Privacy Policy (upcoming)

The short version

• Southern East Inc., a Canadian company in Ontario, runs Invoice Mama.
• We use your information to run and improve Invoice Mama, keep it secure, and talk with you.
• We never sell your personal information or your Customer Data for money. We may share statistics that do not identify anyone.
• We do not collect, use, or sell personal data to train large language models. We do not use your personal information or the invoices, estimates, client records, and other content you put in Invoice Mama to train AI models.
• Before we give a business or research partner anything that identifies you, we will ask you first and you can say no.
• If we change how we use your information, we will tell you at least 30 days ahead. We will not apply a new use to information we already have unless you say yes. If you do not agree, you can close your account; we keep handling information we already hold under the earlier version.
• Your choices: Your Privacy Choices. Questions: Rishit Patel, support@invoicemama.com.

Who we are

Invoice Mama is run by Southern East Inc., a corporation incorporated under the laws of Canada, with a mailing address at 222 Main St E, North Bay, ON P1B 1B1 ("we", "us"). We decide how and why your personal information is used.

Privacy Officer. Rishit Patel is responsible for how Southern East Inc. protects personal information. For people in Quebec, this is also our person in charge of the protection of personal information. Contact: support@invoicemama.com, or by mail at Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1.

What this policy covers. This policy covers Invoice Mama, including invoicemama.com, app.invoicemama.com, mobile apps, and MCP connections. Rules for information about your clients are in Customer Data.

Who we share information with

Service providers act only on our instructions under contract.

Microsoft Clarity. On our marketing site, Clarity may record clicks, scrolls, and page interactions. We mark form fields and document previews with Clarity's masking attribute so typed input and echoed values are not recorded. Microsoft is the provider. You can opt out at Your Privacy Choices, with Global Privacy Control, or by declining analytics cookies in the EEA, UK, or Switzerland. When opted out, we do not load the Clarity script.

PostHog. PostHog provides product analytics and crash/error reporting in the web app and the mobile apps, and session replay in the web app only. On app.invoicemama.com, session replay includes public invoice and estimate pages your clients may view. Replays can capture on-screen text and typed input; we do not mask fields in our configuration. PostHog acts as our service provider for operating, securing, supporting, and improving the Service.

People and apps you choose. When you send an invoice or connect an AI assistant, we share what you direct us to share.

Legal and safety. We may disclose information when required by law or to protect people and the service from fraud or abuse.

Do we use personal information to train AI?

• We do not collect, use, or sell personal data to train large language models. We do not use your personal information or the invoices, estimates, client records, and other content you put in Invoice Mama to train AI models.
• We do not sell personal information to train AI models.
• We do not let partners train on information that identifies you unless you opt in.
• Connected AI assistants (MCP) receive data only because you asked us to send it.

Notice for US residents

Last updated: October 2026.

This notice supplements our Privacy Policy for residents of US states with comprehensive privacy laws. It describes our practices at or before collection and how to exercise your rights.

Categories of personal information

Sale and sharing. We do not sell personal information for money. In the preceding 12 months we have not sold personal information for monetary consideration. Our marketing site may use Microsoft Clarity for US visitors unless you opt out. Some state laws may treat certain analytics or session-replay data as "sharing" for cross-context behavioral advertising even when no money changes hands. You can opt out at Your Privacy Choices or with Global Privacy Control.

Sensitive information. We do not use or disclose sensitive personal information (such as government ID numbers you may enter as a tax identifier on an invoice) for purposes other than providing the service you request, security, or as required by law.

Deidentified information. We may create deidentified or aggregated information that does not identify you. We commit to maintain and use deidentified information without attempting to re-identify it, except as permitted by law to test our processes.

Financial incentives. We do not offer financial incentives in exchange for the collection, sale, or sharing of personal information.

AI training. We do not collect, use, or sell personal data to train large language models. We do not use your personal information or the invoices, estimates, client records, and other content you put in Invoice Mama to train AI models.

Your rights. Depending on your state, you may have the right to know, access, delete, correct, and port personal information; to opt out of sale/sharing and targeted advertising; and to limit use of sensitive information. We do not discriminate against you for exercising these rights. We confirm every request and respond within 45 days (with notice if we extend once). Authorized agents may act with signed permission. To appeal a decision, reply "appeal" to our response or contact your state attorney general. Contact: support@invoicemama.com or Your Privacy Choices. We will not ask you to re-verify for at least 12 months after a confirmed request.

Minors. We do not knowingly sell or share personal information of anyone under 18.

Notice for people in the EEA, UK, and Switzerland

Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1 is the controller. Contact support@invoicemama.com.

Legal bases

Your rights. You may access, rectify, erase, restrict, object, and port your data, and withdraw consent where processing is based on consent. You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Contact support@invoicemama.com. You may lodge a complaint with your supervisory authority.

Transfers. We process data in Canada and where our service providers operate. Canada has an EU adequacy decision for commercial organizations covered by PIPEDA. For transfers to the US and other countries without adequacy, we use Standard Contractual Clauses, the UK Addendum, and the EU-US Data Privacy Framework where applicable.

Notice for people in Quebec

• Person in charge: Rishit Patel (support@invoicemama.com), Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1.
• Optional partner programs are off until you turn them on. PostHog provides product analytics and crash/error reporting in the web app and mobile apps, and session replay in the web app only (see Who we share information with). Marketing-site Clarity stays off until you allow it.
• We collect only what we need for stated purposes. Profiling or identification features are disclosed before you enable them.
• Consent is requested separately for specific purposes; sensitive information requires express consent.
• Anonymization follows Quebec regulation and serious, legitimate purposes, including research where permitted.
• Before personal information leaves Quebec, we assess privacy impacts and use contractual protections.
• You may access, correct, withdraw consent, and port your information. We respond within 30 days.
• Complaints: Commission d'accès à l'information du Québec.

Changes to this policy

Small changes (clearer wording, more protection, or a new service provider doing the same job that does not handle Customer Data): we update this page and the Last updated date. Adding or replacing a provider that handles Customer Data follows the Terms.

Material changes (new partners, new purposes, identifying sharing, AI training on your data, weaker promises, or storing data outside Canada): at least 30 days' notice by email and on Invoice Mama. Material changes apply only to information collected after they take effect. We use information we already hold in a new way only if you agree with a clear action. If you do not agree, we keep handling your existing information under the earlier version. You may close your account.

Past versions: through October 5, 2026, October 6 through November 15, 2026.

If the law requires a faster change, we give as much notice as we can.

Legal Basis for Processing

We will only process your personal data when we have a legal basis to do so. Legal bases include:

• Consent: Where you have given us clear consent to process your personal data for a specific purpose.
• Contract: Where processing is necessary for the performance of a contract we have with you, or because you have asked us to take specific steps before entering into a contract.
• Legal obligation: Where processing is necessary for us to comply with the law.
• Legitimate interests: Where processing is necessary for our legitimate interests or the legitimate interests of a third party, provided your fundamental rights and freedoms do not override those interests.

We may rely on different legal bases depending on the specific processing activity. Where we rely on legitimate interests, these interests include: providing and improving our services, communicating with users, marketing our services, protecting against fraud and security threats, and complying with legal obligations.

Age Restrictions

Our services are not intended for use by individuals under the age of 18 or the age of majority in the jurisdiction where they reside, whichever is higher. We do not knowingly collect personal information from minors. If we learn that we have collected personal information from a minor, we will take steps to delete that information as quickly as possible. If you believe we might have any information from or about a minor, please contact us.

Information We Collect

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier.
• Contact Data: includes email address and telephone numbers.
• Business Data: includes business name, address, tax identification numbers, business contact information, and other information related to invoices you generate.
• Financial Data: includes bank account details, payment card details, billing address, and transaction records related to your Invoice Mama subscription or premium features. This category also includes payment instructions you voluntarily enter into the Service for display on invoices, payment links, or other outputs, such as bank account and routing numbers, payment-provider handles or usernames (e.g., Venmo, Zelle, PayPal, Wise, Interac e-Transfer, UPI, or regional equivalents), QR codes, payment links, phone numbers, email addresses, or cryptocurrency wallet addresses ("Payment Instructions"). Payment Instructions are User Content you control; we do not use them to process, initiate, or settle any payments on your behalf.
• Transaction Data: includes details about payments to and from you, invoice details, and other details of products and services you have purchased from us.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device identifier, and other technology on the devices you use to access this website.
• Profile Data: includes your username and password, purchases or orders made by you, your preferences, feedback, and survey responses.
• Usage Data: includes information about how you use our website, products, and services, including clicking patterns, features used, time spent on pages, and other engagement metrics.
• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• User Content: includes any content that you create, upload, or provide while using our services, such as invoice templates, custom logos, business information, and Payment Instructions you add to invoices, payment links, or other outputs of the Service.

We may combine usage data into aggregated statistics that do not identify anyone—for example, the percentage of users who use a feature. When we anonymize data for research or statistical purposes, we do so under the rules in our Privacy Policy.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offenses.

User-Provided Payment Information

Our Service allows you to enter Payment Instructions for display on invoices, invoice links, payment links, PDFs, customer-facing portals, and other outputs. You choose which payment details to enter, which payment providers to reference, and where to display them. Invoice Mama does not require you to provide Payment Instructions to use the Service.

Visibility of Payment Instructions. Payment Instructions you add to an invoice or payment link may become visible to invoice recipients, payment-link viewers, anyone who receives a shared PDF or forwarded link, and the service providers we use to host, deliver, and operate the Service. You acknowledge that sharing Payment Instructions through the Service is your voluntary decision and that once an invoice or payment link is sent or shared, recipients may copy, forward, store, or otherwise use the payment details it contains.

Third-party payment providers. Any payment transaction conducted through a third-party provider whose details you display (such as Venmo, Zelle, PayPal, Wise, Interac e-Transfer, UPI, bank transfers, or local equivalents) is governed entirely by that provider's own terms of service, privacy policy, and security practices. Invoice Mama does not control, endorse, or assume any responsibility for the privacy or security practices of these third-party payment providers. We strongly recommend that you review the terms and privacy policies of any payment provider whose details you share through the Service.

Your responsibility. You are solely responsible for the accuracy, legality, and appropriateness of all Payment Instructions you provide. You assume all risks associated with sharing your payment details through the Service, including the risk that Payment Instructions may be accessed, copied, or misused by invoice recipients or other third parties. To the maximum extent permitted by applicable law, Invoice Mama shall not be liable for any loss, damage, or claim arising from the disclosure, use, or misuse of Payment Instructions you have entered into the Service.

Surcharge Data

When a business enables the credit card surcharge feature, we collect and store:

• Whether surcharging is enabled and the configured surcharge rate or preset.
• The identity (user ID) of the person who accepted the surcharge liability disclaimer and the timestamp of acceptance.
• The surcharge amount applied to each payment session.

This data is used to calculate and apply surcharges to customer payments, maintain an audit trail for compliance and dispute resolution, and facilitate payment processing through Stripe. Surcharge-related data is retained for as long as the business account remains active and may be shared with Stripe as part of payment processing.

Cookies and analytics

We use cookies and similar technologies on our marketing site. Plausible analytics does not use cookies. Microsoft Clarity may set cookies when you allow it. Invoice Mama uses PostHog for product analytics and crash/error reporting in the web app and the mobile apps, and session replay in the web app only. See Who we share information with. PostHog is not controlled by marketing-site cookie choices.

• im_geo_country (about 24 hours): stores your country code from our hosting provider so we can apply regional privacy rules (for example, EEA analytics consent). Set on HTML page views only.
• im_privacy_opt_out (1 year): remembers your choice to opt out of sale/sharing and Clarity on this browser.
• im_analytics_consent (1 year): remembers whether you allowed non-essential analytics cookies in the EEA, UK, or Switzerland.
• _clck / _clsk (Microsoft Clarity, when loaded): session replay and analytics on our marketing site.

Manage choices at Your Privacy Choices. You can also instruct your browser to block cookies, though some features may not work.

How We Use Your Information

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To provide you with the invoice generation service.
• To manage our relationship with you.
• To improve our website, products/services, marketing, and customer relationships.
• To recommend products or services which may be of interest to you.
• To comply with a legal or regulatory obligation.
• For marketing purposes: We may use all or most of the data we collect for our own marketing efforts, including sending you information about our products, services, promotions, and other offerings that may be of interest to you. While we do not sell your personal data, we do use it to tailor our marketing communications and improve our services.

You may opt out of receiving marketing communications from us by following the unsubscribe instructions included in our marketing communications.

Third-Party Data Collection

We use various third-party services to help operate and improve our service. These third parties may collect data about you when you interact with our service. This includes but is not limited to analytics providers, payment processors, hosting services, and marketing tools.

These third-party services have their own privacy policies addressing how they use the data they collect. We encourage you to read the privacy policies of these third-party services. We are not responsible or liable for these third parties' privacy practices or the content of their privacy policies. Any data collected by these third parties is subject to their own privacy practices, over which we have no control.

Data Security

We use administrative, technical and physical safeguards designed to protect personal information against loss, theft and unauthorized access, use, disclosure, copying or modification, appropriate to its sensitivity (including encryption in transit and at rest and access limited to people who need it). No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed or altered by unauthorized persons.

If a breach of security safeguards involving your personal information creates a real risk of significant harm (Canada), a risk to your rights and freedoms (EU/UK), or otherwise requires notice under applicable law (including US state breach laws), we will notify you and the relevant regulators as and when the law requires.

You are responsible for keeping your login credentials secure and for the security of your devices and of AI assistants you connect.

Payment Instructions. You acknowledge and agree that Payment Instructions you enter into the Service are inherently shared with the recipients of your invoices, payment links, and related documents. The security of information transmitted to or through third-party payment providers is governed by those providers' own security practices and is outside Invoice Mama's control. To the maximum extent permitted by applicable law, you assume all risk associated with the exposure, interception, copying, or misuse of Payment Instructions once they leave our systems or are accessed by invoice recipients or other third parties.

Data Retention

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

When we anonymize information, we follow the Statistics section (when in effect) and Quebec requirements described in our regional notices.

In some circumstances, you can ask us to delete your data. See the "Your Legal Rights" section below for further information.

Account Deletion and Data Removal

If you have created an account with our Service, you have the right to request deletion of your account and associated personal data at any time. You can initiate account deletion through the account settings within our mobile app or web application, or by contacting us directly.

Upon receiving a valid deletion request, we will delete your account from active systems and associated personal data, except for data we are legally required to retain (such as transaction records for tax and accounting purposes). Residual copies in backups are overwritten within 35 days. You may export data for up to 30 days after closure where the product allows. We will process deletion requests within 30 days.

Please note that account deletion is permanent and cannot be reversed. Any active subscriptions will be cancelled, and you will lose access to any invoices, templates, or other data associated with your account.

Your Legal Rights

Depending on your location and applicable laws, you may have the following rights with respect to your personal data:

• Right to access: You have the right to request copies of your personal data. We may charge a reasonable fee when the request is manifestly unfounded, excessive, or repetitive.
• Right to rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to erasure: You have the right to request that we erase your personal data, under certain conditions.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to object to processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to data portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
• Right to withdraw consent: Where we are relying on consent to process your personal data, you have the right to withdraw this at any time.

If you make a request, we have one month to respond to you. Please contact us if you wish to make a request. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

International Transfers

Our services are intended for global use. Your information, including personal data, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside Canada and choose to provide information to us, please note that we transfer the data, including personal data, to Canada (where our company is based) and process it there, as well as in other countries where our service providers operate, as described in this policy. Where the law requires your consent for a transfer, we ask for it separately.

For users in the European Economic Area (EEA), United Kingdom, or regions with similar data protection laws: We ensure appropriate safeguards are in place for international data transfers in compliance with applicable laws.

We use contractual and organizational safeguards designed to protect personal information transferred outside your jurisdiction, as described in this policy and our regional notices.

Legal terms

If you use Invoice Mama, the Terms of Service govern your use of the Service, including limitations of liability and how disputes are resolved. This Privacy Policy is a notice about how we handle personal information. It does not limit any rights you have under privacy law, including the right to complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, your EU/UK supervisory authority, or a US state attorney general.

Mobile Applications

When you use our mobile applications (available on the Apple App Store for iOS and Google Play Store for Android), this privacy policy applies to all data collection and processing activities. Our mobile apps may collect additional device-specific information including device identifiers, operating system type and version, app version, and usage analytics (e.g., features used, session duration) to provide, maintain, and improve the service.

iOS (Apple App Store): This privacy policy is provided by Invoice Mama, the developer of the Invoice Mama app, and not by Apple Inc. Apple has no responsibility for the app's data collection practices or this privacy policy.

Android (Google Play Store): This privacy policy is provided by Invoice Mama, the developer of the Invoice Mama app, and not by Google LLC. Google has no responsibility for the app's data collection practices or this privacy policy.

In-app purchases and subscriptions are processed by Apple (iOS) or Google (Android). Payment and billing data for those transactions are governed by the respective app store's privacy policy. We receive subscription status information to provide access to premium features.

Any questions or concerns regarding privacy, data collection, or your rights should be directed to Invoice Mama using the contact information below.

Contact us

Questions or requests: support@invoicemama.com or our Support page.