Privacy Policy

Last Updated: November 6, 2025

Effective Date: November 6, 2025

1. Information We Collect

1.1 Information You Provide to Us

Account Information:

• Email address and password (required for account creation and authentication via email/password sign-in)
• Password is encrypted and stored securely by Firebase Authentication

Business Profile Information:

• Business name
• Business email address
• Business phone number
• Business address
• Business logo (optional)

Invoice and Customer Data:

• Customer names, email addresses, phone numbers, and addresses
• Invoice details including line items, amounts, dates, and notes
• Tax rates and calculations
• Currency preferences
• Custom notes and descriptions

User Preferences:

• Theme preferences (light, dark, or system)
• Analytics opt-in/opt-out preferences

1.2 Information Collected Automatically

Device and Usage Information:

• Device type and model
• Operating system and version
• App version
• Unique device identifiers
• Time zone and language settings
• App usage patterns and feature interactions (only if analytics is enabled) - this includes non-personally identifiable information such as which screens you visit, which features you use most often, and how long you spend in the app

Error and Performance Data:

• Crash reports and error logs
• Performance metrics
• Diagnostic information (only if error tracking is enabled)

1.3 Information We Do NOT Collect

• PDF invoice files (stored only on your device)
• Payment card information (handled directly by Apple/Google)
• Precise geolocation data
• Biometric data
• Contact list or calendar data
• Photos or media (except business logos you explicitly upload)

2. How We Use Your Information

2.1 Core Functionality

• Create and manage your account
• Authenticate your identity
• Store and sync your invoice and customer data across your devices
• Process and manage your subscription
• Enable offline functionality with cloud synchronization
• Store and retrieve your business logo

2.2 Service Improvement (Optional)

• Analyze app usage patterns to improve features (only if analytics is enabled)
• Identify and fix bugs and performance issues (only if error tracking is enabled)
• Understand which features are most valuable to users

2.3 Communication

• Send transactional emails (account verification, password resets)
• Respond to your support requests
• Notify you of important service changes or updates

2.4 Legal Compliance

• Comply with applicable laws and regulations
• Enforce our Terms of Service
• Protect our rights and prevent fraud

3. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties. We only share your information in the following limited circumstances:

3.1 Service Providers

We use trusted third-party services to operate our App:

Firebase (Google LLC)

• Purpose: Authentication, cloud database, file storage, and analytics
• Data Shared: Email, encrypted authentication data, invoice metadata, business profile, usage analytics (if enabled)
• Privacy Policy: https://firebase.google.com/support/privacy

RevenueCat

• Purpose: Subscription management and in-app purchase processing
• Data Shared: User ID, subscription status, purchase history
• Privacy Policy: https://www.revenuecat.com/privacy

Sentry

• Purpose: Error tracking and crash reporting (if enabled)
• Data Shared: Error logs, device information, app state at time of error
• Privacy Policy: https://sentry.io/privacy/

Apple App Store / Google Play Store

• Purpose: Payment processing and subscription management
• Data Shared: Handled directly by Apple/Google
• Privacy Policy: Apple / Google

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, or government agencies).

3.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

4. Data Storage and Security

4.1 Where Your Data is Stored

On Your Device (Local Storage):

• Complete invoice and customer database (SQLite)
• Generated PDF files
• Business logo (cached copy)
• User preferences

In the Cloud (Firebase):

• Account credentials (encrypted)
• Invoice and customer metadata (for cross-device sync)
• Business profile information
• Business logo (original file)

Important: PDF files are never uploaded to the cloud. They remain on your device only.

4.2 Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data transmitted between your device and our servers uses TLS/SSL encryption
• Authentication: Secure Firebase Authentication with encrypted password storage
• Access Controls: Strict database security rules ensure users can only access their own data
• Regular Audits: We regularly review and update our security practices

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

4.3 Data Retention

• Active Accounts: We retain your data for as long as your account is active and you continue to use the App
• Archived Invoices: Invoices you move to archive are retained in your account for your record-keeping until you permanently delete them or delete your account
• Account Deletion: When you delete your account, we initiate immediate deletion from:
  • Firebase Authentication (your login credentials)
  • Firestore (invoice metadata, customer data, business profile)
  • Local device storage (SQLite database, PDFs, cached files)

  Complete removal from third-party backup systems maintained by our cloud provider (Firebase/Google Cloud Platform) may take up to 30 days per their data retention policies. We cannot accelerate this timeline as backup retention is controlled by Google Cloud Platform. This action cannot be undone.

5. Your Rights and Choices

5.1 Access and Portability

• View Your Data: Access all your data through the App interface
• Export Your Data: Use the "Export My Data" feature in Settings to download all your data in JSON format

5.2 Correction and Deletion

• Edit Information: Update your business profile, customer data, and invoices at any time
• Delete Account: Permanently delete your account and all associated data through Settings → Danger Zone → Delete Account

5.3 Analytics and Error Tracking Control

• Opt Out: Disable analytics collection at any time in Settings → Privacy → "Share anonymous analytics" toggle
• What This Controls: This single toggle controls BOTH:
  • Firebase Analytics (app usage patterns, screen views, feature usage)
  • Sentry error tracking (crash reports and diagnostic data)
• Effect: When opted out, NO analytics or error data is sent to Firebase or Sentry
• Default: Analytics and error tracking are enabled by default; you may opt out at any time
• Takes Effect: Changes take effect on next app restart for error tracking; analytics changes are immediate

5.4 Marketing Communications

We do not send promotional emails. You will only receive transactional emails necessary for account management.

5.5 Your Regional Rights

For EU/EEA Residents (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

GDPR Lawful Bases for Processing:

We process your personal data based on the following lawful bases under GDPR Article 6:

Processing Activity	Lawful Basis	Explanation
Account creation and authentication	Contract	Necessary to provide the App services you requested
Invoice and customer data storage/sync	Contract	Necessary to deliver the core invoicing functionality
Subscription management and billing	Contract	Necessary to manage your paid subscription
Business logo storage	Contract	Necessary to provide invoice customization features
Transactional emails (verification, password resets)	Contract	Necessary for account security and service delivery
Analytics and usage tracking	Consent	Only collected if you enable "Share anonymous analytics"
Error tracking and crash reports	Consent	Only collected if you enable analytics (opt-out applies to both)
Security and fraud prevention	Legitimate Interest	Necessary to protect our services and users
Legal compliance	Legal Obligation	Required to comply with applicable laws

You have the right to withdraw consent at any time for processing based on consent (analytics and error tracking) through Settings → Privacy.

For California Residents (CCPA/CPRA):

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific rights regarding their personal information.

Notice at Collection:

We collect the following categories of personal information and use them for the purposes described:

Category	Examples from Our App	Business Purpose	Sold/Shared?
Identifiers	Email address, device identifiers, user ID	Account creation, authentication, sync across devices	No
Customer Records	Business name, phone, address, email	Store and display business profile on invoices	No
Commercial Information	Subscription status, purchase history, invoice records	Manage subscription, provide invoicing functionality	No
Internet/Network Activity	Device type, OS version, app interactions, error logs	Analytics (opt-in), error tracking (opt-in), service improvement	No
Professional Information	Business profile, customer database, invoice line items	Provide core invoicing and business management features	No
Visual Information	Business logo (optional)	Customize invoices with your branding	No

Retention: We retain personal information for as long as your account is active. When you delete your account, we initiate immediate deletion from Firebase Authentication, Firestore, and local device storage. Complete removal from third-party backup systems (Firebase/Google Cloud Platform) may take up to 30 days per their data retention policies.

Sale and Sharing: We do NOT sell or share your personal information for cross-context behavioral advertising. We do NOT sell or share personal information of minors under 16.

Sensitive Personal Information: We collect your account password (encrypted) for authentication. We do not use or disclose sensitive personal information except as necessary to provide the App services.

Your CCPA/CPRA Rights:

• Right to know what personal information is collected
• Right to know whether personal information is sold or disclosed
• Right to say no to the sale of personal information (we do not sell data)
• Right to access your personal information
• Right to equal service and price (no discrimination)
• Right to request deletion of personal information
• Right to correct inaccurate personal information
• Right to limit use and disclosure of sensitive personal information

Exercising Your Rights: Contact us at info@cavoreum.com or use the in-app data export and account deletion features. We will respond within 45 days. You may designate an authorized agent to make requests on your behalf.

For South African Residents (POPIA):

Under the Protection of Personal Information Act 4 of 2013 (POPIA), South African residents have specific rights regarding their personal information.

Information Officer:
Cavoreum
Email: info@cavoreum.com
Address: Unit 1 Boskruin View Office Park, 1 Girdwood Avenue, Johannesburg, 2125

Lawful Processing Conditions:

We process your personal information in compliance with POPIA's 8 conditions for lawful processing:

1. Accountability: We implement appropriate measures to ensure compliance with POPIA
2. Processing Limitation: We process information only for the purposes disclosed in this policy
3. Purpose Specification: See Section 2 "How We Use Your Information" for detailed purposes
4. Further Processing Limitation: We do not process information for purposes incompatible with original collection
5. Information Quality: You can update your information at any time through the App
6. Openness: This Privacy Policy provides transparent information about our processing activities
7. Security Safeguards: See Section 4.2 "Data Security" for our security measures
8. Data Subject Participation: See below for your rights

Your POPIA Rights:

• Right to access your personal information
• Right to correction of inaccurate or incomplete information
• Right to deletion of personal information (where no legal obligation to retain)
• Right to object to processing based on legitimate interests
• Right to object to direct marketing (we do not engage in direct marketing)
• Right to lodge a complaint with the Information Regulator
• Right to request restriction of processing
• Right not to be subject to automated decision-making (we do not use automated decisions)

Cross-Border Transfers:

Your personal information may be transferred to countries outside South Africa (including the United States for Firebase and Sentry services). We ensure adequate safeguards are in place through:

• Standard Contractual Clauses
• Service provider security commitments
• Compliance with international data protection frameworks

Information Regulator Contact:

If you believe we have not complied with POPIA, you may lodge a complaint with:

Information Regulator (South Africa)
Email: inforeg@justice.gov.za
Website: https://www.justice.gov.za/inforeg/

Exercising Your Rights: Contact our Information Officer at info@cavoreum.com or use the in-app data export and account deletion features.

6. Children's Privacy

Invoice Easy is not intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

7. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ.

If you are located outside the United States and choose to provide information to us, please note that we transfer data, including personal information, to the United States and process it there.

By using the App, you consent to this transfer and processing.

For EU/EEA residents, we ensure appropriate safeguards are in place for international data transfers, including reliance on:

• Adequacy decisions by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework (where applicable)

8. Third-Party Links

The App may contain links to third-party websites or services (e.g., when sharing invoices via email or messaging apps). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the new Privacy Policy in the App
• Updating the "Last Updated" date at the top of this policy
• Sending you a notification through the App or via email (for significant changes)

Your continued use of the App after any changes indicates your acceptance of the updated Privacy Policy.

10. California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

11. Do Not Track Signals

Some web browsers have a "Do Not Track" feature. Because there is no common understanding of how to interpret Do Not Track signals, our App does not currently respond to Do Not Track signals. We do, however, provide you with the ability to opt out of analytics tracking through the in-app Settings.

12. Data Controller and Representative

Data Controller:
Cavoreum
Unit 1 Boskruin View Office Park
1 Girdwood Avenue
Johannesburg, 2125
Email: info@cavoreum.com