Invoistr
Legal

Privacy Policy

Effective date: April 3, 2026

This Privacy Policy explains how Bobcode s.r.o. ("Company," "we," "us," or "our") collects, uses, shares, and protects personal data when you use the Invoistr mobile application, the website at https://invoistr.com, the API at https://api.invoistr.com, and related services (together, the "Service").

1. Who We Are

Data controller:

2. Scope

This Privacy Policy applies to:

  • the Invoistr iOS application;
  • the website at https://invoistr.com;
  • the backend services that authenticate users, run OCR parsing and extraction workflows, store invoice records and uploaded invoice images or document files, manage plans and subscriptions, and support filtered exports, Google Drive export workflows, and CSV generation with scan links; and
  • our support, security, analytics, and diagnostics activities related to the Service.

This Privacy Policy does not apply to third-party services that have their own privacy notices, including Apple, Google, PostHog, and Sentry.

3. Personal Data We Collect

Depending on how you use the Service, we may collect the following categories of personal data.

A. Account and profile data

  • email address;
  • account identifier;
  • password submitted through email-and-password authentication;
  • account information returned after registration or sign-in; and
  • plan type and account status information.

B. Authentication and session data

  • access tokens and refresh tokens;
  • token expiry information;
  • session identifiers;
  • session issue, expiry, and last-used timestamps;
  • device name, app version, and similar session metadata used during token refresh and session management; and
  • session data stored locally in the iOS Keychain to keep you signed in.

C. Invoice and document data

  • uploaded or scanned invoice images and document files stored through the Service;
  • invoice images imported from your photo library, including multiple images you choose to process together in a batch;
  • invoice metadata, including vendor name, invoice number, invoice date, currency, gross totals, net totals, VAT amounts, and line items;
  • OCR text extracted from scanned invoices or receipts;
  • invoice records created from OCR parsing or manual edits;
  • invoice search and filter inputs used to query invoice records; and
  • CSV exports generated from your invoice data, including exports limited by your selected filters; and
  • export packages and related metadata created when you choose to export to Google Drive, including uploaded scan images and CSV files containing links to those uploaded scans.

D. Device-local files and permissions

Invoice images or document files and invoice records may be stored on backend systems through the Service. The app may also keep local cached copies, temporary files, or session-related data on your device.

  • local cached copies of invoice images or document files stored on your device to support app continuity or later viewing;
  • photo-library access, if you choose to import invoice or receipt images from your device;
  • temporary CSV export files stored locally on your device when you export invoices; and
  • camera access, if you choose to scan invoices or receipts.

E. Subscription and purchase data

  • subscription plan type;
  • Apple in-app purchase product identifiers;
  • Apple transaction and verification information; and
  • subscription status, renewal, and expiration information needed to validate paid access.

F. Usage, analytics, and diagnostics data

  • product events such as scan started, scan succeeded, scan failed, batch scan started, invoice created, invoice deleted, invoice exported, Google Drive export started, upgrade screen opened, subscription purchase started, subscription purchase succeeded, and subscription restore;
  • limited event properties such as whether a filter was applied, export criteria type, and scan source; and
  • crash reports, diagnostic information, app version, and operating-system version.

We currently configure analytics and diagnostics to avoid intentionally sending raw invoice text, OCR text, receipt images, email addresses, user IDs, and similar direct identifiers in analytics event properties. We also currently disable PostHog person profiles, automatic screen-view capture, and element-interaction capture in the mobile app configuration.

4. How We Collect Personal Data

We collect personal data:

  • directly from you when you register, sign in, reset your password, scan invoices, import invoice images from your photo library, process one or more invoice images in a batch, edit invoices, search invoices, filter invoices, export invoices, manage your account, delete your account, upgrade, or contact us;
  • from your device camera when you scan a receipt or invoice;
  • from your device photo library when you choose invoice or receipt images to import;
  • from OCR processing used to read text from scanned documents;
  • from optional language-model-assisted extraction features available through Apple platform frameworks on supported devices and operating-system versions;
  • from local device storage used to retain authentication sessions, cached files, and temporary export files;
  • from our backend when it receives and stores scanned invoice images or document files, parses OCR text, and stores, updates, returns, exports, uploads to Google Drive where you instruct us to do so, or deletes invoice records and related files;
  • from Apple when you use Sign in with Apple, buy or restore an App Store subscription, or manage your subscription;
  • from Google when you choose Google Sign-In; and
  • from service providers that help us measure product usage and diagnose crashes and errors.

Important implementation note: in the current iOS client flow, scanned invoice images or uploaded document files, OCR text, and structured invoice data may be uploaded to and stored by backend services to support parsing, storage, retrieval, updating, syncing where applicable, export, and deletion. The app may also keep local cached or temporary copies on the device.

5. How We Use Personal Data

We use personal data to:

  • create and manage user accounts;
  • authenticate users and maintain secure sessions;
  • keep users signed in on their devices, where available;
  • let you scan, upload, parse, create, update, search, filter, export, retrieve, and delete invoice records and related invoice images or files;
  • let you import invoice images from your photo library and process one or more images together in a batch workflow;
  • generate structured invoice data from OCR text;
  • store invoice images or files and invoice records on our servers and return them through the app and API;
  • retrieve previously uploaded invoice files for later viewing through the Service;
  • prepare filtered exports, upload scan images to Google Drive when you choose that export option, and generate CSV files with links to uploaded scans;
  • verify subscriptions, enforce plan limits, and manage trial or paid access;
  • provide customer support;
  • secure the Service, detect abuse, prevent fraud, and debug operational issues;
  • monitor reliability, investigate crashes, support the ongoing operation of the Service, and improve the Service; and
  • comply with legal obligations and enforce our agreements.

6. Automated Processing

The Service uses OCR and automated extraction tools to help convert scanned receipts or invoices into structured invoice data. These tools can make mistakes, omit data, misclassify text, or produce incomplete or inaccurate outputs.

You should review extracted information before relying on it.

We do not use these OCR and extraction features to make solely automated decisions about users that produce legal or similarly significant effects.

7. Legal Bases for Processing

If data protection laws such as the GDPR apply, we generally rely on one or more of the following legal bases:

  • contract: where processing is necessary to provide the Service you request;
  • legitimate interests: where processing is necessary to secure, maintain, troubleshoot, improve, and defend the Service;
  • legal obligation: where we must process data to comply with law, lawful requests, tax obligations, accounting obligations, or regulatory requirements; and
  • consent: where consent is required, including for device permissions such as camera access where applicable.

Where we rely on consent, you may withdraw it at any time, but that will not affect processing carried out before withdrawal.

8. When We Share Personal Data

We may share personal data with:

  • hosting, cloud, and infrastructure providers that operate the Service on our behalf;
  • file storage, object storage, and similar technical providers that store or serve invoice files and related data on our behalf;
  • Apple, including for Sign in with Apple, App Store billing, subscription restoration, and subscription verification flows;
  • Google, if you choose Google Sign-In or export files to Google Drive;
  • PostHog, which we use for product analytics;
  • Sentry, which we use for crash reporting and diagnostics;
  • professional advisers, auditors, insurers, or potential acquirers where reasonably necessary; and
  • courts, regulators, law-enforcement authorities, or other third parties where required by law or necessary to protect rights, safety, and security.

We do not sell personal data for money. Based on the current app implementation, we also do not use third-party advertising SDKs or configure the mobile app for cross-context behavioral advertising.

9. International Transfers

Some service providers may process personal data outside your country, including outside the European Economic Area. Where required by law, we will use appropriate safeguards for international transfers, such as contractual protections or other recognized transfer mechanisms.

10. Data Retention

We keep personal data only as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, comply with law, resolve disputes, and enforce agreements.

In general:

  • account data, invoice records, and stored invoice images or document files are retained for as long as needed to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security;
  • when you delete an invoice or delete your account, production account data, invoice records, and stored invoice files are deleted or de-identified unless retention is legally required, subject to technical limitations;
  • authentication and session data are retained as long as necessary to manage active sessions, security, and account access;
  • session data stored in the iOS Keychain may remain on the device until logout, deletion, token expiry handling, device reset, or removal of local app data;
  • subscription verification and plan-status data are retained as needed to provide paid or trial access;
  • analytics and diagnostics data are retained according to our operational needs and provider settings;
  • local cached invoice images or document files stored by the app may remain on your device until you delete them, remove the app, clear device storage, or otherwise remove local app data;
  • exported CSV files created by the app may remain in temporary device storage until they are removed by you, overwritten, cleared by the system, or deleted with app data;
  • files exported to Google Drive and scan-image links included in exported CSV files may remain in your Google Drive account until you delete them there; and
  • backup, cache, and similar residual copies may persist for a limited period before rotation, overwrite, or deletion.

Important deletion note: deleting an invoice removes the related server-side invoice record and stored invoice file from active production systems subject to retention obligations and technical limitations. Local cached copies or export files already saved on your device may still need to be removed separately through the device or by deleting the app and its local data.

11. Security

We use reasonable technical and organizational measures designed to protect personal data. However, no system is completely secure, and we cannot guarantee absolute security.

12. Your Rights and Choices

Depending on your location, you may have the right to:

  • access the personal data we hold about you;
  • correct inaccurate or incomplete personal data;
  • request deletion of your personal data;
  • restrict or object to certain processing;
  • receive a portable copy of certain personal data;
  • withdraw consent where processing is based on consent; and
  • lodge a complaint with your local data protection authority.

You can also:

  • delete your account through the app's account screen, where available;
  • log out of your device session by signing out through the app;
  • manage or cancel subscriptions through your Apple App Store account settings; and
  • control device permissions such as camera access through your device settings.

If you delete an invoice, the related server-side invoice record and stored invoice file are removed from active production systems subject to retention obligations and technical limitations. Local cached copies or temporary files on your device may remain until they are separately removed.

To exercise privacy rights, contact us at info@invoistr.com. We may need to verify your identity before completing a request.

13. Children

The Service is not directed to children, and we do not knowingly collect personal data from children in violation of applicable law. If you believe a child has provided personal data to us, contact us so we can review and address the issue.

14. Third-Party Services

The Service may rely on third-party services, including:

  • Apple;
  • Google, including Google Drive where you choose that export option;
  • PostHog; and
  • Sentry.

Those third parties process data under their own terms and privacy notices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version on our website or otherwise notify you as required by law. The "Effective date" above shows when this version became effective.

16. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our data practices, contact:

Bobcode s.r.o. Tolstého 5, Bratislava, 811 06, Slovakia Email: info@invoistr.com