Privacy Policy

Effective date: July 2026

NeatInvoice is built local-first: you can create invoices without an account, and you choose when to sign in for cloud sync and workspace features. This policy describes what we collect, why, and how we protect it.

1. Information we collect

Guest use (no account):Invoice drafts and library data are stored in your browser's local storage on your device. We do not receive that content unless you sign in and sync, or unless you voluntarily contact us.

Account holders: When you create an account we collect authentication data (such as your email address and, if you use it, OAuth profile identifiers from Google or GitHub). Your invoice templates, clients, items, business workspace settings, billing and trial metadata, in-app notifications, and related account data are stored in our database (Supabase Postgres) to provide sync and workspace features.

Published invoices: If you turn on a live link, anyone with the URL can view the invoice fields you published (for example client name, line items, and payment details). View counts may be recorded for your account.

Email delivery: When you send invoice email through the Service, or when we send trial or transactional messages related to your account, we process recipient addresses, message content, and delivery status through our email provider (Resend). Operational logs use hashed recipient identifiers where possible rather than storing raw addresses in long-term ops tables.

Payments: If you subscribe to a paid plan, billing is handled by Polar.sh. We store subscription status and customer references needed to enable workspace features; payment card details are processed by Polar, not stored on our servers.

Uploaded files: Logos and signature images you upload are stored in Supabase Storage associated with your account.

Contact form: If you write to us, we receive the name, email, subject, and message you submit, plus basic technical metadata needed to deliver and protect the form (such as rate limiting).

2. How we use information

We use collected information to:

• Provide, maintain, and improve the Service
• Authenticate you and sync data across devices
• Run in-app free trials and paid subscriptions
• Deliver invoice emails and automated reminders you configure
• Run recurring invoice schedules on eligible accounts
• Show in-app notifications and workspace activity
• Process subscriptions and enforce plan limits
• Respond to support requests and protect against abuse

We do not sell your personal information to third parties for their marketing.

3. Legal bases (EEA / UK)

Where GDPR applies, we process data on grounds including contract performance (providing the Service you request), legitimate interests (security, abuse prevention, product improvement), and consent where required (for example optional analytics, if enabled).

4. Cookies and similar technologies

Signed-in sessions use essential cookies managed by Supabase Auth. We store theme and workspace preferences locally in your browser. In production, we may load privacy-conscious analytics scripts only when configured. Guest generator use does not rely on marketing analytics cookies by default.

5. Third-party processors

We rely on trusted providers to operate the Service, including:

• Supabase — authentication, database, and file storage
• Resend — transactional email delivery and delivery webhooks
• Polar.sh — subscription checkout and customer billing portal
• Hosting provider (e.g. Vercel) — application delivery
• Sentry — error monitoring and performance diagnostics for the application (user id may be attached; invoice content is scrubbed by design)

Each provider processes data under its own terms and privacy policy. We configure access so your database rows are scoped to your account via row-level security where applicable.

6. Security

We use technical measures including HTTPS, row-level security on user data, webhook signature verification, and least-privilege service credentials. No online service is completely secure; you are responsible for protecting your account credentials and reviewing published invoice links before sharing them.

7. Retention and deletion

Guest data remains on your device until you clear browser storage. Account data is retained while your account is active. In-app notifications are kept for a limited period (typically 90 days) and then removed. Email operations logs are purged on a rolling schedule (typically 90 days) while suppression records for bounces may be kept to protect deliverability. You may request account or data deletion by contacting us; some records may be retained where required by law or for legitimate dispute resolution.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. Contact hello@neatinvoice.app or use our contact form to exercise these rights. You may also lodge a complaint with your local data protection authority.

9. International transfers

Our processors may store or process data in the United States or other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses offered by our vendors.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes

We may update this policy by posting a new effective date on this page. Material changes may also be communicated in the product or by email where appropriate.

12. Contact

Privacy questions: hello@neatinvoice.app.