Privacy Policy

1. Information we collect

We only collect what we need to run the service. Most data in your account is information you enter yourself when you sign up or use the app.

Account information you provide:

• Name, email address, and phone number
• Business name, address, logo, signature, and tax details
• Customers you add (their names, contact details, addresses)
• Invoices, quotes, receipts, expenses, products, and payment records
• Optional avatar image and personal preferences (theme, language, currency)

2. Information collected automatically

When you use the app we also collect basic technical data to keep things running and catch crashes:

• Device type, operating system version, and app version
• Crash reports and error logs (we strip request bodies before they leave the device, so customer and invoice details are never sent)
• Anonymous usage events (e.g. "invoice created", "payment recorded") so we can see which features are useful
• IP address used to make API requests (kept in server logs for security and debugging)

3. How we use your information

We use your information only to:

• Provide and maintain the InvoiceFlow Africa service
• Generate invoices, receipts, statements, and reports you request
• Send transactional notifications (e.g. payment received, invoice viewed)
• Process subscription and wallet top-up payments through our payment partner
• Investigate and fix crashes, security incidents, and performance issues
• Comply with legal obligations (e.g. tax reporting, fraud prevention)

4. Third-party processors

A short list of vendors process data on our behalf, under written contracts that prevent any other use:

• Paystack — processes subscription and wallet payments. We share only the amount, currency, and your email.
• Sentry — receives crash reports and error metadata. Request and response bodies are filtered out at the device.
• Cloud hosting provider — stores your account database and uploaded files (logos, signatures, receipts).
• Email and SMS providers — deliver password resets and invoice share links you initiate.

5. Sharing with other businesses

When you invite a teammate to your business they can see all data inside that business. If you join another owner's business as a team member, the owner can see the data you create inside their business.

We never sell your personal data, your customers' data, or your business data to anyone. We do not run advertising inside the app, and we do not use your data to train AI models.

6. Where data is stored

Your account database is hosted on infrastructure inside the European Union or the United States, depending on capacity and reliability. International transfers happen under standard contractual clauses, in line with the Ghana Data Protection Act 2012 and equivalent international frameworks.

7. Data retention

We keep your account data for as long as your account is active. If you delete your account from inside the app (Settings → Delete account), we permanently delete your profile, all businesses you own, and all related invoices, customers, expenses, products and quotes within 30 days.

A small amount of anonymous billing data may be kept longer where Ghanaian tax law or fraud-prevention obligations require it. This data cannot be traced back to you.

8. Your rights

Under the Ghana Data Protection Act 2012 (Act 843) and similar international privacy laws, you have the right to:

• See what personal data we hold about you
• Correct anything that is wrong or out of date
• Export a copy of your business data (via Reports → Export)
• Delete your account and all associated data (Settings → Delete account)
• Withdraw any consent you previously gave
• Lodge a complaint with the Data Protection Commission of Ghana

9. Security

All API traffic is encrypted with TLS. Passwords are hashed with bcrypt before storage. Authentication tokens are stored in your device's secure keychain. We run regular dependency updates and monitor for known vulnerabilities, but no system is 100% secure — please use a strong, unique password and enable device-level biometric lock.

10. Children

InvoiceFlow Africa is intended for use by people running a registered or informal business. The service is not directed at anyone under 16 and we do not knowingly collect data from children. If you believe a child has signed up, please contact us and we will delete the account.

11. Changes to this policy

If we make a material change to this policy we will notify you inside the app and update the "Effective" date at the top. Continuing to use the service after the update means you accept the new terms.

12. Contact us

Questions, data requests, or complaints can be sent to privacy@invoiceflow.africa. We aim to reply within 7 working days.