Privacy Policy
- Your data is stored in the European Union (Frankfurt, Germany).
- We use your data to run Invomio — nothing else. We do not sell it, and we show no ads.
- The invoices, customers and products you enter belong to you. For that data we act on your instructions only.
- You can export your data and delete your account from inside the app at any time.
- Questions: privacy@invomio.com
1. Who we are
Invomio is an invoicing app for iPhone (and later other platforms) provided by Codelogix Bilgi Teknolojileri [LEGAL FORM], [REGISTERED ADDRESS], Türkiye ([TRADE REGISTRY / MERSIS NO.]) — “Invomio”, “we” or “us”.
This policy explains how we handle personal data when you use the Invomio app, the pages we send to your customers (invoice and quote links, emails) and the website invomio.com. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK). Users in Türkiye can also read our KVKK information notice in Turkish.
EU representative (GDPR Art. 27): [NAME, ADDRESS]. UK representative: [NAME, ADDRESS].
2. Two roles: controller and processor
- Your account (you as a user of Invomio): we are the controller. We decide why and how this data is processed.
- Your business records (your customers, their contact details, invoices, quotes, payments you record): your business is the controller and we are your processor. We process this data only to provide the service to you, as described in the data processing terms in our Terms of Use. If you are one of our users’ customers and want to exercise your rights, please contact the business that sent you the invoice; we will help them respond.
3. What we collect and why
| Data | Examples | Why | Legal basis (GDPR / KVKK) |
|---|---|---|---|
| Account | Email address, name, app language, sign-in sessions | Create and secure your account, sign you in with a one-time code | Contract — Art. 6(1)(b) / KVKK 5(2)(c) |
| Business profile | Business name, legal name, tax number, address, email, bank details (IBAN, SWIFT), logo, invoice settings | Shown on your invoices, quotes and payment pages | Contract |
| Business records | Customers (name, email, tax number, address), products and prices, invoices, quotes, credit notes, payments you record, notes | The core of the service: creating, sending and tracking documents | Processed on your behalf (processor) |
| Team | Email addresses you invite, roles, who issued or changed a document | Shared access to a business, audit trail | Contract; legitimate interest in an accurate record |
| Document delivery | Recipient email address, delivery and bounce status, when a link was opened | Send documents and show you whether they arrived | Contract |
| Quote decisions | Name and reason entered by your customer, time, IP address, browser type | Evidence of acceptance or rejection of a quote | Processed on your behalf; our legitimate interest in preventing abuse |
| Text you dictate or type into “Write or say it” | “3 hours of consulting for Acme, 150 an hour” | Turn a sentence into invoice fields | Contract |
| Subscription | Plan, trial and renewal dates, an anonymous purchase identifier | Unlock paid features, enforce plan limits | Contract |
| Device | Push notification token, device language and region | Notify you when an invoice is paid or viewed (if you turn this on); format numbers and dates | Consent (notifications, revocable in iOS Settings); contract |
| Technical logs | IP address, time, request type, error messages | Security, preventing abuse, fixing faults | Legitimate interest — Art. 6(1)(f) / KVKK 5(2)(f) |
What we do not collect: we do not process card or bank payments (subscriptions are paid to Apple, which does not share your payment details with us), we do not use advertising identifiers, and we do not track you across other apps or websites. Voice dictation uses your iPhone’s built-in speech recognition, provided by Apple under Apple’s privacy terms; Invomio receives only the resulting text, never audio.
4. The “Write or say it” feature
When you use it, the text you entered is sent — together with the names of your customers, products and tax rates so that it can match them — to our AI provider (Anthropic), which returns structured fields. Amounts are always calculated by Invomio, not by the AI. Our provider processes this data under a commercial agreement that does not allow it to use the data to train its models. The result is a draft that you review before anything is issued.
5. Who we share data with
We share data only with service providers that help us run Invomio, under data processing agreements, and only as far as they need it:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, file storage, sign-in, server functions | EU (Frankfurt, Germany) |
| Brevo (Sendinblue SAS) | Sending invoice, quote, reminder and sign-in emails | EU (France) |
| Postmark (ActiveCampaign, LLC) | Email delivery (alternative provider) | USA |
| Anthropic, PBC | “Write or say it” text understanding | USA |
| RevenueCat, Inc. | Managing App Store subscriptions | USA |
| Expo (650 Industries, Inc.) | Delivering push notifications | USA |
| Apple Inc. | App distribution, in-app purchases, push delivery (APNs) | USA / worldwide |
Your customers see the documents you send them. We may also disclose data if the law requires it, to protect our rights or users’ safety, or as part of a merger or acquisition (in which case this policy continues to apply). We never sell personal data.
6. International transfers
Our main database is in the EU. Where a provider processes data outside the EU/EEA, the UK or Türkiye, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum), the EU–US Data Privacy Framework where the provider is certified, and, for data subject to KVKK, the standard contracts under Article 9 of KVKK, notified to the Turkish Personal Data Protection Authority as required.
7. How long we keep data
- Account data: while your account exists. When you delete your account, there is a 30-day grace period (signing in cancels the deletion); after that your personal account data is deleted or irreversibly anonymized.
- Issued invoices, credit notes and their payment records: tax laws require businesses to keep these for up to 10 years. They stay with the business they belong to; if the account that issued them is deleted, they remain in that business’s records without identifying the deleted user. If the whole business is deleted, its records are deleted with it.
- Drafts, customers, products: until you or your business delete them.
- Technical logs: typically up to 90 days.
8. Security
Data is encrypted in transit (TLS) and at rest by our hosting provider. Access inside a business is limited by role and enforced in the database. Sign-in tokens are stored in the iOS Keychain on your device. Invoice links use long random identifiers that cannot be guessed, and customer-facing pages are not indexed by search engines. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
9. Your rights
Depending on where you live, you have the right to:
- access your data and receive a copy (the app also offers an export);
- correct inaccurate data (most of it you can edit in the app);
- have your data deleted (Settings → Delete account);
- restrict or object to processing based on legitimate interests;
- data portability;
- withdraw consent at any time (for example, turn off notifications);
- under KVKK Article 11: learn whether your data is processed, its purpose, the third parties it is transferred to, and request compensation for damage from unlawful processing.
Write to privacy@invomio.com from the email address on your account. We answer within one month (GDPR) and at the latest within 30 days (KVKK), free of charge. You may also complain to your local data protection authority — in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), in the UK the ICO.
10. Children
Invomio is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children.
11. Cookies
invomio.com and the invoice and quote pages we host do not use cookies or tracking technologies.
12. Changes
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top shows the current version.
13. Contact
Codelogix Bilgi Teknolojileri [LEGAL FORM], [REGISTERED ADDRESS] · privacy@invomio.com