invoxi

Privacy policy

What personal data invoxi collects, how we use it, who we share it with, how long we keep it, and your rights.

In force from 16 October 2026. This is a translation; the Latvian version prevails. The Latvian and Russian versions are on the same page, in the language switch.

1. Controller

SIA Balt Bee Group, reg. No. 40203791123, Anniņmuižas bulvāris 41-175, Rīga, LV-1067, Latvija, support@invoxi.io. Write to this address about anything in this policy.

We are the controller for the data of people who use invoxi (their account, sign-in and use of the service) and of visitors to the website. For the data you enter about your clients and in your invoices we act as your processor: you are the controller, and the data processing agreement applies.

2. What data we collect

• Account: name, e-mail address and Google account identifier from Google sign-in; your language and the name you set.
• Company details you enter: legal name, registration and VAT numbers, address, bank account, contacts, logo; for a private person also the personal code, which we store encrypted.
• Your work in invoxi: clients and their contacts, invoices, credit notes, recurring invoices, payments, reminders, e-mails sent and their delivery status, bank statements you upload, and when your clients open an invoice link.
• Assistant: the messages and files you send and its answers.
• Messages you send us through “Write to us” or by e-mail.
• Technical data: IP address, browser and request logs, needed to run and protect the service.
• On the website, with your consent only: Google Analytics statistics.

We also use public sources: the Latvian Register of Enterprises and the EU VIES service, to fill in and check company and VAT numbers.

3. Data from your Google account

invoxi uses Google only to sign you in. This is how invoxi accesses, uses, stores, shares and deletes Google user data:

• Access: only the openid, email and profile scopes, that is your name, e-mail address, Google account identifier and language. invoxi does not request and cannot read your Gmail, contacts, calendar, Drive or any other Google data.
• Use: to create your account, recognise you when you sign in, show your name in the app and send you e-mails about your account and your invoices. Nothing else.
• Storage: in our database in the European Union; it travels only over encrypted connections.
• Sharing: hosting and e-mail providers process the Google account data needed to store your account, deliver service e-mails and handle support requests, as described in section 5. For example, our e-mail provider receives your e-mail address to deliver a welcome message or a reply to your question. We do not sell or rent Google user data, use it for advertising or use it to train AI models.
• Retention and deletion: kept while your account exists; when you delete your account in Settings it is deleted at once, and from backups within 30 days. You can also remove invoxi’s access at any time at https://myaccount.google.com/permissions.

invoxi’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).

4. How we use your data and on what basis

• To provide the service you signed up for (GDPR Art. 6(1)(b)).
• To keep it secure, fix faults and prevent abuse (legitimate interest, Art. 6(1)(f)).
• To answer your messages and tell you about important changes (Art. 6(1)(b) and (f)).
• To meet legal obligations, for example requests of authorities (Art. 6(1)(c)).
• Website analytics only with your consent (Art. 6(1)(a)); you can change your choice in “Cookie settings” at any time.

We do not sell personal data, do not use it for advertising, and the assistant’s suggestions are not automated decisions about you within the meaning of GDPR Art. 22.

5. Who we share data with

We share personal data only with carefully chosen processors that work for us under data processing agreements, and never sell it:

• hosting of the application and the database in the European Union;
• Amazon Web Services: website delivery and sending of e-mails, in the European Union;
• Google: sign-in with Google, and Google Analytics only with your consent;
• Anthropic (USA): the AI assistant, the first answers in the support chat and reading of uploaded documents. Anthropic does not use the data to train models;
• an e-mail forwarding service for messages to our support address;
• Telegram (United Arab Emirates): when you call a person in the support chat, your name, e-mail, company and that chat are shown to our support people in our closed Telegram group so they can answer you; the group’s topic is deleted together with your company or account.

The full list of processors with their locations is available to customers on request at support@invoxi.io.

When data goes outside the European Economic Area (Anthropic and Google in the USA), it is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Telegram processes the support chats you hand to a person under its own terms; if you do not want that, write to us by e-mail instead.

6. How long we keep data

• Account and company data: while the account or company exists; deleting it in Settings deletes the data at once.
• Request logs: up to 30 days.
• Messages to support: as long as needed to answer, at most 2 years.
• Copies in backups: removed as backups rotate, within 30 days.
• Data we must keep by law or for a pending dispute: as long as required.

Accounting law may require you to keep invoices for years: that obligation is yours as their controller, so keep your own copies.

7. Cookies and similar storage

• invoxi_session: keeps you signed in (necessary; ends after 8 hours without activity or when you sign out).
• invoxi_lang: the language the site is shown in (functional, 1 year).
• Browser storage for your choices, such as language, drafts and the analytics choice (functional, stays on your device).
• Google Analytics cookies (_ga): only after you agree; never on invoice links sent to your clients.

8. Your rights

You can ask for access to your data, a copy, correction, deletion, restriction, portability, and object to processing based on legitimate interest; withdraw consent at any time. Write to support@invoxi.io; we answer within one month. Much of it you can do yourself in Settings.

If you think we process your data unlawfully, you can complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv).

If you are a client of an invoxi user and your data is in their invoice, write first to the business that invoiced you: they are the controller. We will help them answer.

9. Security

Data travels encrypted (TLS), personal codes are stored encrypted, access is limited to what each role needs, and sign-in goes through Google. If a breach puts your data at risk, we tell you and the authority as the law requires.

10. Changes

We publish changes here and tell registered users about material ones by e-mail.