Privacy.

1.The short version

The sections below fill in the detail.

2.Two roles: controller and processor

Invoice Toro handles two different kinds of information, and our responsibility differs for each:

• Your account data — the email, name, and settings tied to you as the account holder. For this, we are the data controller.
• The content you create — the clients, invoices, amounts, and payment records you enter about your business and your customers. Here you are the controller and we act as your processor, handling that information on your behalf and on your instructions.

Because your invoices contain personal information about your clients, you are responsible for having a lawful basis to store it and for giving your clients any privacy notice they're owed. We help you meet those obligations, but we can't do it for you.

3.Information we collect

Account information

Your email address, display name, and password. Authentication is handled by Google Firebase Authentication; passwords are stored by Firebase in hashed form, and we never see or store your plaintext password. If you sign in with Apple or Google, we receive your name and email (or Apple's private relay address) from that provider.

Business profile

Your business name, address, contact email and phone, logo image, tax settings, currency, and locale.

Content you create

Clients (names, email addresses, mailing addresses, notes), invoices, estimates, credit memos, purchase orders and their line items and amounts, payments you record, custom fields, and saved catalog items.

Email delivery data

When you send a document or reminder from the app, we process the recipient's email address, the subject and message, the generated PDF, and the resulting delivery status (delivered, bounced, or marked as spam) so we can show you whether it arrived.

Photos

If you add a logo, the app accesses the single image you pick through your device's photo picker. We don't browse or upload your photo library — only the image you choose.

Device & diagnostic data

To keep the app stable we collect crash reports and basic diagnostics (via Firebase Crashlytics) — things like app version, device model, and operating system. If you enable notifications, we store a push token (via Firebase Cloud Messaging) so we can deliver them.

Subscription status

Purchases are processed by the Apple App Store or Google Play. We receive your subscription status from them — not your card number or payment details.

Support correspondence

If you email us, we keep your message and contact details so we can help and follow up.

4.What we never do

• We don't sell or rent your personal information, or your clients', to anyone.
• We don't show ads or embed advertising or cross-app tracking SDKs.
• We don't access your location, contacts, or photo library beyond the logo image you pick.
• We don't use your invoice content to build advertising profiles.

5.How we use information

• Run the app — create, store, sync, and render your documents, and compute their totals on your device.
• Send what you send — deliver the invoices, estimates, and reminders you choose to email, on your behalf, and report their delivery status back to you.
• Team access — verify membership and enforce roles so the right people see the right documents.
• Support & account management — answer questions, manage your subscription, and reach you about your account.
• Keep it working and safe — diagnose crashes, prevent abuse and fraud, and secure accounts.
• AI drafting (coming soon) — if you use a "Draft with AI" feature, the description you provide is sent to Google's Gemini API to suggest line items. This is opt-in each time you use it; every number stays yours to change.
• Legal — comply with the law and enforce our Terms.

6.Legal bases (EEA/UK)

If you're in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR:

• Performance of a contract — to create your account and provide the service you signed up for.
• Legitimate interests — to secure the service, prevent abuse, diagnose problems, and improve the product, balanced against your rights.
• Consent — for optional things like push notifications and AI features, which you can withdraw at any time.
• Legal obligation — where the law requires us to keep or disclose certain records.

For the client information inside your documents, your instructions as controller are the basis on which we process it.

7.Who we share with

We share data only with the service providers we rely on to run Invoice Toro (our "sub-processors"), each bound by their own security and privacy terms, and only what each needs to do its job:

We may also disclose information if the law requires it, to enforce our Terms, or to protect the rights, property, or safety of our users or the public. If Invoice Toro is ever involved in a merger, acquisition, or sale of assets, your data may transfer as part of that deal — we'll notify you and this policy will continue to govern it.

8.Where your data lives

Invoice Toro runs on Google Cloud (Firebase) infrastructure, with data stored primarily in the United States. If you use the app from the EEA, the UK, or elsewhere, your information may be transferred to and processed in the United States and other countries. Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses and our providers' data-transfer frameworks.

9.How long we keep it

We keep your data for as long as your account is active. When you delete a document or a client in the app, it's removed from our live database. When you close your account, we delete your account and business data within 30 days, except where we must retain certain records to meet a legal obligation (for example, tax or fraud-prevention) or where copies persist in routine backups that expire on a rolling schedule. Email delivery logs are kept for a limited period to support deliverability and resolve disputes.

10.Security

We protect your data with encryption in transit (TLS) and at rest through Google Cloud, authentication managed by Firebase, and role-based access enforced by server-side security rules rather than the honor system. We never store your password in readable form. No method of transmission or storage is perfectly secure, but we work hard to safeguard your information — and if a breach ever affects you, we'll notify you as required by law.

11.Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with your local data-protection authority. You will not be discriminated against for exercising these rights.

Many of these you can exercise yourself: edit or delete your content directly in the app, export any document as a PDF, and delete your account from Settings — see our step-by-step account deletion guide. For anything else — or to reach a person — email support@invoicetoro.com.

California residents (CCPA/CPRA)

You have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its "sale" or "sharing." We do not sell or share personal information, so there is nothing to opt out of. The categories we collect and our purposes are described above.

Requests about client data

If someone whose information you entered as a client asks us to access or delete their data, we'll refer them to you as the controller and help you respond, since that data belongs to your account.

12.Children

Invoice Toro is a business tool and is not directed to children. We don't knowingly collect personal information from anyone under 16 (or the age of digital consent where you live). If you believe a child has given us information, contact us and we'll delete it.

13.Changes to this policy

We may update this policy as the app evolves or the law changes. When we do, we'll revise the "Last updated" date at the top, and for material changes we'll give notice in the app or by email. Continuing to use Invoice Toro after an update means you accept the revised policy.

14.Contact us

Questions about this policy or your data? Email support@invoicetoro.com.

Invoice Toro is operated by Twan Software LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA.