Privacy Notice

INVOXi is a product of Editbase Solutions, registered in South Africa. Editbase Solutions is the data controller (responsible party under South Africa’s Protection of Personal Information Act, or POPIA) for account, service and support information we determine how to use. Contact us at support@myinvoxi.com.

When a business uploads its customers’ records, that business is generally responsible for deciding why those records are used. We process those records on its behalf to provide INVOXi. If you are its customer, contact that business about your invoice or record first; we can assist with requests relating to our own processing.

• Account and identity details: name, email, authentication information and invitation details, used to create and secure accounts, verify access and manage permissions.
• Business and customer records: business names, contact details, addresses, branding, tax and banking details, quotes, invoices, receipts and recorded payments, used to provide document creation, sharing, payment tracking and related services.
• Subscription information: billing currency, plan, renewal dates and payment-provider customer/subscription identifiers, used to manage subscriptions and feature allowances.
• Support communications: messages and information you provide when requesting assistance, used to respond and resolve issues.
• Technical and usage information: IP addresses, device/browser identifiers and service logs where generated by our systems or providers, and AI usage metadata such as request type, success and token usage, used for security, troubleshooting, allowance tracking and service improvement.
• AI inputs: prompts, descriptions, customer names or invoice/business context submitted when you use AI tools, processed to generate the requested result. Avoid submitting unnecessary sensitive information. If using voice input, your browser or speech service may process audio under its own terms.

We process information as needed to perform our contract with you, meet legal obligations, and pursue legitimate interests such as securing and improving the service, balanced against your rights. Where required, optional processing relies on consent, which you may withdraw. We do not treat account creation as consent to unrelated marketing.

• Service providers supporting hosting, cloud storage, authentication, email delivery, support and technical operations. INVOXi uses Lovable Cloud and associated infrastructure.
• AI service providers through Lovable’s AI gateway when you request an AI feature; relevant inputs are sent to the selected model provider to produce the result.
• Paddle, our Merchant of Record, for selling subscriptions, subscription management, payments, tax compliance and invoicing. Paddle’s own processing is explained in its Privacy Policy.
• Professional advisers, including legal and accounting advisers, where necessary; and authorities where disclosure is required by law.
• People you choose to share documents with. Anyone who has a public invoice or quote link may be able to view that document, so share links carefully. Email and WhatsApp sharing also involve the services you choose.

We do not sell your personal information. Providers receive information needed for their role, subject to appropriate contractual and security safeguards.

Our providers may process information outside South Africa. Where information is transferred internationally, we use appropriate contractual or other lawful safeguards consistent with POPIA, including protections for the recipient’s handling of personal information. If applicable UK or EEA data protection law requires additional safeguards, these may include adequacy decisions or standard contractual clauses.

We keep account and business information while needed to provide your account and requested services. After account closure, information is deleted or anonymised when no longer required, subject to legal recordkeeping obligations, dispute resolution, fraud prevention and appropriate backup retention. Financial records may need to be retained for statutory periods.

Support and technical records are kept only as long as reasonably needed for their purposes. You may ask us about retention or request deletion at support@myinvoxi.com. Export important documents before closing your account.

We use appropriate technical and organisational measures, including encryption in transit and access controls, to protect personal information. No system can guarantee absolute security.

INVOXi stores account-specific records and pending changes on your device for offline use and synchronisation. Protect your device, avoid shared-device use for confidential work, and clear site data when disposing of a device. Clearing site data may remove changes that have not yet synchronised.

Essential browser storage and, where used by our providers, essential cookies support sign-in, security, checkout and offline records. Blocking them or deleting site data may prevent these functions from working.

INVOXi does not currently implement optional analytics or marketing cookies in its application. If introduced, we will explain their purpose and obtain consent where required before enabling them. You can manage cookies and site storage in your browser settings; payment and other third-party services may also provide their own controls and notices.

Under POPIA and other applicable law, you may request access to your personal information, correction or deletion, object to qualifying processing, withdraw consent where relied on, and complain to South Africa’s Information Regulator at inforegulator.org.za. Some requests are subject to lawful exceptions and identity verification.

Where GDPR or UK GDPR applies, rights may also include restriction, portability and objection, and the right to complain to your local supervisory authority. We respond within one month where required by that law, subject to permitted extensions.

Send requests or concerns to support@myinvoxi.com. We will respond within the applicable legal timeframe and explain any lawful limitations.

We may update this notice as the service or legal requirements change. The date above identifies the latest version; we will provide appropriate notice of material changes.