Privacy Policy

Last updated: 29 September 2026

This policy explains how InvoiceLite handles account information and business records. It describes the current service and identifies payment features that are still being introduced.

Information we process

• Account information: name, email, password credential and account timestamps. Account passwords are stored as hashes, rather than readable passwords.
• Business profile: business and contact names, email, telephone, address, registration number, VAT information, currency, logo, banking details, payment notes and document defaults.
• Customer information entered by account holders: names, contact persons, emails, telephone numbers, addresses, VAT numbers and notes.
• Business records: saved products/services, quotations, invoices, line descriptions, quantities, prices, costs, discounts, tax amounts, profit/margin information, manual payment dates, references, notes and document/customer snapshots.
• Operational information: record IDs and timestamps, document numbers, sharing tokens, session information and error logs used to operate and troubleshoot the service.

Free-text fields may contain other information you choose to enter. Please limit information to what is appropriate for your business records.

Why we use information

We process information to create and authenticate accounts, operate the service, maintain business records, calculate and generate documents, provide sharing functionality, respond to enquiries, and secure and troubleshoot the service. We do not currently use marketing analytics, advertising profiles, location tracking or document-view analytics.

Customer information entered by users

Account holders decide what customer information to enter, correct and share. They are responsible for an appropriate lawful basis or permission for processing that information through InvoiceLite. If your information appears in a document issued by a business using InvoiceLite, you can contact that business about its use of your information, or contact us for help with a privacy request relating to our service.

Cookies, sessions and device storage

InvoiceLite uses the invoicelite_session cookie and server-side session information for sign-in, security checks, messages and safe form input. The session cookie is configured for seven days; actual session availability also depends on server and browser settings. Logging out clears the application's session. Blocking this cookie may prevent sign-in and forms from working.

The installable web app stores public icons and an offline notice in browser cache storage. It does not provide offline invoicing or intentionally cache your business records for offline use. Installation guidance checks browser/device capabilities locally. Downloaded PDFs may remain on your device until you remove them.

Public documents and sharing

InvoiceLite creates public links for sharing quotation and invoice PDFs; a link can be generated when the account holder opens a document's detail page. Anyone possessing a valid link can access the corresponding document without logging in. Links currently do not expire and there is no self-service revocation feature or restriction to a named recipient.

Shared PDFs may include business/contact details, customer names, document information, amounts, notes, banking details, and payment dates, references and notes where supplied. Internal cost, profit and margin fields are excluded. Links render current saved information, so later edits may change what a recipient sees. Recipients may download, retain or forward a PDF or its link.

Business logos are stored as publicly accessible image files. Treat logos and customer-facing document fields as information that may be disclosed when you use sharing.

Service providers and external interactions

• Hosting and infrastructure: providers supporting the website, database, file storage and operational services process information needed to host and maintain InvoiceLite. Hosting arrangements and any backup retention depend on the deployment.
• jsDelivr: your browser requests Bootstrap and interface resources from this CDN. Those requests disclose ordinary connection information such as your IP address and browser request metadata to that provider.
• WhatsApp: if you choose WhatsApp sharing, a prepared message includes a customer phone number where supplied, customer/business names, document number, amount and public link. You complete sending through WhatsApp.
• Your email application: email sharing opens a prepared message with recipient details, document information, amount and public link. InvoiceLite does not currently send email through its own mail server or delivery API.
• PDF generation: documents are generated on the InvoiceLite server, without an external PDF-generation service.
• Future subscription payments: Paystack may process payment and subscription information when payment functionality is introduced. Paid checkout is not currently available in the application. InvoiceLite does not currently collect or store payment-card details.

External services apply their own privacy practices and may process information outside South Africa. Contact us for information about the hosting arrangements relevant to your account. Sharing actions pass information to the chosen service; InvoiceLite does not maintain email or WhatsApp delivery/read histories.

Security and logging

The application uses password hashing, authentication, account ownership checks, form security tokens, input validation and output escaping. Session cookies use HttpOnly and SameSite settings, with Secure enabled for HTTPS configuration. Access to ordinary account records is scoped to the signed-in account; public links are the sharing exception.

Error logs support troubleshooting and attempt to remove known sensitive values. The application does not maintain a visitor IP or user-agent history, but hosting/network logs may contain connection details. No system can guarantee absolute security. Keep your password and public document links secure and report suspected unauthorised access promptly.

Retention and deletion

Data is retained as necessary to provide the service and meet legitimate operational or legal requirements, subject to future documented retention processes. No fixed retention schedule or automatic age-based deletion is currently implemented. Subscription cancellation does not itself delete your account or business records. Trial expiry or a failed subscription payment will not by itself cause automatic deletion.

Deleting a customer record does not remove information already saved in quotations or invoices. Historical document snapshots can retain customer names and descriptions. Copies shared externally or downloaded by recipients are outside InvoiceLite's direct control. Retention of logs, infrastructure backups and uploaded files must be considered separately when handling a deletion request.

Access, correction, deletion and privacy requests

You can view and edit your business profile, customers, saved items and documents in the application. Individual PDF downloads are available. There is no self-service account deletion workflow or complete account export.

Contact support@invoicelite.co.za to request access, correction or deletion, object to processing, or raise a privacy concern. We may need to verify your identity and authority before acting. Requests will be assessed in light of applicable South African law and any legitimate retention requirements; we will explain relevant limits rather than promise immediate deletion of every copy. Do not send your password or card details.

You may also raise a concern with South Africa's Information Regulator.

Changes and contact

We will update this page and its date when this policy changes, and give reasonable notice of material changes where practicable. For privacy or service enquiries, email support@invoicelite.co.za.