Privacy Policy
Last updated 4 November 2026
This Privacy Policy explains what personal data we collect when you use Free Invoice Automation (the website freeinvoiceautomation.com and its subdomains, the web app, API, MCP server, CLI, apps, plugins and connectors, together the “Service”), why we collect it, how long we keep it, who we share it with, and the rights you have.
The short version: we collect only what we need to run the Service, we store your data in the European Union, we never sell it, we show no ads, and we never use your data to train AI models.
1. Who we are
The Service is run by Genyune (SMC-Private) Limited, Plot # B-54, 13B, Block 1, Gulistan-e-Johar, Karachi 75290, Pakistan. For payments for paid plans, extra members, credit packs and donations, Genyune Inc., a company registered in Wyoming, United States, is the seller and receives the billing data needed for those payments.
EU representative. Because we are based outside the European Union, we have appointed a representative in the EU under Article 27 of the GDPR. To contact our EU representative, email [email protected] and we will give you their details.
For any privacy question or request, email [email protected].
2. Our role: controller and processor
- We are the controller for the data of people who visit our website and of account holders and their members: account, billing, support and usage data.
- We are a processor for the data that businesses enter about their own clients, for example client names, emails, addresses and invoice details. The business is the controller of that data and decides why it is used. Our Terms of Service set out how we process it for them.
3. Data we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, password (stored only as a secure hash), passkeys, two-factor settings, language and time zone | You |
| Sign-in providers | Name, email and profile picture from Google or Apple, if you sign in with them | That provider, with your permission |
| Business | Business name, address, tax numbers, logo, bank and payment details shown on documents | You |
| Documents and clients | Invoices, estimates, items, client names, emails and addresses, files you upload, signatures | You or your members |
| Connected services | Orders, customers and payment events from stores, payment providers and accounting apps you connect | Those services, when you connect them |
| Billing | Plan, payment history, billing country, tax number, card brand and last 4 digits (never the full card number) | You and Stripe |
| Donations | Amount, name and email given at checkout | You and Stripe |
| Sponsors | Company name, logo, website, and the name and email of the contact person | The sponsor |
| Usage and device | IP address, browser and device type, pages and features used, error reports, security and audit logs | Your device |
| Emails | Delivery, bounce and open status of emails we send for you or to you | Our email provider |
| AI agent | Text and files you give the agent, and its replies | You |
| Support and feedback | Messages you send us and our replies | You |
| Launch and product news | Your email if you ask to be notified, for example about a coming feature | You |
We do not ask for special categories of personal data, such as health or religious data, and ask you not to put them into the Service unless you need to.
4. Using the generator without an account
If you use the free invoice generator without an account, your drafts are saved only in your own browser (in its local storage). We do not receive them. When you create an account, the drafts are copied to your account once, and from then on they are stored on our servers like your other documents.
5. How we use data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Service: create documents, send emails, take payments, sync connected services | Contract |
| Bill paid plans, extra members, credit packs, sponsorships and donations; keep tax and accounting records | Contract and legal obligation |
| Show sponsors' names, logos and links on our website for the paid month | Contract |
| Keep the Service and accounts secure; prevent fraud, spam and abuse | Legitimate interests |
| Record e-signatures and estimate acceptance as evidence | Contract and legitimate interests |
| Answer support requests and feedback | Contract and legitimate interests |
| Improve the Service with anonymous or aggregated usage statistics | Legitimate interests |
| Analytics cookies on our marketing website | Consent (you can say no) |
| Service and account emails, such as receipts, security alerts and changes to our terms | Contract and legal obligation |
| Launch notifications and product news | Consent, or legitimate interests for existing users; you can unsubscribe at any time |
| Meet legal duties and answer lawful requests from authorities | Legal obligation |
6. AI features
- When you use the AI agent or other AI features, the text, files and document data needed for the task are sent to our AI provider to produce the result.
- Our AI provider processes this data only to answer your request, under terms that do not allow it to train its models on your data. We do not use your data to train AI models either.
- If you connect your own AI provider key, your data goes to that provider under your own agreement with it.
- The AI agent does not make decisions with legal or similarly significant effects about you. It prepares drafts and acts only when you or your settings tell it to.
7. Who we share data with
We never sell your personal data and we do not share it for advertising. We share it only with service providers that help us run the Service, under contracts that require them to protect it and use it only for us:
| Provider | What for | Location |
|---|---|---|
| Our hosting provider | Servers and databases | European Union |
| Cloudflare | File storage (logos, PDFs, receipts) and encrypted backups | European Union |
| Amazon Web Services (SES) | Sending emails | European Union |
| Hostinger | Our own mailboxes, such as support email | European Union |
| Sentry | Error monitoring (personal data removed where possible) | European Union |
| Stripe | Payments for paid plans, credit packs and donations; fraud checks | United States and worldwide |
| Anthropic | Running the AI agent | United States |
| Google Analytics | Website statistics, only if you accept analytics cookies | United States and worldwide |
| Genyune Inc. | Selling paid plans and taking payments (our group company) | United States |
We also share data:
- with services you choose to connect, such as a payment provider, online store, accounting app or AI assistant;
- with the members of your account, who can see the account's data and, on paid plans, the audit history of who did what;
- with your clients, when you send them documents, pay pages or portal links;
- when the law requires it, or to protect the rights, safety and security of our users, clients and the Service;
- with a buyer if our business is sold or merged, in which case this policy continues to protect your data.
If we add or replace a service provider that handles personal data, we update this list before it starts.
8. Where your data is stored and transfers
Your data, files and backups are stored in the European Union. Data can still be accessed from, or sent to, other countries in these cases:
- some providers listed above are in the United States or other countries;
- billing data is shared with Genyune Inc. in the United States;
- our team, based in Pakistan, can access data where needed to run and support the Service.
When data goes outside the European Economic Area or the UK, we use safeguards recognised by the law, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, with extra security measures such as encryption and strict access control. You can ask us for a copy of these safeguards at [email protected].
9. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account is open |
| After you delete your account | Removed from our live systems within 30 days; copies in encrypted backups are deleted as the backups expire, within about 12 months |
| Documents and client data | Until you or your business delete them, or close the account |
| Signed contracts and acceptance records | As long as the business keeps the document, as evidence of the agreement |
| Billing and tax records | As long as tax law requires, usually up to 10 years |
| Security and audit logs | Up to 12 months, longer if needed to investigate abuse |
| Email and message delivery logs | Up to 12 months |
| Text and files you give the AI agent | Up to 90 days; documents it creates stay with your other documents |
| Events received from payment providers and stores | Up to 90 days (the payments they record stay with your documents) |
| Data export files | 7 days after they are created |
| Support emails | Up to 3 years after the conversation ends |
| Launch and news sign-ups | Until you unsubscribe, or until the related feature launches |
| Analytics data (with consent) | Up to 14 months in Google Analytics |
10. Your rights
Depending on where you live, you have the right to:
- be told how we use your data (this policy);
- get a copy of your personal data, and receive it in a portable format;
- correct data that is wrong or incomplete;
- ask us to delete your data;
- restrict or object to how we use it, including at any time to direct marketing;
- withdraw your consent at any time, where we rely on consent, without affecting what was done before;
- complain to the data protection authority where you live or work, or where you think the law was broken.
You can export and delete your data yourself in Settings, or email [email protected]. We answer requests within one month, which may be extended by two more months for complex requests (we will tell you if so). We may ask you to confirm your identity first. Exercising your rights is free, unless a request is clearly unfounded or excessive.
If you are a client of a business that uses the Service
For data a business holds about you, that business is responsible for answering your request. Please contact the business first. If you contact us, we will pass your request to them and help them answer it.
Residents of the United States
We do not sell or share personal information for targeted advertising, and we do not use or disclose sensitive personal information beyond what is needed to provide the Service. Depending on your state, you may have the right to know, access, correct, delete and get a copy of your personal information, and to appeal our answer. We will not treat you differently for using these rights. To use them, email [email protected]. We treat a browser's Global Privacy Control signal as a request to opt out of analytics cookies.
11. Security
We protect data with encryption in transit, encryption of secrets at rest, strict separation of each account's data, access limited to the people who need it, optional two-factor authentication and passkeys, audit logs, and daily encrypted backups that we test by restoring them every week.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell the authorities within 72 hours where the law requires, and tell you without undue delay. Where we act for a business, we tell the business so it can inform its clients.
12. Pay pages, portal and client emails
When a business sends you a document through the Service, you may open a pay page, the client portal or a document link, or sign in to the portal with a link sent to your email. These pages and client emails have no ads, no advertising trackers and no analytics. We use only what is needed to show the document, take the payment, record your acceptance or signature, and keep the page secure, for example your IP address and browser for security and as evidence of a signature.
13. Emails from us
We send service emails that you cannot turn off while you have an account, such as receipts, security alerts and important changes. Product news and launch notifications are optional: every such email has an unsubscribe link, and you can also email [email protected].
14. Children
The Service is not meant for anyone under 16. We do not knowingly collect data from children. If you think a child has given us data, email [email protected] and we will delete it.
15. Cookies
We use cookies and similar technologies that are needed for the Service to work, and analytics cookies on our marketing website only if you accept them. See our Cookie Policy.
16. Other websites and services
The Service links to, and can connect with, websites and services run by others, such as payment providers, stores and AI assistants. Their own privacy policies apply to the data they collect. Please read them.
17. Changes to this policy
We may update this policy. The date at the top shows the last update. For important changes we will email account Owners before they take effect.
18. Contact and complaints
Email [email protected], or write to Genyune (SMC-Private) Limited, Plot # B-54, 13B, Block 1, Gulistan-e-Johar, Karachi 75290, Pakistan. If you are in the EU, you can also ask us at the same address for the contact details of our EU representative.
If you are not happy with our answer, you can complain to your local data protection authority. We would appreciate the chance to help first.