Privacy Policy

1. Information we collect

We collect only what's needed to run the service:

• Account & profile: your name, email, phone number, and business identity (company, address, logo, brand colour).
• Organization & tax settings: country, currency, tax mode, your tax registration number (GSTIN / TRN / VAT number), state or Emirate, and invoice-numbering preferences.
• Billing data you enter: invoices, line items, clients, products, payments and receipts — including any withholding (TDS) rate you record on an invoice.
• Your clients' details: the name, email and company you enter for each client, plus their country, tax registration number (GSTIN / TRN / VAT number) and state or region, which we use to work out the correct tax treatment for invoices you send them. This is information you provide about other people or businesses — see section 3.
• Email settings: if you configure your own SMTP server, we store its host, port and username, and your password in encrypted form (see section 6).
• Subscription records: your plan, invoice count, when your paid period ends, and — because Pro renews automatically — the reference and status of your recurring subscription with our payment processor, plus payment metadata (amount, currency, period and processor reference) for each charge.
• Reviews: any rating or comment you choose to submit.
• Sign-in data: if you sign in with Google, we receive basic profile information (name, email and avatar) from Google.

2. How we use it

Your data is used solely to provide the service — rendering and sending your invoices, calculating taxes, tracking payments, generating receipts, and managing your account and subscription. We do not sell your data or share it with third parties for advertising.

3. Data about your clients

To bill someone, you enter their details — including, where relevant, their country and tax registration number. Those people and businesses aren't Inceipt users and haven't agreed to anything with us, so we treat that data as yours, held on your behalf: we store and process it only to produce and deliver the invoices you create, we don't use it to market to your clients, and we never contact them except to deliver something you sent.

You decide what to enter and are responsible for having a lawful basis to share it with us. Client records are covered by the same isolation as the rest of your data (section 10), and deleting a client removes it from active storage — though invoices already issued keep the client details recorded on them, because an issued invoice is a financial record.

4. Signing in with Google

Google sign-in is optional. If you use it, Google shares your basic profile (name, email, profile picture) so we can create and secure your account. We don't receive your Google password, and your use of Google is governed by Google's own privacy policy.

5. Reviews & testimonials

If you submit a review, your name, role and comment may be displayed publicly on our website as a testimonial. Only submit what you're comfortable making public, and contact us if you'd like a review removed.

6. Your email credentials

If you connect your own SMTP server to send invoices from your address, your SMTP password is encrypted at rest (AES-256-GCM) and is used only to deliver mail on your behalf. It is never displayed back to you or shared. If you don't configure SMTP, we send invoices through our fallback delivery service.

7. Emails we send you

We send account-related emails, such as a welcome message when you sign up and payment or invoice notifications tied to how you use the service. These are transactional and necessary to operate your account rather than marketing.

8. Payment processing

Pro subscriptions are processed by Razorpay. Your card and payment credentials are handled directly by the payment processor and are never stored on our servers — we retain only non-sensitive records such as the transaction reference, amount and billing period.

Because Pro renews automatically, Razorpay holds a recurring mandate against your payment method and notifies us when a charge succeeds, fails or the subscription changes state. We store the subscription's reference and status so the app knows whether your access is current, when it renews, and whether auto-renewal has been cancelled. To set up a payment we share your name, email and phone number with Razorpay to pre-fill their checkout; their handling of your data is governed by Razorpay's own privacy policy. You can cancel auto-renewal at any time from the Upgrade page.

9. Third-party services we rely on

To run Inceipt we use a small set of trusted providers that process data on our behalf:

• Supabase (PostgreSQL): database, authentication and file storage.
• Razorpay: processing Pro subscription payments.
• Google: optional sign-in.
• Email delivery: your own SMTP server, or our fallback mail service when you haven't set one up.

These providers may process data in the regions where they host their infrastructure.

10. Where it's stored & security

Data is stored securely with our infrastructure provider (Supabase / PostgreSQL) and protected by row-level security, so each account can only ever access its own records. Uploaded logos are kept in private, per-user storage. Some settings (such as your local session and organization preferences) are also cached in your browser's local storage so the app works smoothly on your device. Authorized members of our team may access data only where necessary to operate the service or provide support.

11. Data retention

We keep your data for as long as your account is active so your invoices and history remain available. If you delete a record it is removed from active storage; if you close your account, your associated data is deleted (subject to any records we must retain to meet legal or accounting obligations).

12. Your rights

You can view, edit, export (as PDF) or delete your data at any time from within the app. To permanently delete your account and all associated data, contact us and we'll action it promptly. Depending on where you live, you may have additional rights to access or port your data.

13. Children

Inceipt is a business tool and is not intended for anyone under 16. We don't knowingly collect data from children.

14. Changes

We may update this policy from time to time. We'll revise the "last updated" date above and, where appropriate, notify you in the app.

15. Contact

Questions about privacy? Reach us via the contact page.