1. Who we are and our role
InvoiceIQ (“we”, “us”) provides a web application that turns invoices and receipts into structured, verified records. This policy explains how we handle personal data when you use the application, visit this website or contact us. We follow the Nigeria Data Protection Act 2023 (NDPA) and guidance from the Nigeria Data Protection Commission (NDPC).
- Document data (uploaded files and the data extracted from them): the organization that uploads it is the data controller and InvoiceIQ is a data processor acting on its instructions.
- Account, billing and website data: InvoiceIQ is the data controller.
2. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, organization, role, hashed password | You or your organization’s administrator |
| Documents | Uploaded invoices and receipts, page images and the text read from them | Uploaded by your team |
| Extracted records | Supplier names and addresses, invoice numbers, dates, amounts, tax, line items, categories | Extracted, then reviewed by your team |
| Audit and security data | Sign-ins, uploads, edits, confirmations, exports, timestamps, request identifiers | Generated automatically |
| Billing records | Plan bought, amount, payment status, channel, Paystack reference and the paying administrator’s email | Paystack and you |
| Enquiries | Name, email, organization and message from the contact form | You |
Invoices and receipts can include names, addresses, phone numbers, tax identifiers and bank details of suppliers or customers. We process them only to provide the service, and we do not collect special-category data on purpose.
3. How we use personal data
- To provide the service: storing documents, extracting and validating data, showing it for review and producing exports.
- To keep an audit trail of uploads, edits, confirmations and exports.
- To secure the service: authentication, isolation between organizations, abuse prevention and incident investigation.
- To take payments, respond to enquiries and meet legal obligations.
We do not sell personal data or use it for advertising.
4. Lawful basis
- Document data: processed for your organization, which relies on its own lawful basis, typically its legitimate interests or legal obligations in keeping financial records.
- Accounts and billing: performance of our contract with your organization, and legal obligations for accounting records.
- Security logs and enquiries: our legitimate interests in running a secure service and responding to you.
5. AI processing and human review
- A person confirms every record. Extracted data is a proposal until someone in your organization reviews and confirms it. InvoiceIQ does not approve invoices, make payments or make decisions based solely on automated processing.
- Checks are done by code. Totals, line items, dates and duplicates are checked by deterministic rules, and problems are shown to you rather than silently corrected.
- No model training on your documents. Where an external AI provider is used, we use commercial terms that prohibit training on customer data.
- Traceability. Each record keeps the AI’s original values and the provider and model used, separately from your edits.
7. International transfers
Some sub-processors, including AI model providers, may process data outside Nigeria. We transfer personal data abroad only where the NDPA permits it, for example under appropriate contractual safeguards.
8. How long we keep data
| Data | Retention |
|---|---|
| Documents and extracted records | While your workspace is active or until you delete them. Deleting a document removes the file, its pages and its record. |
| Accounts | While active, then deleted or anonymised within 90 days of the workspace closing, unless needed for audit records. |
| Billing records | As long as tax and accounting law requires, typically six years. |
| Security logs | Up to 12 months. |
| Contact enquiries | Up to 24 months after our last exchange. |
9. How we protect data
- Encryption in transit (HTTPS) and of storage and backups where the hosting platform supports it.
- Passwords stored only as Argon2 hashes, and HttpOnly session cookies.
- Strict separation between organizations, enforced on every request on the server.
- Original files kept private and unchanged; uploads validated and stored under random identifiers.
- Application logs exclude document contents, passwords and tokens.
- If a breach is likely to put people at risk, we will notify affected organizations without undue delay.
10. Your rights
Under the NDPA you can ask to access, correct, delete, restrict or port your personal data, object to processing, and not be subject to decisions based solely on automated processing. For data inside a business’s documents, contact that business first. For anything else, use our contact form and choose “Something else”.
12. Changes to this policy
We will update this policy when our practices change and tell workspace administrators about material changes in advance.
13. Contact and complaints
Send privacy questions or requests through our contact form. InvoiceIQ operates from Nigeria.
If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC).