1Who we are
Invollc is run by Audere Software LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States. For the data about you as a visitor or customer, we are the data controller. You can reach us at info@auderesoftware.com for anything in this policy.
This policy covers invoiceforllc.com, the Invollc app and its API, and the emails we send.
2What we collect
You give it to us
- Account: name, email, password (stored only as a one-way hash), language and display preferences.
- Your LLC and you as its owner: company name, address, EIN, state and date of formation, business activity, and the owner details used for Form 5472 such as citizenship, country of tax residence and foreign tax ID. You decide what to fill in.
- Business records: invoices, estimates, clients, payments, expenses and receipts, transactions between you and your LLC, deadlines and notes.
- Payment details for your invoices: the bank or payment instructions you choose to print on invoices.
- Messages: what you write to us and the feedback you send from the app.
From services you connect
- Banks and payment providers (Mercury, Payoneer, VertoFX, Stripe): when you connect one, we receive the data needed for the feature, mainly incoming transactions with amount, date, sender name and payment reference, plus account names. We store the access tokens encrypted.
- Stripe Billing: when you subscribe, Stripe tells us the plan and the payment status. We never see or store your full card number.
Collected automatically
- Technical data: IP address, browser, device and the pages requested, kept in server logs for security and troubleshooting.
- Usage analytics on the public website, only if you accept analytics cookies (see section 9).
- Bot protection: on sign-in, sign-up and password reset, Google reCAPTCHA looks at signals about your device and behaviour to tell people from bots.
3Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, generating invoices, PDFs and reports, sending invoices and reminders you ask us to send | Performing our contract with you |
| Billing your subscription | Performing our contract with you |
| Deadline reminders and messages about your account, security or changes to these terms | Performing our contract, and our legitimate interest in keeping you informed |
| Keeping the service secure, stopping abuse and bots, fixing bugs | Our legitimate interest in a safe, working service |
| Website analytics | Your consent, which you can withdraw anytime |
| Keeping accounting and tax records about our own sales | Legal obligation |
We don't sell personal data, we don't share it for advertising, and we don't use your business records to train AI models.
4Your clients' data
When you add clients or send them invoices, you decide what data goes in and why. For that data you are the controller and we act as your processor: we store it and use it only to provide Invollc to you, and we don't contact your clients except to deliver the invoices, estimates and reminders you send.
When your client opens an invoice link, we record that the invoice was viewed, so you can see it in the app. If they pay by card, the payment is handled by Stripe on your Stripe account.
If you need a data processing agreement for your clients' data, write to us and we'll send one.
5Who processes it for us
We use a small number of providers. Each one gets only what it needs for its job and is bound by contract to protect it.
| Provider | What for |
|---|---|
| Contabo | Servers that host the app, the database and backups |
| Mailgun (EU region) | Sending emails: invoices, reminders, password resets, deadline alerts |
| Stripe | Subscription payments, and card payments on your invoices if you enable them |
| reCAPTCHA (bot protection), Tag Manager and Analytics (only with your consent), web fonts | |
| Cloudflare (cdnjs) | Delivering the icon font used by the app |
| Mercury, Payoneer, VertoFX | Only if you connect them: reading your incoming payments |
Exchange rates come from a public rates service; we send it only dates and currencies, never personal data. We may also disclose data if the law requires it, or to a buyer if the business is sold, in which case this policy keeps applying.
6Transfers outside the EU
We are a US company and some of our providers are in the US. When personal data from the European Economic Area, the UK or Switzerland is transferred there, we rely on the EU Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework.
7How long we keep it
- Account and business records: as long as your account is open. If you ask us to delete it, we do it within 30 days.
- Backups: deleted data disappears from backups when they are overwritten in their normal cycle.
- Server logs: for a limited period, longer only if needed to investigate an incident.
- Our own billing records: as long as tax law requires, usually up to 7 years.
8Security
Traffic is encrypted with HTTPS. Passwords are hashed. Bank and payment access tokens are encrypted in the database. Sign-in is rate-limited and protected against bots, and each account can reach only its own data. No system is perfectly safe: if a breach affects your data, we'll tell you and the authorities as the law requires.
9Cookies and local storage
| Name | Type | Why |
|---|---|---|
| Session and XSRF-TOKEN | Necessary | Keep forms and requests secure |
| auth_token, auth_user (local storage) | Necessary | Keep you signed in to the app |
| locale, theme, welcome_seen, cookie_consent, cookie_consent_id (local storage) | Preferences | Remember your language, light or dark mode, and choices you made |
| reCAPTCHA | Necessary for security | Tell people from bots on sign-in and sign-up |
| _ga, _ga_* (Google Analytics) | Analytics, optional | Count visits to the public website. Set only after you accept. |
When you choose in the cookie banner, we keep a record of the choice as proof of consent: a random id stored in your browser, the choice, the date, the policy version, your browser type and a hashed version of your IP address. We keep it for as long as the choice is valid and up to 2 years after.
You can change your choice anytime with cookie settings.
10Your rights
Depending on where you live, including under the GDPR and the California Consumer Privacy Act, you can ask to access your data, correct it, delete it, get a copy in a portable format, restrict or object to how we use it, and withdraw consent you gave. Much of this you can do yourself in the app: edit your details in Settings and export invoices, payments and expenses as CSV.
For anything else, write to info@auderesoftware.com. We answer within 30 days and may ask you to confirm your identity first. We won't treat you differently for using these rights. If you are in the EU or UK and think we got it wrong, you can complain to your local data protection authority.
11Children
Invollc is for adults running a business. We don't knowingly collect data from anyone under 18; if we learn we did, we delete it.
12Changes
If we change this policy in a way that matters, we'll email you before the change applies and update the date at the top.