Privacy Policy

1. Who We Are

Anodelabs Technologies Limited ("Anodelabs," "we," "us," or "our") is the data controller for the personal data processed through the Trueinvoice mobile application and website (collectively, the "Service").

We do not currently appoint a Data Protection Officer. All data protection queries should be directed to [email protected].

2. Personal Data We Collect

We collect only the data necessary to provide the invoicing service. The categories below reflect everything we store.

2.1 Data You Provide Directly

2.2 Data We Generate

2.3 Payment Data (Stripe Connect)

We do not store your bank account numbers, card numbers, or any Stripe credentials. All payment processing is handled entirely by Stripe, Inc. under their own privacy policy.

2.4 Authentication Credentials

We support sign-in via email/password, Google OAuth, and Apple Sign-In. Authentication credentials are managed by Firebase Authentication (a Google Cloud service) and are not directly accessible to us. We do not store passwords in our own databases.

2.5 Data Stored on Your Device

2.6 Device Permissions

The mobile app may request the following permissions, each of which you can grant or revoke at any time through your device settings:

• Camera — to photograph receipts for expense tracking.
• Contacts — to help you quickly select existing contacts when creating invoices. Contact data is only read on-device; your full address book is never uploaded to our servers.
• Storage — to save generated invoice PDFs to your device.
• Biometrics (Face ID / Fingerprint) — to optionally lock the app behind biometric authentication.

3. Legal Basis for Processing

For users in the European Economic Area (EEA), United Kingdom, or any jurisdiction requiring a legal basis for processing personal data, we rely on the following grounds under the UK GDPR and EU GDPR:

We do not use analytics SDKs, advertising trackers, or marketing automation. No processing in Trueinvoice requires consent beyond the device permissions listed above.

4. How We Use Your Data

We process your personal data strictly for the following purposes:

• Service delivery — creating, storing, and syncing your invoices, estimates, expenses, contacts, and reports across your devices.
• Transactional communications — sending invoices and estimates to your clients by email, delivering automated payment reminders on schedules you configure, and sending you account verification and security alerts.
• Payment facilitation — enabling your clients to pay invoices online via Stripe Checkout, recording payment status, and linking your Stripe Connect account.
• Customer support — responding to issues or questions you raise through our support channels.
• Service improvement — diagnosing and fixing technical errors. We do not perform profiling, automated decision-making, or behavioural analysis.

5. Third-Party Processors

We share personal data only with the service providers listed below, each of which is necessary to deliver the core functionality of Trueinvoice. We do not sell, rent, or trade your data to any third party.

Each processor is contractually bound to process data only on our instructions and in compliance with applicable data protection law, including maintaining appropriate technical and organisational security measures.

6. International Data Transfers

Our primary data storage is on Google Cloud servers located within the European Union. However, some of our processors may process data outside the EEA:

• Stripe — headquartered in the United States. Transfers are governed by Stripe's Data Processing Agreement, which incorporates the European Commission's Standard Contractual Clauses (SCCs).
• Google Cloud — while our Firestore and Storage resources are configured for European regions, certain ancillary Google services (such as Firebase Authentication) may involve processing in the United States. Google's Data Processing Terms include SCCs for international transfers.
• Mailtrap (Railsware) — email delivery infrastructure may involve servers outside the EEA. Transfers are covered by their Data Processing Agreement and SCCs where applicable.
• Zoho — support ticket data may be processed in Zoho's data centres in the EU and/or US. Zoho's Data Processing Addendum includes SCCs.

In all cases, we ensure that adequate safeguards are in place before any personal data leaves the EEA, in accordance with Chapter V of the GDPR (Articles 44–49).

7. Your Rights Under Data Protection Law

If you are located in the EEA, the United Kingdom, or any jurisdiction that provides equivalent rights, you have the following rights regarding your personal data:

We will respond to all data subject requests within 30 calendar days of receipt. If a request is complex or we receive a high volume of requests, we may extend this period by a further 60 days, in which case we will notify you within the initial 30-day period.

All requests are fulfilled free of charge unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request in accordance with Article 12(5).

8. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. For the United Kingdom:

If you are located in an EU member state, you may also contact your local data protection authority. A full list is available at edpb.europa.eu.

We would appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact us at [email protected] first.

9. Account Deletion

You may permanently delete your account at any time through either of the following methods:

• In the app — Settings > User Details > Delete Account
• On the web — trueinvoice.co/delete-account
• By email — contact [email protected] and we will process your request within 30 days

Both the in-app and web deletion methods require you to re-authenticate your identity before proceeding. Account deletion is irreversible and results in the following actions:

1. Firestore data — all data under your user record is recursively deleted, including all invoices, estimates, expenses, contacts, recurring schedules, reports, and business profile.
2. Firebase Storage — all files associated with your account are deleted, including uploaded logos, signatures, and receipt images.
3. Firebase Authentication — your authentication record is permanently removed.
4. Stripe Connect — if you connected a Stripe account, the OAuth authorisation between Trueinvoice and your Stripe account is revoked. Your Stripe account itself is not deleted (it is owned and managed by you directly with Stripe).

After deletion, we do not retain any of your personal data except where required by law (see Section 10). Emails previously sent to your clients via the service are not retrievable by us and cannot be recalled.

10. Data Retention

• Active accounts — we retain your data for as long as your account remains active and you continue to use the Service.
• Inactive accounts — if your account shows no activity for 11 consecutive months, we will send you a warning email. If there is still no activity after 12 months, we reserve the right to permanently delete your account and all associated data.
• Post-deletion retention — following account deletion (whether initiated by you or due to inactivity), we may retain certain anonymised, aggregated data that can no longer identify you (e.g., aggregate usage statistics). We do not retain identifiable personal data after deletion, except where retention is required by applicable tax, legal, or regulatory obligations, in which case we retain only the minimum data necessary and only for the duration required by law.
• Backup systems — residual copies in encrypted, automated backups may persist for up to 30 days after deletion before being overwritten. These backups are not used for any purpose other than disaster recovery and are not accessible in the ordinary course of business.
• JWT tokens — payment link tokens expire after 30 days. Invoice share link tokens expire after 365 days. Expired tokens cannot be used to access data.

11. Third-Party Contact Data (Your Clients)

When you use Trueinvoice, you enter personal data about your own clients (their name, email, phone, and address) in order to create invoices and estimates. In this context:

• You are the data controller for your clients' personal data. You are responsible for ensuring you have an appropriate legal basis to share their data with us and to send them transactional emails via the Service.
• Anodelabs is the data processor acting on your instructions. We process your clients' data solely to provide the Service to you (generating invoices, delivering emails, processing payments).

Automated reminder emails may be sent to your clients based on schedules you configure. The legal basis for these emails is your legitimate interest in collecting payment for goods or services rendered — this is standard practice for B2B invoicing.

All emails sent through the Service on your behalf include a footer linking to this Privacy Policy so that your clients can understand how their data is processed.

12. Security Measures

We implement appropriate technical and organisational measures to protect your personal data in accordance with Article 32 of the GDPR:

No system is 100% secure. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours in accordance with Article 33, and we will notify affected individuals without undue delay in accordance with Article 34 where the breach is likely to result in a high risk.

13. Cookies and Tracking

Trueinvoice does not use cookies for tracking, analytics, or advertising purposes. We do not use any third-party analytics SDKs (such as Google Analytics, Mixpanel, or Amplitude) in our mobile app or website. We do not serve targeted advertisements. We do not build behavioural profiles.

The only cookies or local storage used are those strictly necessary for authentication session management (e.g., Firebase Authentication tokens), which are exempt from consent requirements under the ePrivacy Directive.

14. Children's Privacy

The Service is not directed to individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without valid parental consent, we will take immediate steps to delete that data. If you believe a child has provided us with personal information, please contact us at [email protected].

15. Zero Data Sale Policy

We do not sell, rent, lease, or trade your personal data or your clients' personal data to any third party, for any purpose, under any circumstances. This applies to all categories of data listed in this policy.

For users protected by the California Consumer Privacy Act (CCPA): we confirm that we do not sell personal information as defined under the CCPA and have not done so in the preceding 12 months.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

• Material changes (new data categories, new processors, changes to legal basis) will be communicated to you via email or an in-app notification at least 14 days before they take effect.
• Non-material changes (clarifications, formatting) will be reflected by updating the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

17. Data Protection for Specific Jurisdictions

17.1 European Economic Area and United Kingdom

This policy has been drafted to comply with the EU General Data Protection Regulation (Regulation 2016/679) and the UK GDPR (as incorporated by the Data Protection Act 2018). All rights described in Section 7 are available to EEA and UK residents.

17.2 California (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know — you may request the categories and specific pieces of personal information we have collected.
• Right to delete — you may request deletion of your personal information (see Section 9).
• Right to opt-out of sale — we do not sell personal information (see Section 15).
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact [email protected].

17.3 Other Jurisdictions

If you are located in a jurisdiction with data protection laws that provide rights beyond those listed here, we will honour those rights to the extent required by applicable law. Contact us and we will work with you to address your request.

18. Contact Us

For any questions about this Privacy Policy, to exercise your data rights, or to raise a concern about how we handle your data: