Privacy Policy

1. Who is responsible

Nexora Soft Tech runs Invoquro. For your account data we are the controller. For your clients' data that you put into Invoquro, you are the controller and we process it on your behalf. [Legal entity, address, and a data processing agreement for business customers to be added.]

2. What we collect

• Account: your name, email address, a hash of your password (never the password itself), and when you sign in.
• Workspace content: business profile, clients, projects, invoices, proposals, contracts and the images you upload.
• Payments: your plan and payment records. Card and wallet details are handled by the payment provider, not stored by us.
• Security records: an audit log of important actions, including the IP address they came from.
• AI usage: how many AI requests you make and their size. We do not store the prompts or the AI's replies.

3. Why we use it

To provide the service you signed up for, to keep it secure, to bill you, to send the emails you ask us to send, and to meet legal obligations such as keeping invoices. [Legal bases under GDPR to be confirmed for each purpose.]

4. Who we share it with

• Our hosting and database providers. [Names and regions to be listed.]
• Our email provider, to deliver emails you send through Invoquro.
• Google (Gemini), only for text and documents you submit to an AI feature.
• Payment providers you or we use (such as PayPal, SSLCommerz or bKash), for payments.

We do not sell personal data. [International transfer safeguards to be described.]

5. How long we keep it

• Documents uploaded for AI reading are deleted straight after they are read; what was read is deleted after 24 hours if not saved.
• IP addresses in the audit log are removed after 90 days.
• In-app notifications are deleted after 180 days.
• Invoices and payment records are kept as long as tax law requires, also after an account is deleted. [Periods to be confirmed per country.]

6. Cookies and local storage

Invoquro does not use advertising or analytics cookies. Your browser stores your sign-in token and a few preferences (such as a collapsed sidebar) in local storage. Signing out removes the token.

7. Your rights

You can download your data and ask for your account or a workspace to be deleted from the Account page. Depending on where you live you may also have rights to access, correct, restrict or object to processing, and to complain to a data protection authority. [Contact route for rights requests to be added.]

8. Security

Passwords are hashed, payment credentials are encrypted, links that work like passwords are stored only as hashes, and administrators use two-step sign-in. No system is perfectly secure; we will tell you about a breach that affects you as the law requires.

9. Changes

We will update this policy as the service changes and tell you about important changes.