Privacy Policy

For the purposes of the EU General Data Protection Regulation (“GDPR”), the UK GDPR and other applicable data protection laws, InvoiceBirds is the controller of the personal data described in this policy, except where section 2 provides otherwise.

You can contact us about any privacy matter, including to exercise your rights, at help@invoicebirds.com.

When you use InvoiceBirds, you may add information about your own clients and contacts, such as names, email and postal addresses, tax identification numbers and the content of invoices, estimates, proposals and contracts (“Customer Data”).

For Customer Data, you are the controller and InvoiceBirds acts as your processor. We process Customer Data only to provide the Services to you, on your documented instructions and in accordance with the data protection terms in section 13 of our Terms of Service.

If you are a client of one of our customers and want to exercise your rights over data that a business holds about you in InvoiceBirds, please contact that business directly. If you contact us instead, we will forward your request to it.

Information you provide

• Account information: your name, email address, password (stored only in hashed form) and language preference.
• Business profile: your business name, logo, address, phone number, website, tax and company registration numbers, the bank or payment details you choose to display on your documents, and your default settings.
• Subscription and billing information: your plan, billing period, billing address and transaction history. Card details are collected and processed by our payment provider. We do not store full card numbers.
• Communications: the messages you send to our team by email, chat or video call, and any feedback you give us.
• Newsletter: your email address and your subscription preferences.

Customer Data

The information about your clients and contacts described in section 2.

Requests to Birdy

The instructions you give Birdy, our smart assistant, and the drafts that Birdy prepares in response.

Information collected automatically

• Device and log data: IP address, browser type and version, operating system, pages viewed, referring pages, and the dates and times of access.
• Usage data: how you use features of the Services, so that we can keep them reliable and improve them.
• Cookies and similar technologies: as described in section 12.

Information from third parties

When you connect Stripe to accept online payments, we receive payment information from Stripe, such as the status, amount and date of a payment, so that your invoices can be marked as paid.

We use personal data only for the following purposes, each based on a legal basis under the GDPR:

• To create and manage your account and provide the Services, including sending your documents and the payment reminders and notifications you have turned on. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
• To process your subscription and payments and to issue invoices for our own fees. Legal bases: performance of a contract, and compliance with our legal obligations, including tax and accounting rules (Article 6(1)(c)).
• To provide support, including migration help on paid plans. Legal basis: performance of a contract.
• To keep the Services secure, prevent fraud and abuse, and enforce our Terms. Legal basis: our legitimate interests in protecting our users and our business (Article 6(1)(f)).
• To understand how the Services are used and improve them, using aggregated or pseudonymised data wherever possible. Legal basis: our legitimate interest in developing a better product.
• To send service announcements, such as security notices or changes to our terms. Legal bases: performance of a contract and compliance with legal obligations.
• To send our newsletter and product news. Legal basis: your consent (Article 6(1)(a)), or, for existing customers and where the law allows it, our legitimate interest in telling you about similar services. You can unsubscribe at any time.
• To comply with the law, respond to lawful requests from public authorities, and establish, exercise or defend legal claims. Legal bases: compliance with legal obligations and our legitimate interests.

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to this processing as described in section 11.

Birdy prepares and edits documents from your instructions, using the clients, items, prices and tax settings saved in your account. To do this, the content of your request and the relevant data in your account are processed by Birdy and by the service providers that power its language processing, acting on our behalf.

• Birdy acts only on your requests and only within your own account.
• Nothing that Birdy prepares is sent to anyone until you have reviewed and approved it.
• Birdy does not make decisions about you that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.
• We require these providers to process data only to provide their service to us, to keep it confidential and secure, and not to use your requests or Customer Data to train their own general-purpose models.

When you connect a Stripe account to accept card payments from your clients, those payments are processed by Stripe, Inc. and its affiliates (“Stripe”) under Stripe’s own terms and privacy policy. Card details entered by your clients are collected directly by Stripe and are never stored on our servers.

We do not sell personal data, and we do not share it for targeted advertising. We share it only as follows:

• Service providers that host our infrastructure, deliver emails, process payments, provide customer support tools, measure usage and power Birdy. They act on our instructions under written contracts that include data protection obligations.
• The people you send documents to. When you send an invoice, estimate, proposal or contract, or share a link, the recipient sees the content you chose to send, together with your business details.
• Professional advisers, such as lawyers, accountants and auditors, who are bound by duties of confidentiality.
• Public authorities, where required by law, a court order or a valid legal request, or where necessary to protect the rights, property or safety of InvoiceBirds, our users or others.
• A successor business, in connection with a merger, acquisition, financing or sale of all or part of our business, provided that your personal data remains protected as described in this policy. We will notify you before your data becomes subject to a different privacy policy.

We may also share aggregated or anonymised information that does not identify you.

Some of our service providers are located outside the European Economic Area (EEA) and the United Kingdom. When we transfer personal data to a country that is not recognised as providing an adequate level of protection, we rely on appropriate safeguards, such as the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum, together with supplementary measures where needed. You can ask us for a copy of these safeguards at help@invoicebirds.com.

We keep personal data only for as long as necessary for the purposes described in this policy:

• Account data and Customer Data are kept while your account is active. When you delete your account, we delete or anonymise them within 30 days. Copies held in encrypted backups are overwritten within a further 90 days.
• Billing records for our own fees are kept for the period required by applicable tax and accounting laws, which can be up to 10 years.
• Support communications are kept for up to 3 years after your last contact with us.
• Newsletter data is kept until you unsubscribe. We then keep only your email address on a suppression list, so that we do not contact you again.
• Log data is kept for up to 12 months, unless we need it for longer to investigate a security incident.

You are responsible for keeping your own invoices and business records for as long as the law requires. Please download any documents you need before you delete your account.

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These include:

• encryption of data in transit using TLS with 256-bit encryption;
• access to production systems restricted to authorised personnel who need it, and logged;
• optional two-factor authentication for your account; and
• share links that give access only to the document you chose to share.

No system is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, without undue delay.

Subject to the conditions set by applicable law, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict the processing of your data;
• receive your data in a structured, commonly used and machine-readable format, and have it transmitted to another controller;
• object at any time to processing based on our legitimate interests, and to direct marketing;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before; and
• where French law applies, give instructions about what happens to your personal data after your death.

You can update most of your information in Settings, and delete your account in Settings, under Profile. To exercise any other right, write to us at help@invoicebirds.com. We will reply within one month. For complex or numerous requests, this period may be extended by two further months, in which case we will let you know. We may ask you to confirm your identity before we act on a request.

You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work, such as the Commission Nationale de l’Informatique et des Libertés (CNIL) in France or the Information Commissioner’s Office (ICO) in the United Kingdom. We would, however, appreciate the chance to address your concerns first.

We use cookies and similar technologies that are strictly necessary to run the Services, for example to keep you signed in, to protect forms against abuse and to remember your language choice. These do not require your consent.

We use analytics or other non-essential cookies only with your consent where the law requires it, and you can withdraw that consent at any time. You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the Services may not work.

We send service emails that are part of the Services, such as account, security and billing messages. You can choose which notifications you receive in Settings. We send our newsletter and marketing emails only as described in section 4, and every one of them includes a link to unsubscribe.

The Services are intended for professionals and businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe that a child has provided us with personal data, please contact us and we will delete it.

The Services may link to, or integrate with, websites and services run by third parties, such as Stripe. Their handling of your data is governed by their own privacy policies, and we encourage you to read them.

We may update this policy from time to time. The date at the top shows when it was last changed. If we make a material change, we will tell you by email or in the app, where reasonably possible at least 30 days before the change takes effect.

For any question about this policy or your personal data, write to us at help@invoicebirds.com.