Privacy Policy
About this policy
This policy explains what personal data Invroot collects, why, who it is shared with, and what rights you have. It covers the invroot.com website and the Invroot application.
It describes the service as it is actually built. Where we name a third party, it is one the product genuinely uses; where we describe what leaves our systems, that is what leaves them.
Two different roles — and why the distinction matters
For the personal data of our own customers — the people who sign up, and their team members — we are the data controller. We decide why and how it is processed, and this policy governs it.
For the data a customer enters about their own clients — names, addresses, tax numbers, invoice lines, payment records — the customer is the controller and we are their processor. We handle that data on their instructions to provide the service, and we do not use it for our own purposes.
If you have received an invoice produced with Invroot and want to know why a business holds your data, contact that business: they hold the relationship and the records. We will support them in answering you.
What we collect
Account and workspace data
- Your name, email address, phone number and password (stored only as a salted hash — never in readable form).
- Business details: company name, address, country, currency, tax registration number, logo, stamp and signature image, and the name and title of your authorised signatory.
- Team members you invite, and their role in the workspace.
Records you create
- Clients and their contact details, invoices, quotes, receipts, credit notes, payments, expenses, catalogue items and bank account details you choose to display on documents.
- This may include personal data about your customers. You are the controller of it; see above.
Billing data
- Plan, subscription status, billing country and currency, invoice history for your subscription, and any promotional code applied.
- Card details are collected and held by Stripe. They do not pass through and are not stored on our servers.
Technical data
- IP address, browser and device information, and timestamps, recorded in server and security logs.
- An audit log of significant actions in your workspace, which exists so that you can see who did what.
- Approximate country, derived from your IP address, used to show prices in the right currency.
Support correspondence
- Messages you send us, and our replies.
Outside Europe we measure how the website is used, with Google Analytics 4 and Google Ads conversion measurement, both loaded through Google Tag Manager. That tells us which pages bring people to the product and whether an advertisement led to a sign-up. What it records is the pages visited, an approximate location, the browser and device, and an identifier held in a cookie.
We do not load either of them for visitors in the European Economic Area, the United Kingdom or Switzerland. We use no session recorders and no advertising pixels belonging to anyone other than Google, and nothing you enter into your workspace — a client, an invoice, an amount — is ever sent to an analytics service.
When you sign up outside Europe, we may also pass Google Ads a SHA-256 hash of the email address you registered with — a one-way fingerprint of it, not the address itself — so that the sign-up can be matched to the advertisement that led to it even when the cookie has been blocked or has expired. Google uses it only to match the sign-up to a signed-in Google account that saw the advertisement, and cannot turn the hash back into your address.
Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service — creating your workspace, storing your records, rendering documents | Performance of a contract |
| Taking payment and managing subscriptions | Performance of a contract |
| Sending service email — verification, password reset, invoices and receipts for your subscription, and reminders you have configured | Performance of a contract |
| Keeping the service secure, preventing fraud and abuse, and diagnosing faults | Legitimate interests |
| Improving the product and understanding which features are used | Legitimate interests |
| Measuring website traffic and advertising — not done for visitors in Europe | Legitimate interests |
| Meeting our own tax, accounting and record-keeping obligations | Legal obligation |
| Optional marketing email about the product | Consent — withdrawable at any time |
We do not sell personal data. We do not use your data, or your customers' data, to train machine-learning models.
AI features and what is sent
Where you use an AI feature, the text needed to answer is sent to our AI provider, Anthropic, over an encrypted connection and processed to return a result.
Specifically:
- For AI invoicing: the description you type, and the client and catalogue context needed to draft the invoice.
- For the website assistant: your question and the product documentation it answers from.
Anthropic processes this to return the result and does not use it to train its models. We do not send your full customer database, your payment records, or your uploaded files to any AI provider. If you would rather no data reached an AI provider, do not use the AI features — the rest of the product works without them.
Who we share it with
We do not sell personal data, and we never share the records inside your workspace for advertising. Outside Europe we do share limited website-usage data with Google, as set out below. We use a small number of processors, each handling only what their function requires:
| Provider | What it does | What it receives |
|---|---|---|
| Stripe | Payment processing and subscription billing | Your name, email, billing country, subscription and payment details. Card data goes directly to Stripe. |
| Anthropic | AI invoicing and the website assistant | Only the text described in "AI features" above, and only when you use those features. |
| Cloud hosting and object storage | Running the application and storing uploaded files such as logos and stamps | Workspace data at rest and in transit. Stored objects are private. |
| Email delivery (SMTP) | Sending service email on your behalf and to you | Recipient address and message content, including attached PDFs. |
| Google (Tag Manager, Analytics 4, Ads) | Website traffic measurement and advertising conversion measurement — outside Europe only | Pages visited, approximate location, browser and device, a cookie identifier and, when you sign up, a SHA-256 hash of your email address. None of your workspace records. |
We may also disclose data where the law requires it, to establish or defend legal claims, or to protect the rights and safety of our users — and, if the business is ever reorganised or sold, to the acquiring party, subject to this policy.
Where your data is stored
Our production servers and database are located in Frankfurt, Germany, within the European Union. Backups are held in the same region.
Some of our processors operate outside the EU — Stripe and Anthropic among them. Where personal data is transferred outside the EEA, that transfer is made under an appropriate safeguard, ordinarily the European Commission's Standard Contractual Clauses, together with additional measures where needed.
How long we keep it
We keep data for as long as it is needed for the purpose it was collected:
- Workspace records — for as long as your account is open.
- After you close your account or a subscription ends — we keep your records for 90 days so the account can be recovered and your data exported, then delete or irreversibly anonymise them, unless we must keep them longer by law.
- Billing records — retained for as long as tax and accounting law requires, typically between five and ten years depending on jurisdiction.
- Security and audit logs — retained for up to 12 months.
- Support correspondence — retained for up to 24 months.
You can export your invoices, clients and payments at any time from inside the app. We recommend doing so before closing an account.
Deleting your account
You can ask us to delete your Invroot account and the data in it at any time, whether you use Invroot on the web or in the Invroot mobile app:
- Email support@invroot.com from the email address you sign in with, with the subject "Delete my account". You can also do this from Settings → Workspace in the web app, or tell us in chat from the mobile app.
- We will confirm the request by replying to that address, then close the account within 5 working days.
- What is deleted — your user profile, workspace settings, clients, invoices, quotes, expenses, scanned documents, bank details and any files you uploaded, from our live systems and, within 30 days, from backups.
- What is kept — records that tax and accounting law obliges us to retain (typically invoices you have issued to customers and our billing records with you), for the period that law requires; security and audit logs for up to 12 months. These are kept only for that purpose and are not used for anything else.
- For 90 days after closure the account can be recovered on request, after which the deletion is final.
If you only want some data removed, for example a single client or a scanned document, delete it inside the app or email us and we will remove it without closing the account.
Your rights
Depending on where you live, you have some or all of the following rights over your personal data:
- Access — a copy of the personal data we hold about you.
- Rectification — correction of data that is wrong or incomplete.
- Erasure — deletion, where we have no overriding obligation to keep it.
- Restriction — to limit how we use it while a question is resolved.
- Portability — to receive it in a structured, machine-readable format.
- Objection — to processing based on our legitimate interests, and to marketing at any time.
- Withdrawing consent — where consent was the basis, without affecting what was done beforehand.
- Complaint — to your data protection authority. In the EU that is the authority in your country of residence; we are also happy to hear from you first.
These rights are recognised in different forms under the EU and UK GDPR, the UAE Personal Data Protection Law, the Saudi Personal Data Protection Law, South Africa's POPIA, and comparable laws in the other countries we serve. To exercise them, email support@invroot.com. We answer within one month, and will tell you if we need longer. We may ask you to confirm your identity before acting.
If your request concerns data held by one of our customers about you, we will refer you to that customer, who controls it.
Cookies
We use cookies to run the service and, outside Europe, to measure website traffic and advertising. Visitors in the European Economic Area, the United Kingdom and Switzerland are served only the cookies the service itself needs, which is why there is no consent banner to click through there.
What we set:
- Authentication cookies that keep you signed in and allow your session to be refreshed. They are httpOnly, meaning scripts in the browser cannot read them, and are marked Secure and SameSite.
- A preference for your chosen language and billing country, so the site opens the way you left it.
- Outside Europe only: Google Analytics cookies (_ga and _ga_*), which count visits and tell one browser from another, and Google Ads cookies (_gcl_*), which record the advertisement a visit arrived from so that a later sign-up can be credited to it. They expire within two years and hold nothing about your workspace.
Blocking the first two will stop you signing in. Your browser can clear any of them at any time, and a tracking-blocking browser or extension stops the Google cookies being set at all.
How we protect it
Measures we take include:
- Encryption in transit using TLS for all traffic, and encryption of stored files at rest.
- Passwords stored only as salted hashes, never in a readable form.
- Strict separation between workspaces, so one customer cannot reach another's records.
- Role-based access inside a workspace, with an audit log of significant actions.
- Uploaded files stored as private objects, served through short-lived links rather than public URLs.
- Internal access to production limited to the people who need it to operate the service.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and tell you without undue delay where the breach is likely to present a high risk to you.
Children
The service is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has provided us with personal data, contact support@invroot.com and we will delete it.
Changes to this policy
We update this policy when the service or the law changes. The date at the top always shows the current version. Where a change materially affects how we handle your data, we will tell you by email or in the app rather than relying on you to notice.
Contact us
Invroot is operated by Trasealla Solutions Limited (trading as Trasealla Solutions), registered at Smart Station, First Floor, Incubator Building, Masdar City, Abu Dhabi, United Arab Emirates, registration number MC 14272, which is the data controller for the purposes described in this policy.
For any privacy question or to exercise a right: support@invroot.com. For other business matters: info@trasealla.com.
