Privacy Policy

Last updated: 4 August 2026

Invio ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal information in accordance with the New Zealand Privacy Act 2020.

1. Information We Collect

Information You Provide:

• Account information (name, email, password)
• Business details (business name, address, GST number, bank account)
• Invoice and quote data, and payment records
• Voice recordings and audio you dictate when using the optional voice-to-invoice feature
• Communications with our support team

Information Collected Automatically:

• IP address and browser type
• Device information
• Usage data (pages visited, features used)
• Cookies and similar technologies

2. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Process your invoices, quotes, and payments
• Draft invoices from your voice using AI, when you choose to use the voice-to-invoice feature
• Send transactional emails (invoice reminders, quotes, receipts)
• Improve our Service
• Respond to support requests
• Comply with legal obligations
• Detect and prevent fraud

3. Legal Basis for Processing

• Contract performance: Providing the Service you signed up for
• Legitimate interests: Improving our Service, security
• Legal compliance: Tax records, fraud prevention
• Your consent: Marketing emails, optional features

4. Data Sharing

We may share your information with service providers (hosting, email, payment processing), professional advisors, and law enforcement when legally required.

We do NOT sell your personal data or share data with advertisers.

Third-party services we use: see our Subprocessors page for the current, specific list of who they are, what each one does, and where they process data. We keep that list on its own page so it can be updated when a provider changes without needing a rewrite of this policy.

AI Features and Voice Data

Our optional voice-to-invoice feature uses artificial intelligence to turn what you say into a draft invoice. When you use it, the audio you record and the related invoice context (such as the client name and the line items needed to build the draft) are sent to our AI provider, Google Cloud (Vertex AI), for processing.

• Invio does not store your voice recordings. They are processed to create your draft and are not kept on our systems.
• Under Google Cloud's enterprise terms, your data is not used to train Google's AI models. Google may retain it only briefly for safety, abuse detection, and legal compliance.
• AI output is a draft you review and confirm before anything is sent. We do not guarantee the accuracy of AI-generated drafts, and you are responsible for checking them before use.

Overseas Data Processing

Some of our providers process data on servers outside New Zealand. Our database (MongoDB Atlas) is hosted in Sydney, Australia. Our web hosting (Vercel), our AI provider (Google Cloud Vertex AI), and our product analytics provider (PostHog) primarily process data in the United States. Our error-monitoring provider (Sentry) processes data in Germany. Our email delivery provider (Brevo) processes data primarily in France and the European Union. Our payment processor (Stripe) processes data in Ireland and the United States, and may use local processing entities in other countries where it operates. Our file-storage provider (Cloudflare R2) does not pin storage to a single country. We only use providers that are subject to privacy protections comparable to the New Zealand Privacy Act 2020, for example through data processing agreements and standard contractual clauses. By using these features you acknowledge that your information may be processed overseas.

5. Data Retention

• Active accounts: Data retained while account is active
• Scheduled account deletion: Data deleted after 30 days unless you cancel before then
• Invoices and Quotes: Export and retain your own records as needed, including where tax law applicable to your region requires it (currently 5-7 years depending on jurisdiction)
• Voice recordings: Not stored by Invio - processed transiently to create your draft, then discarded

6. Data Security

We protect your data with encryption in transit (HTTPS/TLS), encryption at rest, secure password hashing, and periodic security reviews (most recently in July 2026).

7. Data Breach Notification

If we experience a privacy breach that has caused, or is likely to cause, serious harm, the Privacy Act 2020 requires us to notify the Privacy Commissioner and affected individuals as soon as practicable - the Commissioner expects this within 72 hours of us becoming aware of a notifiable breach. Failing to notify without reasonable excuse is an offence under the Act. If you believe your information may have been affected by a breach, contact us at support@invio.co.nz.

8. Your Rights (NZ Privacy Act 2020)

You have the right to access, correct, or delete your personal information. To exercise these rights, contact us at support@invio.co.nz.

9. Cookies

We use cookies for authentication, preferences, and analytics. You can control cookies through your browser settings.

10. Contact Us

Privacy Officer: Bakhtiyar Duganov trading as Invio
Email: support@invio.co.nz
Address: Auckland, New Zealand

11. Complaints

If you have concerns about our handling of your data, you can contact the Office of the Privacy Commissioner:
Website: privacy.org.nz
Phone: 0800 803 909