Privacy policy

Invora is an invoicing application operated by The Darkul Company. It lets you keep several billing entities, store client profiles, and create, send and track invoices and proposals. For the data you enter into your account, Invora acts as the data controller. For the details you record about your own clients, you are the controller and Invora processes that information on your behalf.

Only what the service needs in order to work:

• Account details. Your email address and a securely hashed password, held by our authentication provider. We never see or store your password in readable form. If you verify your email or reset your password, we store the time that happened.
• Business profile. The company names, postal addresses, tax or VAT identifiers, logos, currencies, invoice numbering series and payment details you choose to add.
• Client records. The names, email addresses, billing addresses, payment terms and discounts you record for the people you invoice.
• Documents. Invoices, proposals, line items, taxes, discounts, notes, recorded payments and their history.
• Delivery data. When you email a document, the recipient address, the send time and whether the send succeeded or failed.
• Technical data. Server and security logs generated when you use the site, which may include IP address, browser user agent, requested page and timestamp. These are used to keep the service running and to investigate abuse.
• Google account data. Only if you choose to connect Google Drive — see section 4.

We do not run advertising networks, third-party analytics or tracking pixels, and we do not build behavioural profiles of you.

Your data is used to:

• create your account, sign you in and keep your session active;
• render, number, total and store the invoices and proposals you create;
• generate PDF documents on our server and deliver them to the recipients you nominate;
• send transactional email you have asked for, such as document delivery, payment reminders, email verification and password resets;
• show you totals, outstanding balances and other figures on your dashboard;
• keep the service secure, diagnose faults, prevent abuse and meet legal obligations.

We do not sell your data. We do not share it for advertising. We do not use it to train machine learning or artificial intelligence models.

Invora offers an optional Google Drive connection so that your invoice and proposal documents can be written to, and read back from, your own Drive. This connection is entirely optional and is never enabled unless you start it yourself and grant permission on Google's own consent screen.

When you connect Drive, Invora accesses the files in your Google Drive on your behalf, using the access token Google issues to us. In practice that means we can read the files you point us at and write the documents you ask us to save. We request the narrowest scopes that allow this and nothing more.

We do not store the contents of your Google Drive files on our servers, and we do not transmit your Google Drive data to any third party.

Specifically, for data obtained through Google APIs:

• file contents are held only transiently in memory or in temporary storage for as long as it takes to complete the transfer you requested, then discarded;
• we do not copy your Drive files into our database, and we do not retain them after the operation finishes;
• we never sell Google user data, and we never pass it to advertisers, data brokers, resellers or any other third party;
• we do not use Google user data for advertising, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models;
• no human reads your Google user data, except where you have given explicit permission for a specific support request, where it is necessary for security purposes such as investigating a suspected breach, or where we are compelled to by law.

The access and refresh tokens Google issues are stored encrypted and are used only to carry out actions you have initiated. Invora's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect at any time from within Invora, or revoke our access directly at myaccount.google.com/permissions. Revoking access stops all further Drive access immediately, and we delete the stored tokens. Files already in your Drive stay in your Drive; they are yours and we do not touch them afterwards.

Application data is held in a managed PostgreSQL database provided by Supabase, and the application itself runs on Vercel. Both providers encrypt data in transit using TLS and at rest using disk-level encryption. Traffic to invora.darkul.com is served over HTTPS only.

Access to your rows is enforced in the database itself through row-level security policies, so one account cannot read another account's companies, clients, invoices or proposals. Session cookies are HTTP-only, so page scripts cannot read them. Administrative access to the production database is limited to the operator of the service and is used only for maintenance, backup and fault diagnosis.

Data may be stored and processed on servers outside your country, including in the United States and the European Union, because our hosting providers operate globally. Where data leaves your region, our providers rely on standard contractual clauses or equivalent safeguards.

No online service can promise perfect security. We take reasonable technical and organisational measures, but we cannot guarantee absolute security, and you share information with us on that understanding.

We share data only with the small number of processors needed to run the service, and only for that purpose:

• Supabase — database hosting, authentication and file storage for the data you enter.
• Vercel — application hosting, request routing and server logs.
• Resend — delivery of the transactional email you send, which necessarily includes the recipient address and the document attached.
• Google — only if you connect Drive, and only as the source and destination of your own files. Your Drive data is not passed onward to anyone else.

Beyond these, we disclose data only where the law requires it, such as a valid court order, or where it is necessary to establish, exercise or defend a legal claim. If the service is ever transferred to another operator, you will be told before your data moves.

Invora sets only the cookies needed to keep you signed in and to protect the sign-in process. There are no advertising cookies and no third-party analytics cookies. Clearing these cookies signs you out.

Your account data and documents are kept for as long as your account is open, because invoicing records are typically needed for years for tax and accounting purposes. Deleted items are removed from the live database immediately and disappear from encrypted backups within 30 days as those backups roll over. Server logs are kept for a short operational period and then discarded. Google Drive tokens are deleted as soon as you disconnect.

There are two ways to have your data removed:

• Delete it yourself. Signed in, you can delete individual clients, companies, invoices and proposals from within the app. Deletion is immediate and permanent.
• Ask for full account deletion. Email darkulwork@gmail.com from the address on your account, asking for deletion. We will verify the request, erase your account and all associated companies, clients, invoices, proposals, payments, uploaded logos and Google tokens, and confirm when it is done — normally within 30 days.

Deletion is irreversible, so export anything you need first. We may retain a minimal record of the deletion request itself, and any data we are legally required to keep, for as long as the law requires.

Depending on where you live, you may have the right to access a copy of your data, correct it, export it in a portable format, restrict or object to processing, or have it erased. You can exercise all of these by writing to darkulwork@gmail.com. We answer within 30 days and we do not charge for it. If you think we have handled your data badly, you may complain to your local data protection authority.

Invora is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.

We may update this policy as the service changes. The date at the top always reflects the current version. If a change materially affects how your data is handled, we will tell account holders by email before it takes effect.

Questions, deletion requests and privacy complaints all go to darkulwork@gmail.com, operated by The Darkul Company. You can also read our terms of service.