Privacy Policy

1. Information We Collect

When you use Anytime Invoice, we collect information you provide directly, such as your name, email address, business details (ABN, business name, address), and the content of invoices you create. We also collect information about your use of the service, including log data and device information.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our invoicing services
• Generate and deliver invoice PDFs and emails on your behalf
• Process payments through our third-party payment processor
• Send you service-related notifications and updates
• Comply with legal obligations under Australian law

We handle your personal information in accordance with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We do not sell your personal information.

3. Sub-processors and Third-Party Services

We use the following sub-processors to operate the platform. Each processes personal information only as needed to provide its service to us, under its own privacy policy and its agreement with us.

• Clerk — authentication and account management
• Neon (PostgreSQL) — database hosting and storage of your account, invoice and customer records
• Cloudflare R2 — file and document storage, including generated invoice PDFs and uploaded receipts
• Stripe — payment processing. Where you enable online card payments, Stripe is the payment processor and you contract with Stripe directly under the Stripe Connected Account Agreement; cardholder data is handled by Stripe and is not stored by us
• Resend — transactional email delivery on your behalf
• Hosting and infrastructure providers — application hosting and background job processing (including queues and scheduled tasks such as invoice emails and PDF generation)

We may change a sub-processor from time to time. We will update this list when we do.

4. Data Storage, Location and Security

Your data is stored on secure servers and encrypted in transit using TLS 1.3 and at rest using AES-256. Access to production systems is restricted and access to customer data is limited to what is needed to operate and support the service. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your personal information and the business records you create for as long as your account is active. After you close your account, we retain records for the period required by Australian law — Australian tax law generally requires businesses to keep records relating to tax invoices and GST for at least five years — and for as long as needed to resolve disputes and enforce our agreements. When records are no longer required, we delete or de-identify them. Retention of your own business records is your responsibility, and this policy is not record-keeping advice.

6. Notifiable Data Breaches

We comply with Part IIIC of the Privacy Act 1988 (Cth), the Notifiable Data Breaches (NDB) scheme. If we become aware of a suspected data breach, we will assess it and determine whether it is an eligible data breach — that is, whether it involves unauthorised access to, or unauthorised disclosure of, or loss of, personal information that is likely to result in serious harm to any affected individual.

We will complete that assessment within the statutory period (30 days, unless there are reasonable grounds to believe the breach is not eligible) and, where we assess that the breach is an eligible data breach, we will:

• notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable;
• notify each affected individual as soon as practicable, with the information required by the Privacy Act, including the nature of the breach and the steps they should take in response; and
• take reasonable steps to contain, remediate and prevent recurrence.

7. Your Rights

Under the Australian Privacy Act 1988, you have the right to access and correct personal information we hold about you. You may also request deletion of your account and associated data by contacting us. If you believe we have breached the APPs, you can contact us first, and you may also lodge a complaint with the OAIC.

8. Cookies

We use essential cookies for authentication and session management. Our analytics provider may also set cookies to help us understand how our service is used. You can control cookie preferences through your browser settings.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, via email.

10. Governing Law and Contact

This policy is governed by the laws of the State of New South Wales, Australia, and the Privacy Act 1988 (Cth). If you have questions about this privacy policy or our data practices, please contact us at support@anytimeinvoice.com.au.