Privacy policy in plain language

Last updated October 19, 2026

Who we are

invoicetools.com is operated by Invoice Tools Inc, a Texas corporation. The service is run in the United States and is intended for US businesses at launch. For any privacy question or request, email contact@invoicetools.com.

Using the tools without an account

Every calculator and document generator on this site is a page that does its work on your own device. The figures you enter, the client details on an invoice and the logo you add to a template are read in your browser and are not uploaded unless you use one of the features listed above. In the normal flow there is no upload step, so there is no copy on our side to keep.

What is kept on your device

Some tools remember things in your browser's local storage, on your own device. The invoice generator, the quote generator, the cost estimator, the receipt maker, the credit note, sales order, purchase order, work order, account statement, proforma invoice, packing slip and timesheet generators, and the six file-format template pages (Word, Excel, PDF, online document, online spreadsheet and the blank invoice template) keep a draft there, so you can pick up after a refresh or a closed tab. The invoice generator asks before restoring its draft. Most tools also remember small display choices, such as which optional fields you revealed, Simple or Advanced view, line-item presets you added yourself and your document language. None of this is sent to us. To remove it, use Clear in the generator, decline its restore prompt, or clear this site's data in your browser settings. The calculators keep only those display choices: close the tab and what you typed is gone.

• No account needed to use any calculator or generator.
• The tools do not upload what you type. Data leaves your device only if you choose an account, a shared or tracked link, the AI helper or Pay now, each described below.
• PDFs are produced on your device, not rendered on a server.
• Logos and images you add to a template are read locally and never uploaded, unless you have an account and are saving a business profile.

If you create an account

An account exists so your business details, clients, quotes and invoices are still there tomorrow. That requires storing them, so here is exactly what is stored and why.

We do not store card numbers or bank account numbers. Where payments are taken, that happens with Stripe and we hold only references and status, as described under Online payments.

Who processes information for us

We use these providers only to run the service. They process data under terms that limit their use to providing their service to us.

• Cloud database and sign-in providers: store your account and saved documents and handle sign-in. Every table has row level security enabled, so the database itself refuses to return another person's rows.
• Stripe: payments (Pay now), saved cards for autopay and your connected Stripe account, described below.
• An email delivery provider: sends email on your behalf, such as invoice emails and payment reminders. Reminders come from billing@reminders.invoicetools.com and other notifications from updates@notify.invoicetools.com.
• An AI provider: reads what you give the AI helper, only when you use it.
• An analytics provider: counts page visits, described below.
• Cloud hosting providers, which serve the site and run our server-side code.
• Zapier, only if you choose to connect it. See Integrations, API and webhooks below.
• Google, only if you choose to connect your Google account: Google confirms your email, lets you read your own contacts into InvoiceTools, and lets InvoiceTools write rows to a spreadsheet you created or picked. Google is an independent service with its own privacy policy.
• Intuit (QuickBooks Online), only if you choose to connect a QuickBooks company. During testing this is limited to a sandbox company and InvoiceTools only reads from it.

If you choose to sign in with a third-party sign-in provider, that provider confirms who you are and passes across your name, email and profile picture. We never see your password for that provider.

Sharing a document with a client

When you send a quote or invoice from the dashboard, the link contains a long random token. Anyone holding that link can see that one document without signing in, which is the point: your client should not need an account to read what you sent them. They cannot see anything else, and a wrong token returns nothing at all.

Treat the link like the document itself. If it is forwarded, whoever receives it can read it, and can use the pay button if Pay now is on.

A tracked link records what happens to that document so you can see it: when it was opened and viewed, for how long, and whether it was downloaded or printed, with the browser used. If your client approves or declines a line, asks for a change or signs, that is recorded too. A signature is kept with the name typed, the date and time, the IP address and the browser, because a signature without those is a picture rather than a record. All of it belongs to the account that sent the document and is deleted with it.

If you received an invoice or opened a link from a business

A business using InvoiceTools sent you the document and chose what it contains. We process the document and your activity on it (opened, viewed, downloaded, printed, approved, signed, paid) on that business's behalf, and the business is responsible for what it collected about you. If you pay, your card or bank details go to Stripe, not to us or the business. We record payment status and amount, a signature if you sign (name, time, IP address, browser), and a one-way hash of your network address for a few minutes to limit abuse. To see, correct or delete information about you, contact the business first. You can also email contact@invoicetools.com and we will pass your request on or act on it where we are responsible.

Online payments

If you turn on Pay now, a client can pay a shared invoice through Stripe. Card and bank details are typed into Stripe’s page and go to Stripe, not to us and not to you. For the information it needs to onboard you, process payments, verify identity, prevent fraud and meet legal duties, Stripe is an independent controller under its own privacy policy at stripe.com/privacy, and may send your client a receipt by email. Stripe is regulated for the financial information it holds and gives its own notice.

What we store in your account: the id and status of your connected Stripe account, and for each online payment the invoice it belongs to, the amount, currency, method (card, bank transfer or buy now, pay later), our fee, whether it was the full balance or a part payment, the Stripe reference numbers, the status, refunds and the dates. We do not store card numbers, bank account numbers or any Stripe secret in the browser or in your account data. These records belong to the account that sent the invoice and are deleted with it, except where we have to keep a financial record.

To limit abuse, the payment endpoints keep a one-way hash of the visitor’s network address for a few minutes to count requests. It is not linked to a person and is not used for anything else.

Saved cards and autopay

On the Pro and Business plans, a client can choose to save a card for later invoices on a recurring schedule. The card details are entered on Stripe’s page and stored by Stripe on the business’s connected account. We keep only a reference to the saved payment method, the schedule it applies to, whether it is active, a count of failed charges and the dates of attempts. We do not store the card number. If a charge fails we email the business, and after three failed charges in a row autopay switches off for that schedule. To stop automatic payments, use the Stop automatic payments link in any payment email or the button on the invoice page, which switches autopay off for that schedule immediately, or ask the business. If neither works, email contact@invoicetools.com and we will switch it off promptly. We email the client and the business when autopay is turned off. Once it is off we no longer charge the saved card, and you can ask us to delete our reference to it. We keep a limited record of when autopay was authorized and when it ended as a payment record, for the period given under retention below. Saved-card records are deleted with the account that owns them, except where a financial record must be kept.

Integrations, API and webhooks

On the Business plan you can create API keys and webhooks. When a webhook event happens, we send a signed message to the URL you set. It contains document and payment details such as the document number, status, totals, dates, the client’s name and the public share link. We do not include a client’s email, phone or address, or internal notes. You choose where this data goes and are responsible for that destination.

If you connect Zapier, your automations use the same API, so document and payment details can pass to Zapier when they run, and from there to any services you connect in Zapier. Zapier is an independent service with its own privacy policy. You can disconnect it at any time in your account and in Zapier.

If you connect Google, we ask for four permissions: to know your Google email address, to read your contacts (read only), and to create or append to spreadsheets you choose (Google Drive "file" access, which only covers files you create through InvoiceTools or pick yourself). Contacts are only shown to you; a contact becomes a client in InvoiceTools only when you select it and confirm the import. Exported spreadsheet rows contain the document number, your client's business name, dates, status and totals, never the client's email, phone or address. We store the Google tokens encrypted, we never read your contacts in the background, and disconnecting in your account revokes the permission at Google and deletes the tokens. You can also remove access at myaccount.google.com/permissions.

InvoiceTools' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect QuickBooks Online, we ask for the accounting permission only. In this release we read your company name, customers, items and tax codes to show you how your clients and documents would map; nothing is written to QuickBooks. Disconnecting revokes the token at Intuit and deletes it here.

AI drafting

AI drafting is the one tool that sends what you give it off your device, and only when you use it. The text, photo, PDF or recording goes to our server and on to an AI provider to be read, and the draft comes back to your browser. The file itself is not kept. The draft that comes back is kept for up to 30 days under a fingerprint of the input, so the same input returns the same draft without being sent again. To enforce the daily limit we keep a daily count per account, or per device (a random id stored in your browser) and a one-way hash of the IP address. The AI helper also keeps a short recent chat in your browser for six hours, on your device only. Please do not enter card numbers, bank account numbers, government ID numbers or health information. If you would rather nothing leave your device, type the document in the generator instead.

Email we send for you

When you send a document or reminder by email, we pass the recipient's address, your reply-to address and the message content to our email delivery provider to deliver it. We keep a record that it was sent, and tracked sends record opens and views as described above. Every reminder has a stop link, which works without signing in and stops reminders for that invoice. We do not use these emails for marketing.

What we measure, and cookies

We use an analytics provider to count page visits and understand which tools people find useful. It records the page, the country, approximate location, the kind of device and your IP address, and it sets its own cookies to tell a returning visit from a new one. It runs on the page, not inside the tools: it never receives what you type into an invoice, a quote or a calculator. We send it a few usage events (such as a download or a template choice) that carry no names, amounts or document text. The provider processes this data for us. A content blocker or a browser privacy setting stops it, and every tool on this site keeps working without it.

• Signed in: your sign-in session is kept in your browser's local storage between visits. Signing out removes it.
• Preferences and drafts: local settings and the drafts described above, held on your device rather than sent to us.
• Analytics: our analytics provider sets cookies to count a returning visit once rather than twice.
• Stripe: Stripe's hosted checkout sets its own cookies under its policy.
• No advertising cookies of our own, and no advertising trackers on this site.

We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you, and we never sell it. We do not knowingly sell or share the personal information of anyone under 16. We give information to the providers listed above only to run the service, and when the law requires it.

US state privacy rights

If you live in a state with a consumer privacy law (for example California, Colorado, Connecticut, Virginia, Utah or Texas), you may have the right to know and access the personal information we hold about you, correct it, delete it, get a portable copy, opt out of sale, sharing, targeted advertising and profiling, limit use of sensitive personal information, and not be treated unfairly for using these rights. Account holders can use the export, edit and delete controls in the account. Everyone else can email contact@invoicetools.com. We confirm receipt within 10 business days and respond within 45 days, which we may extend once by 45 more days with notice. We verify requests by matching what you give us to what we hold, and may ask you to sign in. You may use an authorized agent, and we may ask for proof. If we deny a request, you can appeal by replying to our decision, and we will answer in writing within the time your state requires. If you are still unhappy, you may contact your state attorney general.

Categories of personal information

In the past 12 months we may have collected: identifiers (name, email, address, phone, IP address, device id); commercial information (invoices, quotes, payments you record, Pay now payment records); limited financial information (Stripe account status and payment amounts, never card or bank numbers); internet activity (page views and tool use through our analytics provider, and tracked-link logs); approximate location; professional information (business details and trade); and content you create (documents, logos, notes). Sensitive information is limited to tax identification numbers you choose to enter on a document and sign-in credentials handled by our authentication provider.

How long anything is kept, and how deletion works

Tool data: we keep it only if you save it to an account, send it as a tracked link or run it through the AI helper. Drafts and preferences held in your own browser stay there until you clear them. Account data: until you delete it. AI drafts: up to 30 days. Tracked-link logs: until the document is deleted. API keys, webhooks and saved-card records: until you delete them or the account. Security and abuse logs: a short period, not longer than 90 days. Connection tokens for Google or QuickBooks: deleted when you disconnect or delete the account.

Account holders: use Delete account. It removes your profile, business, clients, jobs, documents and settings from our live systems right away, and from backups as they are rotated out, within 30 days. Shared links stop working when the document is deleted. There is an export button beside the delete button so you can take your records first. Everyone else: email contact@invoicetools.com with the email address involved. We verify it and respond within 45 days.

We may keep information we must keep by law or for permitted purposes such as payment, tax and accounting records (for up to seven years, in limited form), fraud and abuse prevention, security, resolving disputes and enforcing our terms, and we will tell you what we kept and why. Stripe and our other providers keep their own records under their own policies, and you must contact them to delete those. Invoicing records often need keeping for tax purposes, frequently five to seven years depending on where you are. That obligation is yours rather than ours, which is why the export exists.

Your rights over your data

• See it. Everything is visible in your account, and exportable as CSV.
• Correct it. Every field is editable in account settings.
• Delete it. One button, no email exchange required.
• Take it elsewhere. The export is a plain CSV, readable by any spreadsheet.

If you are in the UK, the EU or a place with comparable law, these are rights you hold under it. We have built them as buttons rather than as a form you have to fill in. The service is operated in the United States and intended for US businesses at launch.

Security

We protect data with encryption in transit, row level security in the database and limits on who can reach it. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.

Children

These are business tools. Accounts and Pay now are for people 18 or older, and the service is not directed to children under 13. We do not knowingly collect information from children. If you think a child gave us information, email contact@invoicetools.com and we will delete it.

Changes to this page

If what we do changes, this page changes with it and the date at the top moves. Material changes affecting account holders, and any change affecting Pay now, will be emailed at least 30 days before they take effect rather than quietly published.

This page describes in plain language what the software does with information. It is written to be understood rather than to be legally exhaustive, and it is not legal advice.