Privacy Policy
Last Updated: September 26, 2026 • Version 1.1 • GDPR & CCPA Compliant
Table of Contents
Your Privacy Matters
We secure all credentials and payment gateway keys using AES-256 client-side and at-rest envelope encryption. Your data is encrypted and secure.
1. Introduction
Welcome to Invollo. Invollo is an all-in-one financial, invoicing, time tracking, and client billing software platform operated by Global Commerz (licensed in Chattogram, Bangladesh) under Trade License ID . Global Commerz is the controller of the personal data described in this policy, and processes it through the service providers listed below.
We are committed to protecting the privacy and security of our users' personal data. This Privacy Policy describes how we collect, use, process, store, and share information when you use our website, cloud platform, desktop application, or browser extensions. It applies to all clients, freelancers, agencies, and their respective billing entities who interact with our services globally, in accordance with the General Data Protection Regulation (GDPR) in Europe, the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA) in the United States, and the Bangladesh Information and Communication Technology (ICT) Act 2006.
2. Information We Collect
Depending on how you use our platform, we collect different types of personal and usage information. This information is required to satisfy our contractual obligations to deliver Invollo's features.
Account and Profile Data
To create an account, we collect your name, email address, password (stored as cryptographically hashed representations), business name, business address, currency, and tax configurations. We use this information to customize your workspace, invoice clients, and manage your billing accounts.
Time Tracking and Activity Logs
When using the Invollo Desktop App or Chrome Web Extension, we collect active timer durations, timestamps, associated client names, project names, and task categories. This data is collected to compile timesheets and generate billable hours for your invoices. We do NOT capture screenshots, keystrokes, or local files unless explicitly configured by you for client proof-of-work.
Payment Integration Credentials
If you connect your own payment integration details (such as Stripe webhook secrets or PayPal credentials), these sensitive settings are encrypted using 256-bit Advanced Encryption Standard (AES-256) envelope encryption. These secrets are cryptographically secured at rest.
Billing and Transactional Data
We do not store full credit card numbers. All card transactions are processed securely by Stripe (global billing) or bKash (merchant portal for Bangladesh). We receive payment confirmation details, subscription status, billing addresses, and transactional metadata.
Free Tools and Lead Forms
When you download a file from a free tool on invollo.com (the W-8BEN generator or the invoice generator), we collect your email address, the tool you used, the date, whether you confirmed the address, and whether you ticked the optional box to receive emails. To confirm the address, we email you a 6-digit verification code; we keep only a hashed copy of the code, and it expires after 15 minutes. The form you fill in is processed only in your browser and is never sent to us, and we never email the file itself. We email you tips and product updates only if you ticked that box, and you can unsubscribe at any time. You can ask us to delete this record at any time.
3. How We Use Information
We use the collected information for specific, legitimate business purposes related to delivering a premium SaaS platform:
- Providing, operating, and maintaining our web, desktop, and extension apps.
- Compiling hours tracked and converting client tasks into professional invoicing schemas.
- Securing digital quotes, capturing legally compliant IP addresses and electronic signatures.
- Processing subscription plans and client invoice payments via Stripe and PayPal, and regional payments via bKash.
- Routing email notifications, invoice link shares, and auto-reminders via Resend and Brevo.
- Detecting, preventing, and auditing fraud, security exploits, or terms of service abuse.
- Marketing communication and performance measurement, subject to your cookie and email consents.
4. Third-Party Subprocessors
To run Invollo we share personal data with the third-party subprocessors listed below. Each subprocessor is bound by a Data Processing Agreement (DPA) and only receives the data needed for its purpose:
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage and server functions for the Invollo app | Account, workspace, client, invoicing and time-tracking data | United States (us-east-1) |
| Netlify, Inc. | Hosting of the web application (app.invollo.com) | Visitor IP addresses, request logs | United States / global CDN |
| Hostinger | Hosting of the marketing website (invollo.com) | Visitor IP addresses, contact form submissions | European Union |
| Cloudflare, Inc. (R2) | Storage of time-tracking screenshots, downloads and database backups | Screen captures (which may contain any personal data visible on screen), encrypted backups | Global edge / EU and US |
| Stripe, Inc. | Subscription billing and client invoice payments | Payer name, email address, payment details | Global / United States |
| TECNOMAXX DIGITAL LTD | Billing partner that collects card payments for Invollo subscriptions (holder of the Stripe account) | Billing name, email address, subscription and payment status | United Kingdom |
| PayPal | Client invoice payments (connected by the workspace) | Payer name, email address, payment details | Global |
| bKash | Local payment processing (Bangladesh) | Payer name, mobile wallet and payment details | Bangladesh |
| Resend & Brevo | Transactional email delivery (invoices, reminders, notifications) | Recipient names and email addresses, email content | EU and United States |
| Axiom | Application logs for our server functions | Request metadata, error messages, user and company identifiers | United States |
| OpenRouter | Invollo AI processing (forwards only to providers that keep no data) | Limited workspace summaries and query text | United States |
| Google (Gemini API) | Invollo AI processing (paid service; 55-day abuse logs) | Limited workspace summaries and query text | United States |
| Z.AI | Invollo AI processing (content not stored) | Limited workspace summaries and query text | Singapore |
| Anthropic (Claude) | Invollo AI processing (requests kept up to 30 days for abuse detection) | Limited workspace summaries and query text | United States |
International transfers: our primary database is hosted in the United States (Supabase, us-east-1). Where we transfer personal data from the UK or EEA to countries without an adequacy decision, we rely on the EU Standard Contractual Clauses (with the UK Addendum / International Data Transfer Agreement for UK data) together with each provider's Data Processing Agreement.
5. Data Security & Encryption
We adopt strict, enterprise-grade measures to secure your credentials and invoices. All communications between Invollo Apps (Desktop, Extension, Web) and our APIs use Transport Layer Security (TLS 1.3) protocols.
Sensitive configuration data, including connected payment credentials, is encrypted under 256-bit AES cryptographic protocols. Conversations and questions generated with Invollo AI are saved in the workspace for 180 days, and none of our AI providers use your workspace data to train their models.
6. Data Retention Policies
We retain user information only for as long as necessary to perform our contractual obligations or satisfy statutory legal requirements:
- Financial & Invoicing logs: Retained for a standard period of six (6) years following the year of transaction to comply with regulatory tax, accounting, and auditing audits (HMRC, NBR).
- Time Logs & Time Tracking Activity: Retained for the duration of the account lifespan. If you terminate your account, we securely delete or anonymize these logs within 12 months, unless legally required to retain them.
- Unapproved Quotes & Proposals: Automatically deleted after 180 days if left inactive or expired.
7. Your GDPR & CCPA Rights
Depending on your region, you possess specific data protection rights under the GDPR and CCPA. We honor these rights for all global users:
- Right to Access: You may request a report of all personal data we hold about you.
- Right to Deletion (Right to be Forgotten): You can request that we delete your personal and time-tracking data, subject to tax retention laws.
- Right to Portability: Export your client details, invoices, and timesheets in CSV or JSON formats at any time.
- Right to Object or Restrict Processing: Opt-out of non-essential marketing, analytics tracking, or AI prompt data parsing.
- Right to Non-Discrimination: CCPA regulations protect you from rate increase or service degradation if you choose to exercise your privacy options.
To execute any of these rights, please contact our Compliance Officer at the contact link below.
8. Contact Information
If you have questions about this Privacy Policy, your rights, or wish to report a compliance matter, you can contact our privacy desk directly:
Support inquiries can be sent to:
Invollo is operated by Global Commerz (Trade License: , Address: ).