Privacy Policy
Last updated: 28 September 2026
This policy explains what Invoicer does with personal data, written to the GDPR and the Irish Data Protection Acts. In short: your data is stored in Ireland, we never sell it, we set no tracking cookies, and for the details you keep about your clients and contractors, you are the controller and we are only your processor.
1. Who we are
Oxus Technologies Limited operates Invoicer, invoicing and self-billing software for Irish businesses. We are the data controller for the personal data described in this policy, except where we act as your processor. See controller and processor below, which is the most important section here if you keep your clients' or contractors' details with us.
Oxus Technologies Limited
Registered in Ireland, company number 818468
Registered office: Greenhills Road, Walkinstown, Dublin 12, D12 DX80, Ireland
Data protection contact: info@oxus.ie
We have not appointed a Data Protection Officer, because our processing does not meet the thresholds in Article 37 GDPR that require one. Enquiries go to the address above and are handled by us directly.
2. Controller and processor: which is which
Invoicer holds two different kinds of personal data, and our legal role differs between them.
- Your own account data: we are the controller. Your name, email, the business you act for, your plan, billing history and how you use the product. We decide why and how that is processed, and this policy explains it.
- The data you enter about other people: you are the controller, we are your processor. Your clients', suppliers' and contractors' names, addresses, email addresses, tax numbers, bank details and the contents of the invoices and agreements between you. You decide what to collect and why; we only hold and process it to run the service for you, under our Data Processing Agreement.
If you are a client or contractor of a business that uses Invoicer, that business is the controller of your details, not us. Please contact them first. If you reach us instead, we will pass the request to them promptly and tell you we have done so. We are not permitted to change or delete their records on our own initiative.
3. What we collect
Account and profile data: your name, email address, password (stored only as a hash by our authentication provider), chosen plan and the team memberships and roles you hold.
Business details: the name, address, VAT number and CRO number of the business you act for, its invoice settings, and the bank details (IBAN) it chooses to show on invoices.
Team members: the name, email address and role of each person invited to act for a business.
Invoice data: your clients' and contractors' names, business and billing addresses, email addresses, VAT and CRO numbers, a self-employed contractor's tax reference (PPSN) where entered, and IBANs, and the contents of invoices, credit notes, contracts, self-billing agreements and payment records.
Audit trail: when someone accepts terms, signs a contract or agreement, or accepts or rejects an invoice, we record their name, the time, their IP address and their browser's user agent. This is the evidence that the acceptance happened, which self-billing under section 71 requires.
Payment information: card and bank account details for payments are entered on Stripe's pages and held by Stripe, not by us. We never see or store a full card number. We keep the identifiers that link your account to Stripe, and the status and amounts of payments.
Emails: records of the emails Invoicer sends for you, such as who they went to and when.
Support messages: what you send us when you ask for help, including your email address.
Technical logs: server and security logs including IP address, browser type, pages requested and errors.
4. Why we use it, and our legal basis
- To provide Invoicer: running your account, storing your records, producing invoices and documents, and sending the emails you ask it to send. Legal basis: performance of our contract with you.
- To bill you: subscriptions, our invoices to you, and the tax records that go with them. Legal basis: contract, and legal obligation for the accounting and tax records.
- To keep the service secure: logging, rate limiting, fraud and abuse prevention, backups and debugging. Legal basis: our legitimate interest in the security and integrity of the service.
- To tell you about the service: security notices, changes to these documents and service issues. Legal basis: legitimate interest.
- Anything else we ask you about, such as product news. Legal basis: consent, which you can withdraw at any time.
We do not sell personal data, and we do not use it to make automated decisions producing legal or similarly significant effects about anyone.
5. Emails we send
- Account emails: sign-in links, password resets, team invitations, billing receipts and service notices. Necessary to operate the account.
- Invoice and document emails: invoices, reminders, agreements and contracts sent to your clients and contractors. We send these on your instruction and on your behalf, as your processor.
- Marketing: only with your consent, and every such email carries an unsubscribe link.
Emails come from invoices@invoicer.ie or no-reply@invoicer.ie. Those addresses only send; nobody reads replies to them. Write to info@oxus.ie instead.
6. Who else processes your data
We use the following sub-processors and services. Each processor is bound by a data processing agreement and may not use your data for its own purposes. The CRO and VIES are public registers: we send them only the company name, number or VAT number being looked up.
| Processor | What it does | Where |
|---|---|---|
| Supabase | Database hosting, user authentication and file storage | Ireland (AWS eu-west-1) |
| Vercel | Application hosting | Server functions in Dublin, Ireland (dub1), with a global edge network |
| Stripe | Invoicer subscription billing; card and SEPA Direct Debit collection for your own invoices (on your own connected Stripe account, where you have connected one) | Ireland and the United States |
| Resend | Sending account, invoice and notification emails | European Union (eu-west-1) and the United States |
| Anthropic | AI reading of custom contracts you choose to upload for scanning, used only for that feature | United States |
| Companies Registration Office (CRO) Ireland | Company lookups when you add a client, through the CRO open services | Ireland |
| European Commission VIES | VAT number validation | European Union |
The list is also kept at Sub-processors. We may also disclose personal data to our professional advisers, or where we are legally required to, for example in response to a valid order from Revenue, An Garda Síochána or a court. If our business is sold or reorganised, data may transfer to the buyer, who would remain bound by this policy or one no less protective.
7. Where your data is stored, and international transfers
Your account and invoice data is stored in Ireland (AWS eu-west-1), inside the EU.
Some of our providers operate partly outside the EEA, principally in the United States, for payment processing, email delivery and contract scanning. Where personal data reaches them, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses, together with the additional safeguards those mechanisms require.
8. How we protect it
- All traffic is encrypted in transit with TLS, and data is encrypted at rest.
- Access is enforced in the database itself with row level security, so one business cannot read another's records even if the application has a bug.
- Within a business, what each person can do is limited by their role (owner, finance or viewer).
- API keys you give us for third-party services (for example, a connected depot system) are stored encrypted.
- Internal access to production data is limited to the people who need it to operate and support the service (least privilege).
- Acceptances, signatures and invoice decisions are recorded in an audit log, so there is a record of who did what and when.
9. If something goes wrong
If a personal data breach occurs and is likely to result in a risk to people's rights, we will report it to the Data Protection Commission within 72 hours of becoming aware of it, and tell affected customers without undue delay. Where we are your processor, we will notify you so you can meet your own obligations as controller, within the time set in the Data Processing Agreement.
10. How long we keep it
- Account and invoice data: for as long as the account is active. After you close your account or it is terminated, we keep it for 30 days so you can export it, then delete it.
- Our own billing records (what you paid us): 7 years, as Irish tax law requires.
- Support messages: up to 2 years after the matter is closed.
- Security and server logs: typically 30 to 90 days.
- Backups: deleted data persists in backups for a short period before rolling out of the retention window.
Irish VAT law requires a business to keep its invoices, including self-billed invoices, for at least six years. That obligation is yours, not ours: Invoicer lets you export your invoices and records at any time so you can keep your own copies.
11. Your rights
Under the GDPR you have the right to:
- access a copy of the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data where we no longer have grounds to keep it;
- restrict processing in certain circumstances;
- port your data to another provider in a machine-readable format (you can also export your records from Invoicer at any time);
- object to processing based on our legitimate interests;
- withdraw consent at any time, where consent is the basis. This does not affect processing already carried out.
Email info@oxus.ie to exercise any of these. We respond within one month, and will tell you if we need longer because a request is complex. There is no charge unless a request is manifestly unfounded or excessive.
13. Children
Invoicer is a business tool and is not for anyone under 18. We do not knowingly collect personal data from children. If you believe a child's data has reached us, tell us at info@oxus.ie and we will delete it.
14. Complaints
If you are unhappy with how we have handled your personal data, please raise it with us first at info@oxus.ie. Most things are quicker to fix directly.
You also have the right to complain to the Irish supervisory authority, the Data Protection Commission, at www.dataprotection.ie. If you live in another EU country, you may complain to your local supervisory authority instead.
15. Changes to this policy
We update this policy when our processing or the law changes. The “last updated” date at the top always reflects the current version, and we will tell account owners by email or in the app before a material change takes effect.
16. Contact us
Data protection: info@oxus.ie
General support: info@oxus.ie
Oxus Technologies Limited · Company no. 818468 · Registered office: Greenhills Road, Walkinstown, Dublin 12, D12 DX80, Ireland
See also our Terms of Service, Data Processing Agreement and Cookie Policy.