Privacy Policy (October 6 through November 15, 2026)

The short version

• Southern East Inc., a Canadian company in Ontario, runs Invoice Mama.
• We use your information to run and improve Invoice Mama, keep it secure, and talk with you.
• We never sell your personal information for money.
• We do not collect, use, or sell personal data to train large language models. We do not use your personal information or the invoices, estimates, client records, and other content you put in Invoice Mama to train AI models.
• Before we give a business or research partner anything that identifies you, we will ask you first and you can say no.
• If we change how we use your information, we will tell you at least 30 days ahead. We will not apply a new use to information we already have unless you say yes. If you do not agree, you can close your account; we keep handling information we already hold under the earlier version.
• Your choices: Your Privacy Choices. Questions: Rishit Patel, support@invoicemama.com.

Who we are

Invoice Mama is run by Southern East Inc., a corporation incorporated under the laws of Canada, with a mailing address at 222 Main St E, North Bay, ON P1B 1B1 ("we", "us"). We decide how and why your personal information is used.

Privacy Officer. Rishit Patel is responsible for how Southern East Inc. protects personal information. For people in Quebec, this is also our person in charge of the protection of personal information. Contact: support@invoicemama.com, or by mail at Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1.

What this policy covers. This policy covers Invoice Mama, including invoicemama.com, app.invoicemama.com, mobile apps, and MCP connections. Rules for information about your clients are in Customer Data (effective November 16, 2026; see upcoming policy).

Who we share information with

Service providers act only on our instructions under contract.

Microsoft Clarity. On our marketing site, Clarity may record clicks, scrolls, and page interactions. We mark form fields and document previews with Clarity's masking attribute so typed input and echoed values are not recorded. Microsoft is the provider. You can opt out at Your Privacy Choices, with Global Privacy Control, or by declining analytics cookies in the EEA, UK, or Switzerland. When opted out, we do not load the Clarity script.

PostHog. PostHog provides product analytics and crash/error reporting in the web app and the mobile apps, and session replay in the web app only. On app.invoicemama.com, session replay includes public invoice and estimate pages your clients may view. Replays can capture on-screen text and typed input; we do not mask fields in our configuration. PostHog acts as our service provider for operating, securing, supporting, and improving the Service.

People and apps you choose. When you send an invoice or connect an AI assistant, we share what you direct us to share.

Legal and safety. We may disclose information when required by law or to protect people and the service from fraud or abuse.

Do we use personal information to train AI?

• We do not collect, use, or sell personal data to train large language models. We do not use your personal information or the invoices, estimates, client records, and other content you put in Invoice Mama to train AI models.
• We do not sell personal information to train AI models.
• We do not let partners train on information that identifies you unless you opt in.
• Connected AI assistants (MCP) receive data only because you asked us to send it.

Notice for US residents

Last updated: October 2026.

This notice supplements our Privacy Policy for residents of US states with comprehensive privacy laws. It describes our practices at or before collection and how to exercise your rights.

Categories of personal information

Sale and sharing. We do not sell personal information for money. In the preceding 12 months we have not sold personal information for monetary consideration. Our marketing site may use Microsoft Clarity for US visitors unless you opt out. Some state laws may treat certain analytics or session-replay data as "sharing" for cross-context behavioral advertising even when no money changes hands. You can opt out at Your Privacy Choices or with Global Privacy Control.

Sensitive information. We do not use or disclose sensitive personal information (such as government ID numbers you may enter as a tax identifier on an invoice) for purposes other than providing the service you request, security, or as required by law.

Deidentified information. We may create deidentified or aggregated information that does not identify you. We commit to maintain and use deidentified information without attempting to re-identify it, except as permitted by law to test our processes.

Financial incentives. We do not offer financial incentives in exchange for the collection, sale, or sharing of personal information.

AI training. We do not collect, use, or sell personal data to train large language models. We do not use your personal information or the invoices, estimates, client records, and other content you put in Invoice Mama to train AI models.

Your rights. Depending on your state, you may have the right to know, access, delete, correct, and port personal information; to opt out of sale/sharing and targeted advertising; and to limit use of sensitive information. We do not discriminate against you for exercising these rights. We confirm every request and respond within 45 days (with notice if we extend once). Authorized agents may act with signed permission. To appeal a decision, reply "appeal" to our response or contact your state attorney general. Contact: support@invoicemama.com or Your Privacy Choices. We will not ask you to re-verify for at least 12 months after a confirmed request.

Minors. We do not knowingly sell or share personal information of anyone under 18.

Notice for people in the EEA, UK, and Switzerland

Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1 is the controller. Contact support@invoicemama.com.

Legal bases

Your rights. You may access, rectify, erase, restrict, object, and port your data, and withdraw consent where processing is based on consent. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Contact support@invoicemama.com. You may lodge a complaint with your supervisory authority.

Transfers. We process data in Canada and where our service providers operate. Canada has an EU adequacy decision for commercial organizations covered by PIPEDA. For transfers to the US and other countries without adequacy, we use Standard Contractual Clauses, the UK Addendum, and the EU-US Data Privacy Framework where applicable.

Notice for people in Quebec

• Person in charge: Rishit Patel (support@invoicemama.com), Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1.
• Privacy by default: optional analytics and partner programs are off until you turn them on.
• We collect only what we need for stated purposes. Profiling or identification features are disclosed before you enable them.
• Consent is requested separately for specific purposes; sensitive information requires express consent.
• Anonymization follows Quebec regulation and serious, legitimate purposes, including research where permitted.
• Before personal information leaves Quebec, we assess privacy impacts and use contractual protections.
• You may access, correct, withdraw consent, and port your information. We respond within 30 days.
• Complaints: Commission d'accès à l'information du Québec.

Changes to this policy

Small changes (clearer wording, more protection, or a new service provider doing the same job that does not handle Customer Data): we update this page and the Last updated date. Adding or replacing a provider that handles Customer Data follows the Terms.

Material changes (new partners, new purposes, identifying sharing, AI training on your data, weaker promises, or storing data outside Canada): at least 30 days' notice by email and on Invoice Mama. Material changes apply only to information collected after they take effect. We use information we already hold in a new way only if you agree with a clear action. If you do not agree, we keep handling your existing information under the earlier version. You may close your account.

Past versions: through October 5, 2026, October 6 through November 15, 2026. Upcoming version: /privacy/upcoming.

If the law requires a faster change, we give as much notice as we can.

Legal Basis for Processing

We will only process your personal data when we have a legal basis to do so. Legal bases include:

• Consent: Where you have given us clear consent to process your personal data for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legal obligation: Where processing is necessary for us to comply with the law.
• Legitimate interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, provided your fundamental rights and freedoms do not override those interests.

We may rely on different legal bases depending on the specific processing activity. Where we rely on legitimate interests, these interests include: providing and improving our services, communicating with users, marketing our services, protecting against fraud and security threats, and complying with legal obligations.

Age Restrictions

Our services are not intended for use by individuals under the age of 18 or the age of majority in the jurisdiction where they reside, whichever is higher. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a minor, we will take steps to delete that information as quickly as possible. If you believe we might have any information from or about a minor, please contact us.

Third-Party Services and Liability

Our service may contain links to or integrate with third-party websites, services, or applications that are not owned or controlled by Invoice Mama. We have no control over, and assume no responsibility for the content, privacy policies, practices, or availability of any third-party websites, services, or applications.

We are not liable for any:

• Security breaches, data losses, or other issues related to third-party services, applications, or websites
• Content, policies, or practices of any third-party services
• Damages, losses, or any other issues that may arise from your use of or reliance on any third-party services
• Unauthorized access to or use of third-party servers or any personal information stored therein

You acknowledge and agree that Invoice Mama shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any third-party content, goods, or services.

Information We Collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier.
• Contact Data: includes email address and telephone numbers.
• Business Data: includes business name, address, tax identification numbers, business contact information, and other information related to invoices you generate.
• Financial Data: includes bank account details, payment card details, billing address, and transaction records related to your Invoice Mama subscription or premium features. This category also includes payment instructions you voluntarily enter into the Service for display on invoices, payment links, or other outputs, such as bank account and routing numbers, payment-provider handles or usernames (e.g., Venmo, Zelle, PayPal, Wise, Interac e-Transfer, UPI, or regional equivalents), QR codes, payment links, phone numbers, email addresses, or cryptocurrency wallet addresses ("Payment Instructions"). Payment Instructions are User Content you control; we do not use them to process, initiate, or settle any payments on your behalf.
• Transaction Data: includes details about payments to and from you, invoice details, and other details of products and services you have purchased from us.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device identifier, and other technology on the devices you use to access this website.
• Profile Data: includes your username and password, purchases or orders made by you, your preferences, feedback, and survey responses.
• Usage Data: includes information about how you use our website, products, and services, including clicking patterns, features used, time spent on pages, and other engagement metrics.
• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• User Content: includes any content that you create, upload, or provide while using our services, such as invoice templates, custom logos, business information, and Payment Instructions you add to invoices, payment links, or other outputs of the Service.

We may combine usage data into aggregated statistics that do not identify anyone—for example, the percentage of users who use a feature. When we anonymize data for research or statistical purposes, we do so under the rules in our Privacy Policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offenses.

User-Provided Payment Information

Our Service allows you to enter Payment Instructions for display on invoices, invoice links, payment links, PDFs, customer-facing portals, and other outputs. You choose which payment details to enter, which payment providers to reference, and where to display them. Invoice Mama does not require you to provide Payment Instructions to use the Service.

Visibility of Payment Instructions. Payment Instructions you add to an invoice or payment link may become visible to invoice recipients, payment-link viewers, anyone who receives a shared PDF or forwarded link, and the service providers we use to host, deliver, and operate the Service. You acknowledge that sharing Payment Instructions through the Service is your voluntary decision and that once an invoice or payment link is sent or shared, recipients may copy, forward, store, or otherwise use the payment details it contains.

Third-party payment providers. Any payment transaction conducted through a third-party provider whose details you display (such as Venmo, Zelle, PayPal, Wise, Interac e-Transfer, UPI, bank transfers, or local equivalents) is governed entirely by that provider's own terms of service, privacy policy, and security practices. Invoice Mama does not control, endorse, or assume any responsibility for the privacy or security practices of these third-party payment providers. We strongly recommend that you review the terms and privacy policies of any payment provider whose details you share through the Service.

Your responsibility. You are solely responsible for the accuracy, legality, and appropriateness of all Payment Instructions you provide. You assume all risks associated with sharing your payment details through the Service, including the risk that Payment Instructions may be accessed, copied, or misused by invoice recipients or other third parties. To the maximum extent permitted by applicable law, Invoice Mama shall not be liable for any loss, damage, or claim arising from the disclosure, use, or misuse of Payment Instructions you have entered into the Service.

Surcharge Data

When a business enables the credit card surcharge feature, we collect and store:

• Whether surcharging is enabled and the configured surcharge rate or preset.
• The identity (user ID) of the person who accepted the surcharge liability disclaimer and the timestamp of acceptance.
• The surcharge amount applied to each payment session.

This data is used to calculate and apply surcharges to customer payments, maintain an audit trail for compliance and dispute resolution, and facilitate payment processing through Stripe. Surcharge-related data is retained for as long as the business account remains active and may be shared with Stripe as part of payment processing.

Cookies and analytics

We use cookies and similar technologies on our marketing site. Plausible analytics does not use cookies. Microsoft Clarity may set cookies when you allow it. Invoice Mama uses PostHog for product analytics and crash/error reporting in the web app and the mobile apps, and session replay in the web app only. See Who we share information with. PostHog is not controlled by marketing-site cookie choices.

• im_geo_country (about 24 hours): stores your country code from our hosting provider so we can apply regional privacy rules (for example, EEA analytics consent). Set on HTML page views only.
• im_privacy_opt_out (1 year): remembers your choice to opt out of sale/sharing and Clarity on this browser.
• im_analytics_consent (1 year): remembers whether you allowed non-essential analytics cookies in the EEA, UK, or Switzerland.
• _clck / _clsk (Microsoft Clarity, when loaded): session replay and analytics on our marketing site.

Manage choices at Your Privacy Choices. You can also instruct your browser to block cookies, though some features may not work.

How We Use Your Information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To provide you with the invoice generation service.
• To manage our relationship with you.
• To improve our website, products/services, marketing, and customer relationships.
• To recommend products or services which may be of interest to you.
• To comply with a legal or regulatory obligation.
• For marketing purposes: We may use all or most of the data we collect for our own marketing efforts, including sending you information about our products, services, promotions, and other offerings that may be of interest to you. While we do not sell your personal data, we do use it to tailor our marketing communications and improve our services.

You may opt out of receiving marketing communications from us by following the unsubscribe instructions included in our marketing communications.

Third-Party Data Collection

We use various third-party services to help operate and improve our service. These third parties may collect data about you when you interact with our service. This includes but is not limited to analytics providers, payment processors, hosting services, and marketing tools.

These third-party services have their own privacy policies addressing how they use the data they collect. We encourage you to read the privacy policies of these third-party services. We are not responsible or liable for these third parties' privacy practices or the content of their privacy policies. Any data collected by these third parties is subject to their own privacy practices, over which we have no control.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security. You acknowledge that you provide your personal information at your own risk.

We are not responsible for circumvention of any privacy settings or security measures contained on the website or third-party platforms.

Payment Instructions. You acknowledge and agree that Payment Instructions you enter into the Service are inherently shared with the recipients of your invoices, payment links, and related documents. The security of information transmitted to or through third-party payment providers is governed by those providers' own security practices and is outside Invoice Mama's control. To the maximum extent permitted by applicable law, you assume all risk associated with the exposure, interception, copying, or misuse of Payment Instructions once they leave our systems or are accessed by invoice recipients or other third parties.

Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

When we anonymize information, we follow the Statistics section (when in effect) and Quebec requirements described in our regional notices.

In some circumstances, you can ask us to delete your data. See the "Your Legal Rights" section below for further information.

Account Deletion and Data Removal

If you have created an account with our Service, you have the right to request deletion of your account and associated personal data at any time. You can initiate account deletion through the account settings within our mobile app or web application, or by contacting us directly.

Upon receiving a valid deletion request, we will delete your account and all associated personal data, except for data we are legally required to retain (such as transaction records for tax and accounting purposes). We will process deletion requests within 30 days and notify you upon completion.

Please note that account deletion is permanent and cannot be reversed. Any active subscriptions will be cancelled, and you will lose access to any invoices, templates, or other data associated with your account.

Your Legal Rights

Depending on your location and applicable laws, you may have the following rights with respect to your personal data:

• Right to access: You have the right to request copies of your personal data. We may charge a reasonable fee when the request is manifestly unfounded, excessive, or repetitive.
• Right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to data portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
• Right to withdraw consent: Where we are relying on consent to process your personal data, you have the right to withdraw this at any time.

If you make a request, we have one month to respond to you. Please contact us if you wish to make a request. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Limitation of Liability

To the maximum extent permitted by applicable law, Invoice Mama and its affiliates, officers, employees, agents, partners, and licensors shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including without limitation, loss of profits, data, use, goodwill, or other intangible losses resulting from:

• Your access to or use of or inability to access or use the service
• Any conduct or content of any third party on the service
• Any content obtained from the service
• Unauthorized access, use, or alteration of your transmissions or content
• Any other matter relating to the service
• Any reliance you place on the completeness, accuracy or existence of any advertising, or as a result of any relationship or transaction between you and any advertiser or sponsor whose advertising appears on the service
• Any changes which we may make to the service, or for any permanent or temporary cessation in the provision of the service (or any features within the service)
• The deletion of, corruption of, or failure to store, any content and other communications data maintained or transmitted by or through your use of the service
• Your failure to provide us with accurate account information
• Your failure to keep your password or account details secure and confidential
• Any errors or omissions in any content or for any loss or damage of any kind incurred as a result of your use of any content posted, transmitted, or otherwise made available via the service
• Your use of Payment Instructions or third-party payment methods through the service, including lost funds, payments sent to the wrong recipient, failed or delayed transfers, chargebacks, holds, reversals, fraud, scams, provider account suspension or closure, or the privacy, security, or business practices of any third-party payment provider
• The disclosure, copying, forwarding, or misuse of Payment Instructions by invoice recipients, payment-link viewers, or any other third party who accesses documents or links generated through the service

In no event shall our total liability to you for all claims exceed the amount you have paid, if any, to Invoice Mama for the service during the twelve (12) month period prior to any cause of action arising.

This limitation of liability section applies whether the alleged liability is based on contract, tort, negligence, strict liability, or any other basis, even if Invoice Mama has been advised of the possibility of such damage. The foregoing limitation of liability shall apply to the fullest extent permitted by law in the applicable jurisdiction.

Some states or jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so the above limitations or exclusions may not apply to you. This agreement gives you specific legal rights, and you may also have other rights which vary from state to state or jurisdiction to jurisdiction. The disclaimers, exclusions, and limitations of liability under this agreement will not apply to the extent prohibited by applicable law.

Force Majeure: Invoice Mama shall not be liable for any failure to perform its obligations hereunder where such failure results from any cause beyond Invoice Mama's reasonable control, including, without limitation, mechanical, electronic or communications failure or degradation, acts of God, terrorism, epidemic, pandemic, or government restrictions.

International Transfers

Our services are intended for global use. Your information, including personal data, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside Canada and choose to provide information to us, please note that we transfer the data, including personal data, to Canada (where our company is based) and process it there, as well as in other countries where our service providers operate, as described in this policy. Where the law requires your consent for a transfer, we ask for it separately.

For users in the European Economic Area (EEA), United Kingdom, or regions with similar data protection laws: We ensure appropriate safeguards are in place for international data transfers in compliance with applicable laws.

Invoice Mama will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy and no transfer of your personal data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information.

Dispute Resolution

If you have any concern or dispute about our privacy policy, you agree to first try to resolve the dispute informally by contacting us. If these efforts prove unsuccessful, you agree that any dispute, claim or controversy arising out of or relating to this privacy policy shall be settled by binding arbitration, rather than in court.

The arbitration shall be conducted in accordance with the arbitration laws of Ontario, Canada. Any judgment on the award rendered by the arbitrator may be entered in any court of competent jurisdiction. By agreeing to this privacy policy, you and Invoice Mama waive the right to a jury trial and to participate in a class action lawsuit.

You remain free to bring your dispute in your local small claims court, if permitted by that small claims court's rules.

For users in regions with mandatory consumer protection laws that cannot be waived, the dispute resolution provisions above may not apply to you to the extent they conflict with your local laws.

Governing Law

This privacy policy and your use of the website and service shall be governed by and construed in accordance with the laws of Canada and the Province of Ontario, without giving effect to any choice or conflict of law provision or rule, regardless of your location.

Any legal suit, action, or proceeding arising out of, or related to, this privacy policy or the website shall be instituted exclusively in the courts of Canada or the courts of the Province of Ontario. You waive any and all objections to the exercise of jurisdiction over you by such courts and to venue in such courts.

If you are accessing our services from regions where other laws may apply, these terms still apply and Canadian courts have jurisdiction, without depriving you of mandatory consumer protections under the laws of your country of residence.

Severability

If any provision of this privacy policy is held to be unenforceable or invalid, such provision will be changed and interpreted to accomplish the objectives of such provision to the greatest extent possible under applicable law and the remaining provisions will continue in full force and effect.

This privacy policy constitutes the entire agreement between us regarding our service and supersedes and replaces any prior agreements we might have had between us regarding the service.

Mobile Applications

When you use our mobile applications (available on the Apple App Store for iOS and Google Play Store for Android), this privacy policy applies to all data collection and processing activities. Our mobile apps may collect additional device-specific information including device identifiers, operating system type and version, app version, and usage analytics (e.g., features used, session duration) to provide, maintain, and improve the service.

iOS (Apple App Store): This privacy policy is provided by Invoice Mama, the developer of the Invoice Mama app, and not by Apple Inc. Apple has no responsibility for the app's data collection practices or this privacy policy.

Android (Google Play Store): This privacy policy is provided by Invoice Mama, the developer of the Invoice Mama app, and not by Google LLC. Google has no responsibility for the app's data collection practices or this privacy policy.

In-app purchases and subscriptions are processed by Apple (iOS) or Google (Android). Payment and billing data for those transactions are governed by the respective app store's privacy policy. We receive subscription status information to provide access to premium features.

Any questions or concerns regarding privacy, data collection, or your rights should be directed to Invoice Mama using the contact information below.

Contact us

Questions or requests: support@invoicemama.com or our Support page.