Invio ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal information in accordance with the New Zealand Privacy Act 2020.
1. Information we collect
Information you provide:
- Account information (name, email, password)
- Business details (business name, address, GST number, bank account)
- Invoice and quote data, and payment records
- Voice recordings and audio you dictate when using the optional voice-to-invoice feature
- The text of your conversations with Offsider (our in-app AI assistant) and of your voice invoices, and the AI's answers (see AI features and voice data)
- Files you choose to send us for import help, such as a client export from your old tool (see Data retention for how long we keep them)
- Your answer, if you choose to give one, to the optional question we ask when you cancel a subscription (the reason you pick and any note you add). We store it on your account, use it to improve Invio, and include it in your data export
- Your answer to a one-question survey email, if you choose to reply, and any note you add. We only quote a note publicly, with your first name and business name, if you tick the box that says we may
- Communications with our support team
- Bank statement data, only if you choose to import a statement file in the Bank area (see Bank statements you import under Data sharing): the bank accounts you add and the lines of the statements you import
- Xero sync data, only if you choose to connect Xero (see Xero sync under Data sharing): the name and settings of the Xero organisation you connect, and a record of what Invio sent to it
Information collected automatically:
- IP address and browser type
- Device information
- Usage data (pages visited, features used)
- Cookies and similar technologies
2. How we use your information
We use your information to:
- Provide and maintain the Service
- Process your invoices, quotes, and payments
- Draft invoices from your voice using AI, when you choose to use the voice-to-invoice feature
- Send transactional emails (invoice reminders, quotes, receipts) and notices about your account or plan, such as a change to your plan
- Improve our Service
- Respond to support requests
- Comply with legal obligations
- Detect and prevent fraud
3. Legal basis for processing
- Contract performance: Providing the Service you signed up for
- Legitimate interests: Improving our Service, security
- Legal compliance: Tax records, fraud prevention
- Your consent: Marketing emails, optional features
4. Data sharing
We may share your information with service providers (hosting, email, payment processing), professional advisors, and law enforcement when legally required.
We do NOT sell your personal data or share data with advertisers.
Third-party services we use: see our Subprocessors page for the current, specific list of who they are, what each one does, and where they process data. We keep that list on its own page so it can be updated when a provider changes without needing a rewrite of this policy.
AI features and voice data
Our optional voice-to-invoice feature uses artificial intelligence to turn what you say into a draft invoice. When you use it, the audio you record and the related invoice context (such as the client name and the line items needed to build the draft) are sent to our AI provider, Google Cloud (Vertex AI), for processing.
When you use Offsider (our in-app AI assistant) or voice invoicing, we keep the text of the conversation - what you asked, what the AI looked up or drafted for you, and its answers (for voice, the words the AI heard, never the recording) - for 30 days to check and improve the answers, then delete it automatically.
Receipt scanning. If you choose Scan receipt on the Add expense screen, the photo or PDF you give it is sent to Google Cloud (Vertex AI), our AI provider, which reads it and returns the details for you to check. Under Google Cloud's enterprise terms it is not used to train Google's AI models. Invio does not keep the image from the scan or the AI's reply: if you save the expense, the photo you attached is stored as that expense's receipt, in the same private storage as any other receipt, and the lines are saved with the expense. The scan is a draft; you check and save it.
Which AI provider reads your receipt. Receipt scanning, and the weekly one-line summary of what a business does that we write for our own internal customer list, use whichever of two AI providers we have selected: Anthropic (Claude) or Google Cloud (Vertex AI). We can change the selection at any time. When Anthropic is selected, the receipt photo or PDF you scan (and, for the internal summary, the business name and invoice line descriptions) is sent to Anthropic, PBC instead of Google Cloud. We have not yet verified where Anthropic processes these requests or how long it keeps them, so this policy makes no claim about either, or about training use. Voice invoices and Offsider always use Google Cloud.
- Invio does not store your voice recordings. They are processed to create your draft and are not kept on our systems.
- Under Google Cloud's enterprise terms, your data is not used to train Google's AI models. Google may retain it only briefly for safety, abuse detection, and legal compliance.
- AI output is a draft you review and confirm before anything is sent. We do not guarantee the accuracy of AI-generated drafts, and you are responsible for checking them before use.
Bank statements you import
In the Bank area you can add a bank account and import a statement file (a CSV you download from your online banking, or, on a paid plan, a PDF statement). Invio shows the transactions and matches deposits to your invoices. Importing a file does not connect Invio to your bank and Invio cannot move money.
What we collect when you use it:
- For each bank account you add: the bank name, a nickname, the account type, the currency (from your business’s region) and, if you choose to type them, the account number and a start date. We also remember the column choices from your last import, so the next file with the same headings needs no setup.
- For each line of a statement you import: the date, the amount, the description and, where your file has them, the payee, particulars, code, reference, transaction type and running balance. These can include the names of people or businesses who paid you or whom you paid, and whatever they wrote as a reference. Lines dated before the start date you set are not stored.
- For each import: the file’s name and how many lines were read, added, skipped as duplicates or could not be read. We do not keep the file itself, only the lines taken from it.
- What you decide about each line: whether it is waiting, ignored (with your reason) or matched to an invoice, and whether Invio or you matched it.
Why we use it: to show your statement, to match deposits to your invoices and, unless you switch that off in the Bank area, to mark an invoice as paid automatically when the amount is exact and the invoice number is in the deposit’s details. Less certain matches are only suggestions for you to confirm. You can undo a match, which removes the payment it recorded. An invoice marked paid this way keeps the amount, the date, the invoice number and the nickname of your bank account, not the bank’s description.
Who can see it: you, and people you have given access to your business in Invio whose role allows it. Admins and accountants can view the Bank area; only the owner and admins can import a statement, match or ignore lines, undo an import or edit an account. Other roles cannot see it.
AI and other tools: once imported, we do not send your statement lines to our AI features (Offsider, voice invoices and receipt scanning), to our connectors for AI assistants (the Invio and Xero connectors) or to the REST API, and none of them can read them. We do not send statement lines to our analytics. Our error reports for the Bank area carry the type of error, not the content of a line. If you use the Xero sync, the payment recorded on an invoice is copied to Xero like any other payment; statement lines are not sent.
PDF statements: if you choose to import a PDF statement (a paid-plan feature), the PDF itself is sent to our AI provider Anthropic, PBC, which reads it and returns its lines. A statement PDF can show your account number and the names of the people and businesses you paid or were paid by. Invio then checks that the lines add up to the opening and closing balances printed on the statement, and shows them to you before anything is saved. We do not keep the PDF or the AI’s reply; only the lines you choose to import are stored, as with a CSV. A PDF statement is always read by Anthropic, whichever AI provider we have selected for other features. We have not yet verified where Anthropic processes these requests or how long it keeps them, so this policy makes no claim about either, or about training use. If you would rather not send a PDF, import the CSV from your bank instead: a CSV is never sent to an AI provider.
Where it is stored: in our database (MongoDB Atlas, Sydney, Australia), the same place as the rest of your Invio data, and, like the rest of it, in our encrypted backups (see Backups under Data retention).
How long we keep it, and how to remove it:
- We do not delete imported lines automatically while your account is open.
- You can undo an import in the Bank area. That removes the lines it added that you have not acted on. If some of them are already matched or ignored, undo those first. The record that the import happened (the file name and the counts) stays. Undoing a match puts the line back to waiting and removes the payment it recorded.
- There is no button to delete a single line or a bank account. Your other rights under this policy, including asking us to delete your information, apply to it in the same way.
- If you delete your Invio account, your imported lines, import records and bank accounts are deleted when the account is permanently deleted, 30 days after your request. Deleted data stays in encrypted backups until they age out, as described in the policy.
- Your data export includes your bank accounts, import records and imported lines.
Xero sync (optional)
If you choose to connect Invio to your Xero organisation, Invio copies your documents into it so that you do not have to key them twice. The Xero sync is optional and off until you connect it. Nothing is sent until you sign in to Xero on Xero’s own page, choose the organisation, and finish the setup in Invio.
What Invio sends to the Xero organisation you chose:
- Each invoice you send, and any change you make to it afterwards: its number, dates, lines, amounts and tax, your PO number, and a link to the invoice page that anyone with access to that Xero organisation can open.
- Payments recorded against those invoices (amount, date and reference), if you leave Record payments in Xero on, and the removal of a payment you remove in Invio.
- A credit note, when you void an invoice that has payments recorded.
- Your client as a Xero contact: the name and, where you have them in Invio, the email address, phone number and address. Invio looks for an existing contact first and links to it rather than making a second one.
- Invoices you sent before you connected, only if you choose to send them: you see the list, and one button sends exactly that list.
What Invio reads from Xero: the organisation’s name, currency and lock dates, and its accounts, tax rates and branding themes (so you can choose how Invio’s invoices map to them). Invio also looks up an invoice number or a contact in Xero to avoid creating a duplicate, and reads the state of an invoice before it adds a payment to it. Invio does not copy Xero’s contact lists, invoices or reports into its own database; the account, tax rate and theme lists are kept for up to a day so the settings screen can show them.
What Invio keeps: the access Xero gives it, stored encrypted and never shown in the app; the organisation’s name; and a queue and log of what was sent - Invio’s and Xero’s ids, whether each item went through, and any message Xero gave when it refused an item (that message can quote a name or number from the document). The log holds no amounts.
Who can see it: you, and people you have given access to your business in Invio, according to their role. We do not sell it or share it with advertisers. Neither the data from Xero nor the sync’s records are sent to our AI features (Offsider, voice invoices and receipt scanning), to our connectors for AI assistants (the Invio and Xero connectors) or to the REST API, and none of them can read them. An assistant that sends an invoice for you does so through the same step as you do; the invoice is then queued for the sync like any other.
How long we keep it, and how to stop it:
- While Xero is connected we keep the access and the sync’s records.
- When you press Disconnect in Invio, Invio asks Xero to remove its connection and deletes the stored access at once. We keep the sync’s ids (no amounts, no personal details beyond those ids) so that connecting the same organisation again does not create duplicates. Nothing that is already in Xero is changed or deleted by disconnecting.
- If you ask us to delete your Invio account, the stored access and the sync’s records are deleted when the account is permanently deleted, 30 days after your request. Invio does not ask Xero to remove the connection at that moment, so press Disconnect in Invio first, or remove Invio under Connected apps in your Xero settings.
- Xero holds your documents in your own Xero organisation, under your agreement with Xero. Where Xero stores them is decided by Xero; see our Subprocessors page.
Shift summary links
A Home & field teams business can give a client's family a link that shows the client's completed shifts. The business must confirm it has the client's consent before it makes a link.
- The page shows the client's first name, the day and time of each completed shift in the period the business chose, the worker's initials or first name and the name of the service only if the business chose to show them, and the business's name and phone number. It does not show notes, incidents, addresses, prices or health information.
- The link is a long random address that works without a login. Invio stores only a scrambled form of it, so it cannot be shown again; if it is lost, the business makes a new one. Invio counts how many times a link is opened and when it was last opened.
- The business can switch a link off at any time. A link also stops working when it expires, when the module is switched off, or when the account's plan no longer includes it. Links are deleted with the client or the account.
Overseas data processing
Some of our providers process data on servers outside New Zealand. Our database (MongoDB Atlas) is hosted in Sydney, Australia. Our web hosting (Vercel), our AI provider (Google Cloud Vertex AI), and our product analytics provider (PostHog) primarily process data in the United States. Our error-monitoring provider (Sentry) processes data in Germany. Our email delivery provider (Brevo) processes data primarily in France and the European Union. Our payment processor (Stripe) processes data in Ireland and the United States, and may use local processing entities in other countries where it operates. Our file-storage provider (Cloudflare R2) does not pin storage to a single country. When selected as our AI provider, Anthropic, PBC (a United States company) processes receipt scans and internal summaries; where its servers are, and how long it keeps what it receives, we have not verified. We only use providers that are subject to privacy protections comparable to the New Zealand Privacy Act 2020, for example through data processing agreements and standard contractual clauses. By using these features you acknowledge that your information may be processed overseas.
5. Data retention
- We keep your MYOB connector waitlist details to contact you about the preview until it opens or you ask us to delete them.
- Active accounts: Data retained while account is active
- Scheduled account deletion: Data deleted after 30 days unless you cancel before then
- Care and worker records: If you keep care records or worker records in Invio (progress notes, incidents, worker screenings and credentials, shifts and hours), you as the provider are responsible for keeping the records the law requires; Invio deletes them 30 days after you delete your account, and offers you a full export first.
- Backups: We keep encrypted backups on a rolling 30-day cycle. Data you delete stays in any backup that was taken before the deletion, until that backup reaches 30 days old and is removed automatically
- Invoices and Quotes: Export and retain your own records as needed, including where tax law applicable to your region requires it (currently 5-7 years depending on jurisdiction)
- Voice recordings: Not stored by Invio - processed transiently to create your draft, then discarded
- AI conversations: The text of your Offsider chats and voice invoices is deleted automatically 30 days after it was written
- Files you send us for import help: Stored privately, readable only by our team, and deleted within 7 days of us returning your ready-to-import file (or within 14 days of receiving it if we do not return one)
- Imported bank statement lines: kept until you undo the import they came from or your account is permanently deleted (see Bank statements you import under Data sharing)
- Xero sync records: kept while Xero is connected and, so that connecting the same organisation again does not create duplicates, after you disconnect; deleted when your account is permanently deleted (see Xero sync under Data sharing)
6. Data security
We protect your data with encryption in transit (HTTPS/TLS), encryption at rest, secure password hashing, and periodic security reviews (most recently in July 2026).
7. Data breach notification
If we experience a privacy breach that has caused, or is likely to cause, serious harm, the Privacy Act 2020 requires us to notify the Privacy Commissioner and affected individuals as soon as practicable - the Commissioner expects this within 72 hours of us becoming aware of a notifiable breach. Failing to notify without reasonable excuse is an offence under the Act. If you believe your information may have been affected by a breach, contact us at support@invio.co.nz.
8. Your rights (NZ Privacy Act 2020)
You have the right to access, correct, or delete your personal information. To exercise these rights, contact us at support@invio.co.nz.
9. Cookies
We use cookies for authentication, preferences, and analytics. You can control cookies through your browser settings.
10. Contact us
Privacy Officer: Bakhtiyar Duganov trading as Invio
Email: support@invio.co.nz
Address: Auckland, New Zealand
11. Complaints
If you have concerns about our handling of your data, you can contact the Office of the Privacy Commissioner:
Website: privacy.org.nz
Phone: 0800 803 909