Privacy Policy

1. Who we are

Invoice Partner is a GST invoicing service built and operated by Shreyansh Jain ("we", "us"). It is made up of the web app at invoice.partner.shrynshjn.com, the Invoice Partner mobile app, and the API that both use (together, the "Service"). This policy explains what personal data the Service handles and why, in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

2. What we collect

We collect only what you or your teammates give the Service:

• Account details — your name, email address, optional phone number, and your password, which is stored only as a bcrypt hash.
• Company records — company name, PAN, logo and contact details; billing GSTINs and addresses; bank account details printed on invoices; customers with their GSTINs, addresses and contacts; products with HSN/SAC codes and rates; transporters; numbering series; and the users and roles in the company.
• Documents and transactions — proforma invoices, tax invoices, credit and debit notes, payments and their mapping to invoices, and the e-invoice (IRN, acknowledgement, signed QR) and e-way bill details you upload after using the government portal.
• Session and security data — for each sign-in, the IP address, device/browser user agent and time; and an audit log of who created or changed which record, with the IP address it came from.
• Messages you send us — support emails and their contents.

We do not collect your contacts, location, photos or advertising identifiers. The mobile app does not include advertising or third-party analytics SDKs. This marketing website uses Google Analytics to count page visits; the web app and mobile app do not.

3. How we use it

We use the data above only to:

• create and run your account and sign you in on the web and in the app;
• let you and your teammates create, issue, print and share invoices and other documents, record payments, and run reports;
• generate e-invoice and e-way bill JSON files for you to upload to the government portal yourself;
• send service emails — teammate invitations, password-reset codes and important notices about the Service;
• keep the Service secure — rate limiting, detecting misuse, and investigating incidents using session and audit logs; and
• operate and fix the Service and answer your support requests.

We do not sell your data, use it for advertising, or build marketing profiles from it.

4. Your company's data and our role

Records entered into a company — including details of your customers and their contact people — belong to that company. For those records the company decides what is collected and why (it is the "data fiduciary" or controller), and we process them on its behalf to provide the Service. The company is responsible for having a lawful basis to enter its customers' details and for answering its customers' privacy requests; we will help it do so. For your own account details, we are responsible.

Anyone your company makes a member can see that company's records within the permissions of their role. The company's owner and administrators control who is a member.

5. Who it is shared with

We do not sell or rent data. It leaves the Service only in these cases:

• Infrastructure providers — the Service runs on Amazon Web Services servers and stores its database on MongoDB Atlas; outgoing email is sent through our email provider. They process data on our behalf, under their contractual terms, only to run the Service.
• People you choose to share with — when you share an invoice PDF from the app, download an export, or invite a teammate, the data goes where you send it.
• The government portal, by your hand — e-invoice and e-way bill JSON is downloaded by you and uploaded by you; the Service does not connect to the GST, IRP or e-way bill portals on your behalf.
• Legal requirements — when we are required to by law, a court order or a lawful request from a government authority, or to protect the rights and safety of users and the Service.

6. Where it is stored and how it is protected

Data is stored with the providers above, which may keep it in data centres in India or other countries; they apply their own physical and encryption-at-rest protections. Within the Service:

• all traffic between the apps and the API is encrypted with HTTPS;
• passwords are hashed with bcrypt and are never stored or logged in plain text;
• sessions use short-lived access tokens and rotating refresh tokens; only a hash of each refresh token is stored, reusing an old one signs that session out, and you can sign out of every device at once;
• password-reset codes are single-use, expire after 15 minutes and are stored hashed;
• sign-in and API requests are rate-limited; and
• every company's records are kept separate, and every request is checked against the member's role and permissions.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the authorities as the law requires. To report a vulnerability, write to the contact below.

7. How long we keep it

We keep your account and company records for as long as the account or company is active. Expired sessions and reset codes are deleted automatically. Indian tax law requires businesses to keep invoices and accounts for several years; it is your company's responsibility to keep its own copies (for example through exports) for as long as the law requires it to, and we do not promise to keep them for you after an account or company is deleted.

8. Your rights

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct or complete data that is wrong (most of it you can edit yourself in the app);
• erase your personal data, subject to §9;
• withdraw a consent you gave, which may mean we can no longer provide the Service; and
• nominate someone to exercise these rights on your behalf if you die or are unable to.

Send requests to the contact in §13 from the email on your account. We will respond within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

9. Deleting your account

To delete your Invoice Partner account, email shreyansh@shrynshjn.com with the subject "Invoice Partner account deletion" from the email address on the account. We will confirm the request and complete it within 30 days. When an account is deleted:

• your name, email, phone, password hash and sessions are deleted;
• you are removed from every company you belong to; and
• if you are the only owner of a company, that company and all its records are deleted too, unless you first transfer ownership to another member — so export anything you need to keep before you ask.

Invoices and other records you created in a company that continues to exist stay with that company, because they are its business records; your name on their audit history is replaced with "deleted user". Copies in backups are overwritten on the normal backup cycle.

10. On your device

The mobile app keeps your sign-in tokens in the device's secure storage (Keychain on iOS, Keystore on Android) and saves invoice PDFs to a temporary folder only when you share them. The web app stores your sign-in session and display preferences, such as light or dark theme, in your browser. Neither app uses advertising cookies or cross-site trackers.

11. Children

Invoice Partner is a business tool for adults and is not meant for anyone under 18. We do not knowingly collect data from children; if we learn that we have, we will delete it.

12. Changes to this policy

If this policy changes, we will update the date at the top of this page and, for significant changes, tell you by email or in the app before they take effect.

13. Contact & grievances

Questions, privacy requests and grievances go to our grievance officer, Shreyansh Jain, at shreyansh@shrynshjn.com. We acknowledge grievances within 24 hours and aim to resolve them within 15 days.

See also the Terms of Use and the User Agreement.