Privacy Policy

InvoSlick is operated by Guy Sinai, Israel, who is responsible for your personal data (the “controller”). Contact us about privacy at guy.sinai@invoslick.com.

• Account data: your email address and password. The password is stored only as a secure hash by our authentication provider.
• Documents you upload: each file is sent for extraction and is not stored by us afterwards. We keep the file name and the extracted data (which may include names, addresses, phone numbers and emails printed on the document) so you can view and export your history.
• Billing data: payments are handled by Paddle. We receive your Paddle customer and subscription identifiers, your plan and subscription status. We never receive or store card details.
• Technical data: your IP address and account ID are used to rate-limit sign-in attempts and uploads. These records are deleted within about a day. Our hosting provider may also keep standard server logs.
• Cookies: we use only the cookies needed to keep you signed in. We don't use advertising or analytics cookies.

• to provide the Service: sign-in, document extraction, history, exports and credits (performance of our contract with you);
• to manage subscriptions and billing (contract and legal obligations);
• to keep the Service secure and prevent abuse (our legitimate interests);
• to send account and billing emails such as sign-up confirmation, password resets and failed-payment notices, and to answer your messages;
• to send a few product emails, such as a welcome email, getting-started tips and reminders when your free credits run low (our legitimate interest). Every tip or reminder has an unsubscribe link; account and billing emails are always sent.

We don't sell your personal data and don't use your documents to train AI models.

We share data only with the providers needed to run the Service, under their data protection terms:

• Supabase: account sign-in and the database that stores your account and extracted data
• Anthropic: AI extraction of the documents you upload (Claude API)
• Paddle: checkout, payments, invoicing and sales tax, as our Merchant of Record
• Vercel: hosting the website and application
• Zoho: sending our emails to you and receiving your messages

Anthropic doesn't use data sent through its API to train its models under its commercial terms. Some of these providers process data outside Israel, including in the United States and the European Union, with contractual safeguards in place.

We keep your account and extracted document data while your account is active. When you ask us to delete your account, we delete this data within 30 days, except records we must keep by law (for example billing records, which Paddle keeps as Merchant of Record).

Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and withdraw consent. You can already export your extracted data as CSV or JSON from the dashboard. For anything else, email guy.sinai@invoslick.com; we reply within 30 days. You can also complain to your local data protection authority.

Data is encrypted in transit (HTTPS). Database access rules ensure each customer can read only their own data, and access to our systems is restricted. No method of transmission or storage is completely secure, but we work to protect your data.

The Service is for businesses and is not intended for anyone under 18.

We may update this policy. We'll update the effective date above and, for material changes, notify you by email or in the dashboard.