Privacy Policy

1. Organization Details

Invoflux operates under FUN MANAGEMENT SRL, registered in Cluj-Napoca, Romania (Registration: RO23772000). The service provides AI-powered invoice collection and financial automation tools for businesses.

2. Data Collection

User-Provided Information

• Personal details (name, email, company)
• Account credentials and billing data
• Support communications

Business & Financial Data

• Invoices in various formats
• Invoice metadata (supplier, amount, dates, VAT)
• Bank transaction references
• Accounting documents via email or WhatsApp

Automatically Collected

• IP addresses and device information
• Usage logs and browsing activity
• Cookies and tracking technologies

3. How We Use Your Information

We use collected information to operate services, extract invoice data, enhance AI features, communicate with users, provide support, and meet legal requirements. We do not sell personal data and do not use your business documents for advertising purposes.

4. Legal Basis for Processing (GDPR)

We process your data under the following legal bases: contractual necessity, legitimate interests, legal obligations, and explicit consent where required.

5. Third-Party Data Sharing

Data is shared only with essential service providers (cloud infrastructure, email services, payment processors, and AI providers) under confidentiality agreements. We do not sell or share your data for advertising purposes.

AI Providers

Invoflux uses artificial intelligence to read invoice documents, categorize transactions, suggest invoice-to-payment matches, and answer questions you ask the AI assistant. For these features, document contents and related business data are processed by the following AI providers acting on our behalf:

• Anthropic (Claude models): invoice data extraction, document classification, bank statement parsing, transaction categorization, and the AI assistant
• Google (Gemini models): invoice-to-transaction matching suggestions
• OpenAI: search indexing (embeddings) and duplicate detection

These providers process your data only to provide the requested functionality, under API terms that do not permit using your data to train their models. AI-extracted values and AI-suggested matches are always visible in the app, and you can correct or undo them at any time.

6. Data Retention

We retain your information while your account remains active, as needed for service provision, and as legally required. You may request deletion at any time.

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption at rest and in transit
• Access controls and role-based permissions
• EU-hosted secure cloud infrastructure
• Regular security audits and monitoring

8. Cookies

We use cookies for authentication, session management, and analytics. You can manage cookie preferences through your browser settings.

9. Your Rights & Data Deletion

You have the right to:

• Access your personal data
• Request corrections or restrictions on processing
• Request deletion of your data
• Withdraw consent at any time

How to Request Data Deletion

1. In-app: Account Settings → Privacy & Data → Request Data Deletion (processed within 30 days)
2. Email: Send a request to [email protected] with subject "Data Deletion Request"

Upon deletion, your personal account data, documents, invoices, metadata, and logs are deleted or anonymized. Legally-required data is retained in restricted form.

10. Third-Party Integrations

Integrations (WhatsApp, email, cloud drives) process data solely for requested functionality. You can disconnect at any time; deletion requests apply equally to integrated data.

11. Google API Services

Gmail (gmail.readonly)

• Scans inbox for invoice emails using filters
• Extracts PDF attachments
• Reads metadata (sender, subject, date)
• Does NOT read email body text, send emails, or modify your inbox

Google Drive (drive.file)

• Creates an "Invoflux" folder for backups
• Uploads extracted invoices
• Can share with specified accountants
• Accesses ONLY Invoflux-created files

Restrictions

We do not share data with third parties for advertising, do not use data for non-invoice-related purposes, and do not retain data after you disconnect.

User Controls

You can disconnect Google services from Settings > Data Privacy. Disconnecting immediately revokes tokens. Deletion of Google-sourced data is available in settings.

12. Children's Data

Our service targets businesses only. We do not knowingly collect data from children under 16.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted with revised dates. We will notify you of significant changes by email or through the application.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected].