Privacy Policy

Effective date: [to be set on finalization]

This policy explains what [Legal entity] collects when you use InvoxAI, and why.

What we collect

• Account data — name, email, organization, role.
• Invoice data — the documents you submit and the fields extracted from them (vendor, amounts, dates, line items).
• Usage data — logs and audit events needed to operate and secure the service.

Why we use it

To provide the service (extraction, approval, sync), to secure it, to bill you, and to support you. We do not sell your data.

Legal bases

We process data to perform our contract with you, for our legitimate interests in operating and securing the service, and to comply with law.

Sub-processors

We use vetted third parties to run the service — see our sub-processors list. AI extraction is performed by Anthropic; your invoice content is sent to Anthropic only to extract fields.

Retention

We keep your data while your account is active and as needed for legal and audit purposes. The audit trail is append-only by design.

Security

Deny-by-default row-level security isolates each organization; secrets and OAuth tokens are encrypted at rest; MFA is available; access is over HTTPS with a strict content-security policy.

Your rights

Subject to applicable law, you may request access, correction, export, or deletion of your data by emailing invoxaisupport@gmail.com.

Contact

[Legal entity], [Company address]. Data questions: invoxaisupport@gmail.com.