Privacy Policy
Invoiceee, operated by PortraitXAI LLP
This Privacy Policy explains how PortraitXAI LLP (“we”) collects, uses, stores, and protects your personal data when you use Invoiceee, in accordance with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). For the purposes of the DPDP Act, PortraitXAI LLP is the Data Fiduciary.
1. Information We Collect
We collect only what is needed to run the Service:
- Account data — your email address and authentication credentials.
- Business & invoice data — your business profile (name, address, GSTIN, and any bank/UPI details you choose to add), your clients’ details, items/services, invoices, expenses, and related records you create.
- Payment data — when you subscribe, payment is processed by Razorpay. We receive limited transaction and subscription-status information; we do not store your full card or bank account numbers.
- Technical data — basic usage and device information needed to operate and secure the Service.
2. How We Use Your Data
We use your data to:
- provide, maintain, and sync the Service across your devices;
- process subscriptions and payments;
- send you service, security, and support communications;
- improve and secure the Service; and
- comply with applicable legal, tax, and accounting obligations.
3. Consent & Legal Basis
We process your personal data based on the consent you provide when you create an account and use the Service, and for other lawful uses permitted under the DPDP Act. You may withdraw your consent at any time (see Your Rights), though some features may stop working as a result.
4. Where Your Data Is Stored
Your account and business data are stored in our cloud database hosted on Supabase, a third-party infrastructure provider, and may be processed on servers operated by Supabase and its sub-processors. We take reasonable measures to ensure appropriate safeguards are in place.
5. Third Parties & Processors
We share data only with service providers who help us operate the Service:
- Supabase — database, authentication, and hosting (acts as a Data Processor).
- Razorpay — payment processing for subscriptions, governed by Razorpay’s own privacy policy.
We do not sell your personal data.
6. Your Rights Under the DPDP Act
Subject to the DPDP Act, you have the right to:
- access a summary of the personal data we process about you;
- request correction or updating of inaccurate or incomplete data;
- request erasure of your personal data;
- raise a grievance and seek redressal; and
- nominate another individual to exercise your rights in the event of death or incapacity.
To exercise any of these rights, contact us using the details below.
7. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service and meet legal, tax, and accounting obligations. You may request deletion of your account and associated data, subject to any retention required by law.
8. Security
We use reasonable, industry-standard measures — including encrypted connections and row-level access controls — to protect your data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Children
The Service is not intended for individuals under 18 years of age, and we do not knowingly collect personal data from children.
10. Grievance Officer & Contact
If you have any questions or grievances about how your personal data is handled, please contact our Grievance Officer at the address below. We will acknowledge and respond in accordance with the DPDP Act.
11. Changes to This Policy
We may update this Policy from time to time. We will reflect the revision in-app and, where required by law, seek your fresh consent.