1. Who is responsible
Invoicing HQ is operated by TajiTechin Kenya. We are the data controller for the personal data described in this policy, and we process it in line with Kenya’s Data Protection Act, 2019. For any privacy question or request, email support@invoicinghq.com.
Your customers’ data. When you add details about your own customers (names, contacts, addresses, amounts on documents), you are the data controller for that information and we act as your data processor: we store and process it only to provide the Service to you, and never use it for our own purposes. Requests from your customers about their data should go to you; we will help you respond.
2. What we collect
Information you give us
- Account: your name, email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
- Business details: company name, address, contact details, logo and other settings you enter.
- Your Content: customers, quotations, invoices, receipts, line items, notes and templates.
- Support and account requests: messages you send us, and the optional reason you give when deleting your account.
Billing information
Payments are handled by Paystack. We receive and store your plan, payment channel (card or mobile money), amounts, currency, payment references, dates and status. We do not receive or store full card numbers or mobile money PINs.
Collected automatically
- Security and service logs: IP address, browser type and request details, used to keep the Service secure, prevent abuse (for example rate-limiting sign-in attempts) and fix errors. When you delete your account we record the IP address the request came from.
- Website analytics:on our public pages only (home, pricing, about, contact, sign-in, sign-up and these policies), Google Analytics records pages visited, clicks on buttons such as “Get started”, the plan you pick, approximate location, device and browser. It is not loaded with data from inside your dashboard or admin area. See our Cookie Policy.
3. How we use it, and why we are allowed to
- To provide the Service — create your account, store your documents, generate PDFs and show your dashboard. Basis: performing our contract with you.
- To bill you — process subscriptions, send receipts and renewal reminders, and handle failed payments. Basis: contract, and our legal obligation to keep financial records.
- To communicate with you — account emails such as welcome, security, billing and account deletion notices. These are part of the Service, not marketing.
- To keep the Service secure — prevent fraud and abuse, and investigate problems. Basis: our legitimate interest in a safe, working Service.
- To improve our website — understand which pages and plans interest visitors, using aggregated analytics. Basis: legitimate interest.
We do not sell or rent personal data, we do not use your content or your customers’ data for advertising, and we do not make decisions about you based solely on automated processing.
4. Who we share it with
We share personal data only with service providers that help us run the Service, under agreements that protect it:
- Supabase — database and user authentication.
- Paystack — payment processing for subscriptions.
- Resend — delivery of account and billing emails.
- Google— “Sign in with Google” (only if you use it) and Google Analytics on public pages.
- Our hosting provider — servers that run the application.
We may also disclose information where the law requires it, to protect our rights or users’ safety, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
5. Transfers outside Kenya
Some of these providers store or process data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act allows, such as the provider’s contractual data protection commitments, and we only use providers with appropriate security measures.
6. How long we keep it
- While your account is open, we keep your account information and Your Content.
- When you delete your account, access stops immediately and you can restore the account for 30 days. After that we permanently remove your personal profile and sign-in details.
- Financial records — invoices, receipts, and subscription payment records — may be kept after deletion for as long as tax and accounting laws require. They are no longer linked to your sign-in.
- Deletion history — we keep a minimal record that an email address deleted an account (the address and dates), to prevent abuse and keep accurate records. Your name, IP address and deletion reason are removed from it at purge.
- Logs are kept only as long as needed for security and troubleshooting.
7. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed about how your personal data is used (this policy);
- access the personal data we hold about you;
- have inaccurate or misleading data corrected;
- have data deleted, subject to records we must keep by law;
- object to processing, including for direct marketing;
- receive your data in a structured, commonly used, machine-readable format (portability).
You can update most information yourself in Settings, and delete your account there. For anything else, email support@invoicinghq.com from the address on your account. We will respond within the time the law requires. If you are unhappy with our response, you can complain to the Office of the Data Protection Commissioner.
8. Security
Data is encrypted in transit (HTTPS). Each business’s records are separated at the database level with row-level security, access to administrative tools is restricted, and payment details are handled by Paystack rather than by us. No system is perfectly secure; if a breach affects your personal data, we will notify you and the Data Protection Commissioner as the law requires.
9. Children
The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect children’s data.
10. Changes to this policy
We will post any update here with a new “last updated” date, and email account holders about material changes.
11. Contact
TajiTech, operator of Invoicing HQ. Email: support@invoicinghq.com.