Privacy Policy

1. What we collect and why

• Invoice and client information: business details, client names, emails and phone numbers, line items, amounts, taxes, currency, and notes, to create, save, download, and share invoices. Unsaved drafts and the anonymous free-plan counter are kept in your browser's local storage. Signing in and saving stores invoices and client records in our database.
• Public invoice links: sending a share link stores a display copy of that invoice behind a random link. Anyone with the link can view the invoice and its client details. For anonymous links, we also keep the sender's IP address to limit abuse; these links are not automatically removed when a saved invoice is deleted.
• Account information: sign-in email, account creation date, language and business profile details you choose to supply, to authenticate you and maintain your account. Sign-in uses an emailed magic link.
• Subscription information: payment provider identifiers and subscription status, to provide paid features. Card details are entered with Freemius, not in ReciboPro.
• Device and usage data: browser storage for drafts, language and sessions; signed-in product events such as invoice creation and downloads, with timestamps and account identifiers, to operate and improve the service. Anonymous share requests also use IP addresses for rate limits. Hosting providers may process request and device information needed to deliver the site and protect it.

For client information you put on an invoice, you decide what to enter and must have a lawful reason to use it. We process it to provide the invoicing service. We do not sell or license personal data.

2. Providers and AI

Lovable Cloud (using Supabase infrastructure) hosts our app, authentication, and database. Freemius processes subscription purchases, billing, and taxes as reseller and merchant of record. If you use the AI assistant, your job description and selected currency are sent through the Lovable AI Gateway to Google's Gemini 3 Flash Preview model to suggest line items. Please do not include sensitive information you do not need for the invoice.

Our app does not submit your invoices for AI model training. The code does not establish the gateway or model provider's independent data-retention or training terms, so we cannot guarantee their handling beyond the request we send.

3. WhatsApp and analytics

Sharing opens WhatsApp with a prefilled link; you choose whether to send it. We do not access your WhatsApp contacts or conversations. The app records signed-in product events in its own database; no third-party advertising or cross-site analytics script is loaded by the app. The page loads fonts from Google Fonts, whose own servers may receive browser request information. We do not use cross-site tracking in our app, and do not change app behavior based on browser Do Not Track or Global Privacy Control signals.

4. Storage, retention, and deletion

Browser drafts remain until you clear them or your browser's storage. Saved invoices, clients, and account data remain until deleted or you request account deletion; you can delete individual saved invoices and clients from the dashboard. A public share copy is stored separately, so ask us to remove a shared link when requesting deletion. Email michaelclarke854@gmail.com to request deletion of your account, shared links, and associated data. Some billing records may need to be retained by Freemius under its own policy.

5. Your rights and international transfers

Wherever you live, email us to request access, correction, deletion, or a portable copy of your personal data. We aim to respond within 30 days. You can also ask us to restrict or object to processing or withdraw consent where applicable. Our processing relies on providing the service (contract performance), protecting and improving it (legitimate interest), and consent where needed. Your data may be processed outside your country, including in the United States, by our providers.

In Brazil, the LGPD also gives you rights to confirm processing, request anonymisation when appropriate, learn about sharing, and complain to the Autoridade Nacional de Proteção de Dados (ANPD). If you are in the EU or UK, you may complain to your local data protection authority.

6. Children

ReciboPro is for people aged 13 and older. Users aged 13–17 need a parent or guardian's permission. We do not knowingly collect personal data from children under 13. If we learn that we have, we will delete it; please contact us at the address above.

7. ReciboPro Connector for Muse

If you ask Meta's Muse assistant to start an invoice, the details you give Muse are processed by Meta under its own policies. The single-use link expires after seven days; opening it clears the stored draft payload. Expired records are cleaned up when the connector next receives a request after its cleanup threshold. Request logs record item count, currency, and outcome, not names, phone numbers, emails, or amounts. We do not receive your Muse conversation or account.

If you create a personal agent token in Settings → Agent access, an AI assistant holding that token can read your own invoices, client balances, payments and reminder history, and draft reminder text. It cannot send messages, record payments or change anything. We store only a fingerprint (hash) of each token, show when it was last used, and keep a short per-call log (tool name and outcome, kept about a day) for rate limiting. Revoking a token stops access immediately. Data the assistant reads is then handled by that assistant's provider under its own policies.

8. Policy changes and contact

We will update this page's effective date when the policy changes. For material changes, we will notify signed-in users by email or in the app before the change takes effect. Email michaelclarke854@gmail.com with any questions or rights requests.