Privacy Policy

1. Who this applies to

This policy covers personal data we collect through Free Invoice Generator ("the Service"), operated by Iftikhar Ahmad, an independent freelancer based in Saudi Arabia. It applies to account holders, team members invited to a company account, and guests using the no-signup "Pay As You Go" invoice tool.

2. What we collect

• Account holders: name, email address, password (stored hashed, never in plain text), profile photo (if using Google sign-in), two-factor authentication setup data.
• Company data: company name and settings, VAT registration number, subscription and billing history, team member roles and invitations.
• Invoices, customers, and products you enter: customer names, emails, phone numbers, VAT numbers, and addresses; product/service names and prices; invoice line items, amounts, and payment status. This is data you provide about your own customers - you are the one responsible for having a lawful basis to store it, and we process it on your behalf.
• Guest invoice tool: business name, email, and the invoice details you enter for the one-off invoice; a receipt image if you pay by bank transfer.
• Automatically collected: basic technical data needed to operate the site (IP address, browser type). We do not currently use third-party analytics, advertising, or tracking tools. We use Google Search Console to monitor how the site performs in search results, which does not track individual visitors or use cookies.

3. How we use this data

To provide the Service (create your account, generate invoices, calculate VAT, send you emails like payment confirmations and download links); to process payments (card or bank transfer, including manual review of bank transfer receipts); to communicate with you about your account or support requests; to maintain security (two-factor authentication, fraud prevention); and to meet legal obligations.

We do not sell your data or your customers' data to third parties.

4. Who we share data with

• Moyasar, our payment processor, to process card payments.
• Email delivery services, to send account, invoice, and payment notifications.
• Google, only if you choose to sign in with Google.
• Hostinger, our hosting provider, which stores the Service's data on our behalf.
• We may disclose data if required by law or to protect the rights, safety, or property of the Service or our users.

5. Where data is stored

Data is stored on servers operated by Hostinger, located in the United Kingdom, with backups stored in Germany. Because this is outside Saudi Arabia, this transfer is handled in a manner intended to meet the requirements of Saudi Arabia's Personal Data Protection Law (PDPL) for cross-border data transfers - the UK and Germany both maintain data protection standards (UK GDPR and EU GDPR respectively) that are generally recognized as robust.

6. How long we keep data

We retain account and invoice data for as long as your account is active, and for a reasonable period afterward - generally up to 6 years - to comply with tax record-keeping obligations and resolve disputes. You can request deletion of your account data subject to these retention requirements.

7. Your rights

Depending on applicable law (including PDPL), you may have the right to access, correct, export, or request deletion of your personal data, and to withdraw consent where processing is based on consent. To exercise these rights, contact us at ifikhan171@gmail.com.

8. Security

We use industry-standard measures to protect your data, including password hashing, optional two-factor authentication, and access controls. No system is 100% secure, and we can't guarantee absolute security.

9. Cookies

We use a small number of essential cookies: a session cookie to keep you logged in and remember your selected language, a security token (CSRF) to protect forms from tampering, and, if you tick "remember me" when logging in, a cookie that keeps you signed in between visits. Your light/dark theme preference is stored in your browser's local storage, not a cookie. We do not use advertising or third-party tracking cookies.

10. Children's privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. We'll post the updated version here with a new "Last updated" date.

12. Contact

Questions or requests about your data: ifikhan171@gmail.com · +966 56 248 2097 (WhatsApp) · Saudi Arabia.