subprocessor List. Paddle acts as merchant of record and handles buyer data under its own privacy notice.

Referrals

When you follow an approved referrer's link, we store the referral code in a first-party cookie for up to 30 days so it remains available if sign-up is interrupted. If you create a workspace with the code, we record which referrer it came from so we can pay them commission and delete the cookie. The referrer sees an anonymous entry — when it signed up, whether a scan was run or findings were raised, whether it subscribed, and the commission earned on its payments — but never your name, your workspace name, or any invoice data. Referrers we pay are processed for payment and tax purposes.

International transfers

Where personal data is transferred internationally, we use an appropriate legal mechanism such as an adequacy decision, standard contractual clauses, or another lawful safeguard as applicable.

Retention

We retain account and service data while needed to provide the service and for a limited period afterward for security, backup, dispute, audit, and legal obligations. Customer-configured retention applies where available. Source documents scheduled for deletion are removed from active systems; backup copies expire according to the relevant backup cycle. We may retain de-identified data that can no longer reasonably identify a person.

Security

We use technical and organizational measures including encryption in transit, managed encryption at rest, role-based access, tenant scoping, API-key hashing, audit logging, and defensive file handling. No online system is completely risk-free. See Security & Trust for more detail.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to withdraw consent. You may also complain to your local data-protection authority. Email hello@invogi.com to make a request. If your data was provided by an Invogi customer, contact that customer first; we assist them with verified requests.

Cookies

The marketing site uses cookieless page-view analytics and a Zoho SalesIQ support-chat widget, which may use cookies or similar storage to provide chat functionality. The application uses cookies and similar storage necessary for authentication, security, and user preferences. Invogi does not use these tools for cross-site advertising. Read our Cookie Policy.

Children

Invogi is a business service and is not directed to children. We do not knowingly collect personal data from children.

Changes and contact

We may update this policy and will post the new effective date here. Material changes will be communicated where required. Questions and requests can be sent to hello@invogi.com.