Privacy policy
Last updated: 2026-09-29
This policy explains exactly what Invoice Creator does with your information, why we are allowed to do it, who else is involved and how you stay in control. It is written in plain language on purpose, and it applies to the website, the free invoice creator, the Pro workspace, invoice emails and the public payment pages.
1. Who is responsible for your data
Invoice Creator is operated by A² Solutions, Oosterhesselenstraat 339, 2545 SW Den Haag, The Netherlands. Chamber of Commerce (KVK) number 99882957, VAT number NL005416615B22. For anything in this policy you can reach us at info@invoice-creator.net.
In Türkiye the same service is presented under the name FaturaJet. The operator, the systems and this policy are identical.
We are the controller for your account and workspace data. For the details of your own customers that you enter into invoices, you are the controller and we act on your instructions as processor. Using Invoice Creator to store customer data means these terms serve as our processing agreement with you.
2. The free invoice creator stays on your device
The free creator runs entirely in your browser. The seller details, customer details, invoice lines, notes and logo you enter are kept in your browser's local storage so a refresh does not lose your work. They are not sent to us and not saved in our database.
The one exception is generating the PDF: the invoice content is sent to our server, drawn into a PDF and returned to you. It is processed in memory for that request only, is not written to our database and is not kept in logs. Clearing your browser data removes the draft permanently, and we cannot recover it.
3. What we collect in a Pro workspace
Account information
- Your email address, password (stored only as a salted hash) and sign-in timestamps.
- Your name and, if you sign in with Google, the basic profile Google returns.
- Your interface language, invoice language and light or dark appearance preference.
Business and invoicing data
- Company profile: legal and trading name, address, phone, VAT and KVK numbers, bank name and account number, logo, accent colour, invoice template, footer settings and contact person.
- Customers you save: name, address, email, phone, VAT number and country.
- Products and services you save, with prices and VAT rates.
- Invoices with their line items, discounts, VAT amounts, totals, dates, numbering, status and history of changes, sends and reminders.
- Payment records, including manual payments you register and payments confirmed by Stripe.
Billing information
- Your subscription status, plan, currency, renewal date and payment history reference. Card details are entered on Stripe's own pages and never reach our servers.
Technical information
- Security and error logs containing IP address, browser type, timestamps and the page or request involved. We use these to keep the service running and to stop abuse.
- Email delivery events from our email provider: delivered, opened where available, bounced or marked as spam.
People who pay your invoices
When you share an invoice payment link, the person opening it sees only that invoice. We record the visit and payment attempt (time, IP address, browser) for security and to reconcile the payment correctly. We do not use their details for anything else and we never market to them.
4. Why we are allowed to process it
| What we do | Legal basis |
|---|---|
| Run your account, store your invoices, create PDFs, send invoices and reminders | Performance of our contract with you (GDPR Art. 6(1)(b)) |
| Take subscription payments and handle refunds | Performance of our contract with you |
| Keep security logs, prevent fraud and abuse, back up data | Our legitimate interest in a safe, reliable service (Art. 6(1)(f)) |
| Keep invoicing and tax records for the statutory period | Legal obligation (Art. 6(1)(c)), Dutch tax law |
| Send product news, if you ever ask for it | Your consent (Art. 6(1)(a)), withdrawable at any time |
If Turkish law applies to you, the equivalent grounds under KVKK Art. 5 apply: necessity for performing a contract, our legitimate interests and compliance with legal obligations.
5. Providers who process data for us
We keep the list short on purpose. Each of these is bound by a data processing agreement and may only act on our instructions.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication and file storage for Pro workspaces | European Union |
| Cloudflare | Hosting, content delivery, TLS and abuse protection | Global edge network |
| Stripe | Subscription billing and, through Stripe Connect, invoice payments you collect | European Union / United States (EU Standard Contractual Clauses) |
| Resend | Sending invoice emails, payment reminders and account emails | European Union / United States (EU Standard Contractual Clauses) |
Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses together with additional technical safeguards such as encryption in transit and at rest.
Stripe is an independent controller for payment data it collects, and handles that data under its own privacy policy and its obligations as a regulated payment institution.
6. How your data is kept separate and secure
- Every workspace is isolated at the database level. Database rules check the signed-in user on every single read and write, so one workspace can never see another's data.
- All traffic is encrypted with TLS, and data is encrypted at rest by our database provider.
- Passwords are stored only as salted hashes; nobody at A² Solutions can read them.
- Incoming notifications from Stripe and our email provider are cryptographically verified before we act on them, and each event is applied only once.
- Access to production systems is limited to the people who need it and is logged.
If a data breach happens that is likely to affect your rights, we will notify the Dutch Data Protection Authority within 72 hours and inform you without undue delay.
7. What we never do
- We never sell your data or your customers' data.
- We never use your invoice content for advertising or to train advertising profiles.
- We never load advertising or cross-site tracking cookies. Optional product analytics run only after you allow them in the cookie notice and never include invoice contents, names or addresses (see the cookie policy).
- We never log passwords, access tokens or card numbers.
- We never email your customers except the invoices and reminders you ask us to send.
8. How long we keep things
| Data | Kept for |
|---|---|
| Free creator drafts | Only in your browser, until you clear it |
| Workspace data (customers, products, invoices, payments) | While your account exists |
| Data after you delete your account | Removed within 30 days, apart from the records below |
| Invoices and billing records we must keep for tax | 7 years, as Dutch law requires |
| Security and error logs | Up to 90 days |
| Email delivery events | Up to 12 months |
| Contact form messages | Up to 24 months after your question is resolved |
9. Your rights
You can, at any time and free of charge:
- Ask what personal data we hold about you and receive a copy.
- Have incorrect details corrected, which you can also do yourself in the app.
- Have your data deleted, including by deleting your account.
- Ask us to pause processing while a dispute is being sorted out.
- Export your data in a machine-readable form. Customers, invoices and reports can be downloaded as spreadsheet files directly from the app.
- Object to processing based on our legitimate interests.
- Withdraw any consent you gave, without affecting what happened before.
Write to info@invoice-creator.net and we will answer within one month. We never make decisions about you purely by automated means, and we do not profile you.
If you are unhappy with our answer, you may complain to the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at https://autoriteitpersoonsgegevens.nl, or to the supervisory authority in your own country. In Türkiye the competent authority is the Kişisel Verileri Koruma Kurumu (KVKK).
10. Children
Invoice Creator is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
We may update this policy as the product develops. The date at the top always shows the current version. If a change materially affects you, we will tell you in the app or by email before it takes effect. Questions: info@invoice-creator.net.