Privacy policy

Invin is invoicing software for small trades and service businesses. This policy explains what we collect, why we hold it, and who else sees it. It covers the Invin app and invoice.moosedevs.ltd.

The short version: we hold the records you create so we can show them back to you, we do not sell anything to anyone, and we do not use your business data to train anybody's models.

Who we are

Invin is operated by Moosedevs Limited, Canada. For anything in this policy, write to privacy@moosedevs.ltd.

What we collect

Your account

Your name and email address, and a password if you set one. If you sign in with Apple or Google we receive an identifier and, where you allow it, your email address — never your password.

What you put in

Your business details, your clients, invoices, quotes, payments, expenses, products and any photos you attach. This is the substance of the service: we hold it so we can show it back to you and put it on your invoices.

Things we record as you work

When an invoice was sent, when a customer opened it, who changed what. An audit trail is part of what makes invoicing records worth keeping.

Your phone

Contacts

Your contacts stay on your device. When you begin typing a client's name the app searches your phone's address book locally, on the phone, and shows matches. Nothing is uploaded, indexed or read in bulk. Only the details of the one contact you choose are saved, as a client record you created.

Microphone and speech

Speech becomes text on your device, using the recogniser built into iOS or Android. Recordings are not uploaded or stored by us. The resulting text is sent to our server so the assistant can act on it — the same as if you had typed it.

If you turn on spoken replies, the assistant's reply text is sent to OpenAI to be read aloud. Your question is not.

Camera and photos

Only the images you choose, and only to attach to an invoice or a receipt. The app does not read your photo library otherwise.

Who else sees your data

We use other companies to run the service. Each is given only what its job needs, and none of them may use your data for their own purposes.

Your data is not used to train AI models. Anthropic and OpenAI are used under terms that exclude API content from training.

We do not sell your data, and we do not share it for advertising.

Where it is held

Our database and file storage are in the United States, and the companies above may process data in the United States and the European Union. If you are in Canada this means your information is stored outside the country and may be accessible to foreign courts and authorities under their laws.

How long we keep it

Your records stay while your account is open — invoices are documents you may be required to keep for years, so we do not quietly delete them. If you close your account we remove your data within 90 days, except anything we must keep for tax or legal reasons.

What you can ask for

• A copy of what we hold about you
• A correction, if something is wrong
• Deletion of your account and its contents
• An explanation of any of the above

Write to privacy@moosedevs.ltd. We will reply within 30 days. If you are unhappy with the answer you can complain to the Office of the Privacy Commissioner of Canada.

Security

Traffic is encrypted in transit and data is encrypted at rest. Passwords are hashed, never stored in a readable form. Sign-in tokens on your phone are kept in the device keychain. No system is perfect, and we will tell you promptly if a breach affects your data.

Children

Invin is for businesses and is not intended for anyone under 18.

Changes

If we change this policy we will update the date above, and tell you in the app if the change is significant.