Privacy Policy

This Privacy Policy describes how Invoral ("Invoral", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you access or use the Invoral website and invoicing platform at invoral.com (the "Service"). It is our notice to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and our privacy policy under the Information Technology Act, 2000 and the rules made under it. Our registered business details are set out in Section 13.

1. Personal Data We Collect

We collect only the personal data necessary to provide the Service, namely:

1. Account data — your name, email address and password (stored only in hashed form), and records of sign-up and sign-in;
2. Business profile data — business name, address, GSTIN, PAN, contact details, logo, signature, bank account and UPI details and, where applicable, particulars required for the export of services;
3. Client data — particulars of your clients entered by you, including name, contact details, address, GSTIN, PAN and, for clients outside India, country, currency and tax identification number;
4. Document data — invoices, proforma invoices, quotations and payment records created by you, including amounts, taxes and related particulars;
5. Billing data — the billing name, GSTIN, state and address provided at checkout, and payment references and status. We do not receive your full card, UPI or bank credentials;
6. Communications — requests, reports and correspondence you send us, including any attachments; and
7. Technical data — IP address, the approximate location derived from it (city, region and country), browser, operating system and device type or model, and records of sign-ins, sign-outs and the devices signed in to your Account, used to secure the Service, to show you the devices signed in to your Account, and to detect and prevent misuse.

Passwords and financial information such as bank account details constitute sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. They are collected with your consent and used only for the purposes set out in this Policy.

2. Purposes of Processing

We process personal data to:

1. provide, operate and maintain the Service;
2. authenticate Users, secure Accounts and prevent fraud and misuse, including misuse of free trials and the Free Plan;
3. send service communications, including verification codes, tax invoices, Plan reminders and responses to requests;
4. comply with legal obligations, including those under GST law;
5. respond to queries and grievances; and
6. improve the Service, using aggregated information.

We do not sell personal data, and do not use it for advertising or profiling.

3. Grounds for Processing

We process personal data on the basis of: (a) your consent, given when you create an Account and accept this Policy, which you may withdraw at any time by writing to us (withdrawal does not affect processing already carried out, but may require the closure of your Account where the Service cannot be provided without such data); and (b) the legitimate uses permitted under Section 7 of the DPDP Act, including the processing of data voluntarily provided for a specified purpose and processing required for compliance with law.

4. Data Processed on Your Behalf

In respect of the personal data of your clients entered into the Service, you act as the Data Fiduciary, and Invoral processes such data solely on your behalf as a Data Processor. You are responsible for having a lawful basis for such processing, for giving any notice required to your clients, and for responding to their requests.

5. Storage, Transfer and Security

5.1 Personal data is stored on secure servers located in Singapore. Such transfer outside India is permitted under Section 16 of the DPDP Act, and our service providers are bound to protect the data so transferred.

5.2 We maintain reasonable security practices and procedures, including encryption of data in transit and of sensitive client data at rest, storage of passwords in hashed form only, segregation of each Account's data, access controls, and safeguards against unauthorised access.

5.3 Access to personal data is restricted to authorised personnel who require it to operate the Service and who are bound by obligations of confidentiality. Individual records are accessed only at your request, to investigate a security incident or misuse, to resolve a fault, or where required by law.

5.4 No method of transmission or storage is completely secure. We nevertheless take reasonable technical and organisational measures to protect personal data.

5.5 For recovery in the event of a technical failure, encrypted backup copies of the data are kept in a location separate from the primary servers, accessible only to us. Backup copies are deleted on a rolling basis within twelve (12) months.

6. Cookies and Browser Storage

Invoral does not use advertising or tracking cookies. We use browser storage only as strictly necessary to provide the Service, including to maintain your session, remember your preferences and secure the Service. Our security and payment service providers may set cookies that are strictly necessary for those purposes.

7. Disclosure of Personal Data

We disclose personal data only:

1. to service providers engaged to operate the Service, including providers of hosting, security, payment processing, communication and verification services, to the extent necessary for them to perform their services and subject to obligations of confidentiality. Payments are processed by Razorpay Software Private Limited;
2. where required by law, by order of a court, or at the direction of a governmental authority; and
3. in connection with a merger, acquisition or transfer of the business, subject to protection equivalent to that under this Policy.

We do not sell personal data.

8. Retention

8.1 We retain personal data for as long as your Account remains active. You may delete clients and draft documents at any time, and may request deletion of your Account by writing to [email protected]. Such requests are completed within thirty (30) days.

8.2 On deletion of an Account, the associated personal data is erased, except: (a) tax invoices, credit notes and payment records, which are retained for the period prescribed under GST law; (b) security records, including records of sign-ins and of the devices used, which are retained for one (1) year; (c) limited information necessary to prevent misuse of free trials and the Free Plan, which is retained in protected form; and (d) copies held in the encrypted backups described in clause 5.5, which are deleted on a rolling basis within twelve (12) months.

9. Your Rights

Subject to the DPDP Act, you have the right to:

1. obtain a summary of your personal data and of the processing undertaken;
2. seek the correction, completion, updating or erasure of your personal data;
3. withdraw your consent;
4. have your grievances redressed; and
5. nominate another individual to exercise your rights in the event of your death or incapacity.

Requests may be made by writing to [email protected] from your registered email address, and are responded to within one (1) month. If your grievance is not resolved to your satisfaction, you may complain to the Data Protection Board of India.

10. Children

The Service is intended for businesses and professionals and is not directed at persons under eighteen (18) years of age. We do not knowingly process the personal data of children, and any such data brought to our attention will be deleted.

11. Personal Data Breach

In the event of a personal data breach, we shall inform affected Users without undue delay and notify the Data Protection Board of India and other authorities, as required by law.

12. Changes to this Policy

We may amend this Policy from time to time. The "Last updated" date indicates the current version. Material changes shall be notified by email or within the Service before they take effect. Continued use of the Service after a change takes effect constitutes acceptance of the amended Policy.

13. Contact and Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, queries, requests and grievances relating to personal data may be addressed to our Grievance Officer: