Skip to content
InvoiceJet
Start free

Privacy Policy

Last updated November 2, 2026

This policy describes what InvoiceJet collects, how it is used, and the choices you have. The short version: we collect what the product needs to work, we process your documents only to provide the service, we do not sell your data, and you can delete everything yourself at any time.

What we collect

  • Account data: your email address, display name, and authentication identifiers (including Google account identifiers if you sign in with Google).
  • Documents and extracted data: the invoice files you upload, forward by email, or send via API, and the structured data extracted from them, including your corrections.
  • Vendor records derived from your invoices (names, addresses, contact details printed on the documents).
  • Usage and diagnostics: API request logs (method, path, status, latency), extraction runs and processing steps, webhook delivery logs, and error logs.
  • Emails you forward to your ingest address, including sender information and attachments.
  • Billing data: your plan, billing history, and the cancellation reason you choose, if any. Card details are collected and stored by Stripe; we never see or store your full card number.
  • Analytics: how visitors use our website and how signed-in users move through the app (see Analytics below).

How we use it

  • To run the service: extract data from your documents, store results, and show them to you.
  • To operate the features you configure: webhooks, approval emails, digests, exports, and the API.
  • To enforce quotas and rate limits, prevent abuse, and debug failures.
  • To email you about your account: welcome, quota alerts, getting-started tips, and digests. Tips and digests can be switched off in Settings or with the unsubscribe link in each email.
  • To understand which pages and features people use, so we can improve the product.

We do not sell your data or use it for advertising.

AI processing

Documents are processed by third-party AI models via OpenRouter to perform extraction. We only route to providers under policies that prohibit training on your data, and we send only the document content needed for extraction. Extraction results, including model responses, are stored in your account so you can audit them.

Analytics

On invoicejet.ai we use Google Analytics and PostHog to count page views and clicks on buttons such as "Start free". In the app we use PostHog to record product events, such as signing up, uploading a first invoice, reaching the monthly limit, and changing plans. App events are linked to your account ID, not your email address. Session recording and automatic click capture are off, and we do not send invoice contents to analytics.

These tools use cookies or local storage to recognize a returning browser. If your browser sends a Do Not Track or Global Privacy Control signal, we do not load them at all. You can also block or clear these cookies in your browser.

Where your data lives

We use these subprocessors:

  • Supabase: database, file storage, and authentication.
  • Resend: transactional email and inbound email receiving.
  • OpenRouter and the AI model providers it routes to: document extraction (see AI processing).
  • Stripe: payments and billing.
  • PostHog and Google Analytics: website and product analytics.

Documents are stored in private buckets scoped to your account; access is controlled by row-level security and time-limited signed URLs.

Retention

  • Documents and extracted data: kept until you delete them or your account.
  • API request logs: deleted after 90 days.
  • Idempotency records: deleted after 24 hours.
  • Error and delivery logs: kept for operational debugging and pruned periodically.

Your rights and choices

  • Export: download your invoice data as CSV or JSON from the app at any time.
  • Correction: edit any extracted field in the review screen.
  • Deletion: delete individual invoices, or delete your entire account under Settings, which permanently removes your documents, extracted data, vendors, keys, and logs tied to your account.
  • Email preferences: digests, alerts, and getting-started tips can be switched off in Settings or with the unsubscribe link in each email; account, billing, and approval emails are transactional.
  • Analytics: send a Do Not Track or Global Privacy Control signal, or block analytics cookies in your browser.
  • Depending on where you live (for example the EU/EEA, UK, or California), you may have additional statutory rights; contact us to exercise them.

Security

All traffic is encrypted in transit. API keys are stored only as SHA-256 hashes. Webhook payloads are signed. Documents live in private storage with per-account access rules. No system is perfectly secure; if we learn of a breach affecting your data we will notify you without undue delay.

Changes

We will update this policy as the product changes and notify you of material changes by email or in the app before they take effect.

Questions? Email support@invoicejet.ai.