Privacy policy

Effective from 23/10/2026 · v2026-10-23

Who processes the data and in what capacity

The operator listed below is the controller of data about visitors, user accounts, subscriptions and support communications. For personal data of your customers entered into documents and contacts, you generally act as the controller and Invelo processes the data on your instructions to provide the service.

Data, purposes and legal bases

To create and manage an account, we use email, company and identification details, a secure password hash, company settings and subscription information. The legal basis is performance of a contract and steps before entering into it. Data required by law is processed to comply with legal obligations.

We use technical logs, IP addresses, request times and statuses to operate the service, protect accounts and resolve errors. The basis is our legitimate interest in service security and reliability. You may object to this processing.

Documents, contacts, bank details and email history are processed when saving, generating PDFs, sending and performing other actions you choose. For public links, we record the first and last opening and the access count; opening may also be caused by an email service scanner and does not prove that the recipient personally read the content.

Invoice by email without an account

We verify the email address using a code to deliver the PDF. We do not save the content of this one-off invoice as an account document. We retain the email address and sending record and, where given, separate voluntary consent to offers. Verification and security records support delivery and protection against misuse. The delivery service and recipient may retain a copy of the message.

Marketing and analytics

Consent-based marketing can be withdrawn at any time by contacting the operator. Consent is not required to create an account or a one-off invoice. Google Analytics loads on public pages only if enabled by the operator and permitted by the visitor. Details and preference controls are on the Cookies page.

Recipients and bank connections

Data may be received by authorised staff, infrastructure and email providers, document recipients you select and the payment gateway used. ThePay or Comgate processes subscription payments on its own page; Invelo does not store full card numbers or CVC codes. Bank APIs are used only after a user sets up a connection. Available operations depend on that connection's permissions.

Retention, infrastructure and international transfers

Specific information on infrastructure, recipients, retention and any transfers outside the EEA is provided in the section below. Users can export documents. Contact the operator to request account closure, erasure or return of data. Statutory retention, protection of rights and backup recovery may limit immediate erasure.

Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, object to processing and withdraw consent without affecting prior lawful processing. Send requests to the data protection contact. The operator may reasonably verify your identity. You may complain to the Czech Office for Personal Data Protection (uoou.gov.cz) or the competent supervisory authority in your country of habitual residence. We do not use automated decision-making with legal or similarly significant effects.

Security and responsibility for submitted data

Account access is protected by authentication, communication uses HTTPS and sensitive access keys are stored encrypted. Company data separation and operational backups provide additional protection. Users are responsible for their authority to enter customer data, disclose it to recipients and secure their access. Do not enter sensitive data that is unnecessary for invoicing.