This policy is compliant with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDPA).
By using Invyoc, you agree to the terms described below.
Information We Collect
To provide you with our billing and GST invoicing services, we collect the following types of information:
Account & Identity Information
- Full name, email address, and mobile number provided during sign-up
- Business name, GSTIN (GST Identification Number), and business address
- Profile photo or business logo (optional)
- Chosen subscription plan and billing preferences
Invoice & Transaction Data
- Customer details added to your invoices (names, addresses, GSTINs)
- Invoice line items, amounts, GST rates, and payment statuses
- Payment records, due dates, and transaction references
Technical & Usage Data
- IP address, browser type, device type, and operating system
- Pages visited, features used, and session duration
- Error logs and performance diagnostics
How We Use Your Information
Your data is used solely to provide, maintain, and improve Invyoc. Specifically, we use it to:
- Create and manage your Invyoc account and business profile
- Generate GST-compliant invoices on your behalf
- Send GST filing deadline reminders via SMS and WhatsApp
- Process subscription payments and manage your plan
- Provide customer support and respond to your queries
- Send important product updates, feature announcements, and security alerts
- Analyse usage patterns to improve the product experience
- Comply with applicable Indian tax and regulatory requirements
Data Storage & Security
We take the security of your business data seriously. Here's how we protect it:
- All data is encrypted in transit using TLS 1.2 / 1.3 (HTTPS)
- Data at rest is encrypted using AES-256 encryption
- Our servers are hosted on secure, audited cloud infrastructure within India
- Access to your data is restricted to authorised Invyoc personnel only
- We conduct regular security audits and vulnerability assessments
- Two-factor authentication (2FA) is available for all accounts
Despite our best efforts, no system is completely immune to breaches. In the unlikely event of a data breach affecting your information, we will notify you within 72 hours as required by applicable law.
Sharing Your Data
We do not sell, rent, or trade your personal data. We may share limited information only in the following circumstances:
- Service Providers: Trusted vendors who help us operate Invyoc (e.g., payment gateways, SMS providers, cloud hosts) — bound by strict confidentiality agreements
- Legal Obligations: If required by Indian courts, regulators (GSTN, MCA), or government authorities under applicable law
- Business Transfers: In the event of a merger or acquisition, your data may be transferred to the successor entity under the same privacy protections
- With Your Consent: Any other sharing will only happen with your explicit consent
Cookies & Tracking
Invyoc uses cookies and similar technologies to improve your experience. Here's what we use:
- Essential Cookies: Required for the platform to function — login sessions, security tokens, preferences
- Analytics Cookies: Help us understand how users interact with the app (e.g., page visits, feature usage) — anonymised and aggregated
- Functional Cookies: Remember your settings like language, theme, and dashboard layout
You can manage or disable non-essential cookies through your browser settings. Disabling essential cookies may affect platform functionality.
Your Rights
Under the Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights as a data principal:
- Right to Access: Request a copy of all personal data we hold about you
- Right to Correction: Ask us to correct any inaccurate or incomplete information
- Right to Erasure: Request deletion of your personal data (subject to legal retention obligations)
- Right to Portability: Receive your data in a structured, machine-readable format
- Right to Withdraw Consent: Withdraw consent for data processing at any time
- Right to Grievance Redressal: Raise a complaint with our Data Protection Officer
To exercise any of these rights, email us at privacy@invyoc.in. We will respond within 30 days of receiving your request.
Data Retention
We retain your data only for as long as necessary to provide our services and meet legal obligations:
- Account data — retained for the duration of your subscription, plus 90 days after account closure
- Invoice & GST records — retained for 8 years as required under the GST Act, 2017
- Communication logs — retained for 12 months for support and audit purposes
- Analytics data — retained in anonymised form for up to 24 months
After the applicable retention period, your data is securely and permanently deleted from our systems.
Third-Party Services
Invyoc integrates with select third-party services to deliver core features. These include:
- Payment Gateways (e.g., Razorpay) — for processing subscription payments
- WhatsApp Business API — for sending invoices and GST reminders
- SMS Providers — for deadline reminder notifications
- Cloud Infrastructure — for hosting and data storage within India
- Analytics Tools — for anonymised product usage analysis
Each of these providers has their own privacy policy. We encourage you to review them. Invyoc is not responsible for the data practices of external websites or services linked from our platform.
Children's Privacy
Invyoc is a business tool intended solely for use by individuals aged 18 years and above. We do not knowingly collect personal data from minors.
If you believe a minor has provided us with personal information, please contact us at privacy@invyoc.in and we will promptly delete that information from our records.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do:
- We will update the "Last Updated" date at the top of this page
- We will notify you via email or an in-app banner for material changes
- Continued use of Invyoc after the effective date constitutes acceptance of the updated policy
We recommend reviewing this page periodically. Previous versions of this policy are available upon request.
Contact Us
For any privacy-related questions, requests, or concerns, please reach out to our Data Protection Officer:
We aim to respond to all privacy inquiries within 30 business days. If you are unsatisfied with our response, you may escalate your concern to the Data Protection Board of India as established under the DPDPA 2023.