Privacy Policy
Last updated: January 15, 2025 • Effective: February 1, 2025
End-to-End Encryption
All data encrypted in transit (TLS 1.3) and at rest (AES-256)
No Data Selling
We never sell, rent, or trade your personal or invoice data
Data Portability
Export all your data at any time in JSON or CSV format
GDPR Compliant
Full compliance with GDPR, CCPA, and other global data regulations
At EAPInvoice, privacy is foundational, not an afterthought. This policy explains what data we collect, why we collect it, and how we protect it. We process invoice data on your behalf under strict data isolation per organization. Your data is yours — always.
Information We Collect
Account Information
When you create an account, we collect your name, email address, and password (stored as a cryptographic hash). For organization accounts, we also collect the organization name and billing information.
Invoice Data
EAPInvoice stores the invoice data you create or upload, including client names, amounts, due dates, and payment status. This data is isolated per organization and is never shared with other organizations.
Usage Data
We collect information about how you interact with the Service, including page views, feature usage, and performance metrics. This data is used to improve the product and is never tied to individual invoices.
Cookies and Tracking
We use essential cookies for authentication and session management. We also use analytics cookies (with your consent) to understand aggregate product usage. You can opt out of non-essential cookies at any time.
How We Use Your Information
Service Delivery
We use your data to provide, maintain, and improve EAPInvoice, process invoice transactions, send notifications, and provide customer support.
Invoice Status Processing
EAPInvoice automatically processes invoice data to determine and update status (paid, unpaid, overdue, 6-month critical). This processing is automated and occurs within your organization's isolated environment.
Communications
We may send you service-related emails including account confirmations, invoice reminders (as configured by you), security alerts, and product updates. You can unsubscribe from marketing emails at any time.
Data Retention
Active Accounts
We retain your data for as long as your account is active or as needed to provide services.
Account Deletion
When you delete your account, we retain your data for 30 days to allow recovery. After 30 days, data is permanently deleted from our systems, including backups, within 90 days.
Invoice Archives
Some invoice records may be retained for up to 7 years for legal and tax compliance purposes, even after account deletion, in accordance with applicable financial regulations.
Your Rights (GDPR & CCPA)
Right to Access
You have the right to request a copy of all personal data we hold about you. We will respond within 30 days.
Right to Deletion
You may request deletion of your personal data. Requests are fulfilled within 30 days, subject to legal retention requirements.
Right to Portability
You can export all your data at any time from your organization settings in JSON or CSV format.
Right to Object
You may object to processing of your personal data for marketing purposes at any time.
Security
Technical Safeguards
EAPInvoice employs industry-standard security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, regular penetration testing, and 24/7 security monitoring.
SOC 2 Type II
We maintain SOC 2 Type II certification, audited annually by an independent third party. Reports are available upon request under NDA.
Breach Notification
In the event of a data breach, we will notify affected users within 72 hours as required by GDPR, and will provide details on what data was affected and steps we are taking.
Contact Our Privacy Team
To exercise your rights or ask questions about this policy, contact our Data Protection Officer:
Email: privacy@eapinvoice.com
DPO: privacy-dpo@eapinvoice.com
Address: 123 Finance Street, London, EC1A 1BB, United Kingdom
Response time: Within 30 business days
This policy is governed by the laws of England and Wales.