Privacy Policy

Last updated: 17 October 2026

This Privacy Policy describes the policies and procedures of Invoice Maker ("we", "us", "our"), the developer and publisher of the Invoice Maker App, on the collection, use, and disclosure of your information when you use the Service, and tells you about your privacy rights and how the law protects you.

By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in the singular or in the plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Application refers to the Invoice Maker App, the software program provided by the Company, including the Android application and the Windows desktop application.
• Cloud Account means the optional account you create with your email address in order to use Cloud Sync.
• Cloud Sync means the optional feature that uploads your business data from the Application to our cloud servers and keeps it synchronised across your devices.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Invoice Maker, the developer and publisher of the Invoice Maker App.
• Country refers to: Pakistan
• Customer Data means information about your clients, customers, suppliers and other business contacts that You enter into the Application — such as their names, phone numbers, email addresses, billing and shipping addresses and tax identification numbers.
• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Application and the Website.
• Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Website refers to the Invoice Maker website on which this policy is published.
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, we may ask you to provide certain personally identifiable information that can be used to contact or identify you. This may include:

• Email address — collected only if You choose to enable Cloud Sync. We use it to create your Cloud Account and to send you a one-time sign-in code. We do not use a password.
• Business profile details that You enter — business name, phone number, email address, business address, business description, tax identification number, business logo and signature image.
• Customer Data that You enter about your own clients and suppliers.
• Google account email address — collected only if You choose to use the Google Drive backup feature.
• Purchase information — if You buy Premium, the plan, subscription status and renewal dates we receive from Paddle or Google Play. We never see or store your payment card details.

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device's Internet Protocol address (e.g., IP address), the features of our Service that you use, the time and date of your use, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile operating system version, the Application version, a randomly generated app instance identifier, crash reports and performance diagnostics.

The app instance identifier is generated by the Application, is not derived from your device hardware, and is reset if You uninstall and reinstall the Application. It is not linked to your Cloud Account email address.

The Windows desktop application does not send usage analytics or crash reports. See Invoice Maker for Windows.

Information Collected While Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Contacts. Access to your Device's phone book, so You can pick an existing contact when creating a customer. Contact details are only saved if You select a contact; we do not upload or retain your phone book.
• Camera. Access to your Device's camera to scan a barcode to save an item or add an item to a sale, and to photograph your business logo or signature. Barcode scanning is performed entirely on your device — camera images are not uploaded to us or to any third party.
• Storage. Access to your Device's storage to save invoices, reports, exports and local backups.
• Google account and Google Drive. Our Application may request access to your Google account and Google Drive to provide automatic data backup and restore functionality. See the Google Drive and Google Sign-In section below.
• Location permission (for Bluetooth printers only). Android requires apps to hold the location permission in order to discover nearby Bluetooth devices on older versions of Android. We request it solely so You can find and connect to a thermal receipt printer. The Application never reads, collects, stores, or shares your location.
• Notifications. Permission to show notifications, used to report the status of scheduled backups.

You can enable or disable access to this information at any time through Your Device settings.

Invoice Maker for Windows

The Windows desktop application works in the same way as the Android application, with these differences:

• Local, encrypted storage. Your business data is stored in an encrypted database on your computer. Without Cloud Sync, it never leaves your computer.
• No analytics or crash reporting. The desktop application does not send Usage Data, analytics events or crash reports to us or to Google Firebase.
• No device permissions. The desktop application does not access your contacts, camera or location. Images you add (such as a logo or signature) are files you choose yourself.
• Printing and PDFs. Invoices are turned into PDFs on your computer using the Microsoft Edge (or Google Chrome) browser already installed on it, without sending them over the internet. Receipts print to printers installed on your computer.
• Phone backups. If You open a backup file from your phone in the desktop application, it is read on your computer only.
• Cloud Sync and Premium. If You sign in, Cloud Sync works exactly as described below and uses the same Cloud Account as your phone. Premium can be bought from the desktop application through Paddle — see Payments.

Cloud Sync

What Cloud Sync is

Cloud Sync is an optional feature that stores a copy of your business data on our cloud servers and keeps it up to date across the devices where you are signed in. It exists so that you do not lose your records if your phone or computer is lost, damaged or replaced.

Cloud Sync is off by default. No business data leaves your device until you open Cloud Sync in the Application (on Android: Menu → Cloud Sync), choose to enable it, and sign in. If you never enable it, the Application continues to work entirely offline and stores everything only on your device.

Creating your Cloud Account

To enable Cloud Sync you enter your email address. We send a six-digit one-time code to that address, and you enter the code to sign in. There is no password to create or remember.

Your Cloud Account stores only:

• Your email address
• A randomly generated account identifier used to tag your data so it is kept separate from other users' data
• Sign-in timestamps needed to keep your session valid and secure

We do not collect a name, profile photo, date of birth, or any social media profile as part of your Cloud Account.

What is uploaded when Cloud Sync is enabled

Once you enable Cloud Sync, the following business records are uploaded to our servers and kept synchronised:

• Customers and suppliers — name, phone number, email address, billing address, shipping address, tax identification number, opening and current balance.
• Your business profile — business name, phone number, email address, business address, business description and tax identification number.
• Invoices and other transactions — reference numbers, dates and due dates, the customer or supplier the transaction belongs to, subtotals, discounts, taxes, additional charges, totals, amounts paid or received, amounts due, payment status, descriptions, shipping addresses and transportation details.
• Transaction line items — item name, quantity, unit, price, description, discount, tax and totals.
• Your item catalogue — item names, codes, units, categories, descriptions, sale, wholesale and purchase prices, discounts and tax rates.
• Stock adjustments and item categories.
• Expenses — expense categories, expense items and amounts.

Please read this carefully. The records above include Customer Data — personal information about your own customers and suppliers, such as their names, phone numbers, email addresses and postal addresses. When you enable Cloud Sync, that information is uploaded to our servers along with the rest of your business records. Please see Your Customers' Data below for what this means for your own legal responsibilities.

Business logo and signature images

If you have added a business logo or a signature image to your business profile, those two image files are uploaded to our cloud file storage so they can appear on your invoices on your other devices.

These files are stored in a private storage area. They are not published, not indexed by search engines, and cannot be opened by anyone who is not signed in to your Cloud Account. Each account's files are kept in a separate folder identified by your account identifier.

What is NOT uploaded

The following stay on your device only and are never sent to our servers:

• Generated PDF invoices, receipts and reports. These are created on your device. They leave your device only if you choose to share, email, print or save them.
• Excel and CSV exports. Same as above.
• Your application settings — invoice print settings, thermal printer settings, home screen layout, report filters and general preferences.
• Your device's phone book. Only contacts you explicitly select become customers.
• Camera images used for barcode scanning.
• Google Drive backup files. These go to your Google Drive, not to us. See below.

When Cloud Sync runs

Once you have enabled it, Cloud Sync runs automatically and continuously while you are using the Application — there is no separate "sync now" button to press. Changes you make are sent as you save them, and changes made on your other devices are received while the Application is open. Syncing pauses while the Application is in the background and resumes when you return to it.

Choosing how your existing data is merged

The first time you enable Cloud Sync on a device, the Application asks you to choose one of two options:

• Use the data from the cloud — the data currently on this device is replaced with the data from your Cloud Account.
• Use the data from this device — the data currently in your Cloud Account is erased and replaced with the data from this device.

Please choose carefully: both options overwrite data, and the change cannot be undone by us.

Your Customers' Data

You decide what information about your customers and suppliers you enter into the Application. We store and transmit that information on your behalf and under your instructions; we do not use it for our own purposes, do not analyse it, and do not sell or disclose it to anyone.

Because that information relates to other people, you are responsible for it. In particular, you are responsible for ensuring that you have a lawful basis to collect and store your customers' details, for telling your customers how you use their information where the law requires it, and for responding to any requests they make about their information. Where data protection law uses the terms, you act as the controller of Customer Data and we act as your processor.

Turning Cloud Sync off

You can turn Cloud Sync off at any time from Cloud Sync in the Application (on Android: Menu → Cloud Sync). This signs you out on that device and stops any further syncing. It does not delete anything — the data already on your device stays on your device, and the data already in your Cloud Account stays in your Cloud Account. To remove your cloud data, see Delete Your Personal Data.

Payments

Invoice Maker Premium is a paid subscription. How your payment is handled depends on where you buy it:

• Desktop application and Website — Paddle. Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for these orders. Paddle collects your name, email address, billing address (country and postal code), payment details and IP address to process the payment, calculate and collect tax, prevent fraud and send your receipt. Paddle processes this information as an independent controller under Paddle's Privacy Policy.
• Android application — Google Play. Purchases made inside the Android application are processed by Google Play Billing under Google's privacy policy.

From Paddle or Google Play we receive only what we need to give you Premium: which plan you bought, the subscription status, renewal and expiry dates, a transaction or purchase identifier, and the email address of your Cloud Account so Premium is linked to it. We never see or store your full payment card details.

Our Website

The Website is a simple information site. It has no sign-in, no advertising, and no analytics or tracking cookies.

• Hosting. The Website is hosted by Cloudflare. Like any web host, Cloudflare processes your IP address and basic request information (such as browser type and the page requested) to deliver the pages, keep the Website secure and protect it from attacks.
• Fonts. The Website loads its font from Google Fonts, so your browser connects to Google's servers, which receive your IP address.
• Emails you send us. If you email us — for example to ask to be told when the Windows version is ready — we use your email address only to reply to you or to send what you asked for.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.
• To provide Cloud Sync: to store your business records, keep them synchronised across your devices, and restore them when you sign in on a new device.
• To manage Your Account: to manage your registration as a user of the Service, and to send the one-time codes needed to sign you in.
• For the performance of a contract: the development, compliance and undertaking of the purchase contract for the products, items or services You have purchased or of any other contract with Us through the Service, including managing subscriptions.
• To contact You: to send you service-related and security announcements, such as notices about changes to the Service, sign-in codes, or important updates to this Privacy Policy. We do not send marketing email.
• To manage Your requests: to attend and manage Your requests to Us, including support enquiries and any feedback you choose to submit through the Application.
• To keep the Service working and secure: to diagnose crashes, measure performance, detect abuse and fix defects.
• To perform backups and data restoration: where you have enabled it, we use access to Your Google Drive to store and restore Your data backups. This ensures you can retrieve your data if the Application is reinstalled or used on another device.
• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.
• For other purposes: such as data analysis in aggregate, identifying usage trends, and evaluating and improving our Service and your experience.

Sharing of Your Personal Data

We do not sell your personal information, and we do not share it for advertising or cross-context behavioural advertising. The Application contains no advertising software and no third-party tracking or attribution software.

We may share Your personal information in the following situations:

• With Service Providers: we share information with the providers listed in the table below, strictly so they can operate the Service on our behalf. They are not permitted to use your information for their own purposes. Paddle, as Merchant of Record, also uses payment information for its own legal obligations, such as tax and fraud prevention.
• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.
• With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy.
• For legal reasons: as described under Disclosure of Your Personal Data below.
• With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Service Providers we use

Google Drive and Google Sign-In

Our Android Application optionally uses Google Sign-In for authentication and the Google Drive API to back up and restore your data. This feature is separate from Cloud Sync, and you may use either, both, or neither.

We only access data necessary for:

• Signing in with your Google account
• Creating backup files in your Google Drive and reading them back when you restore

Backups are saved into a folder named InvoiceMaker in your Google Drive, organised by month. The Application requests the drive.file permission scope, which means it can only see and modify the files it created itself. It cannot access, read, list or modify any of your other Google Drive files or folders.

We do not store your Google account password. Backup files created in your Google Drive belong to you — they remain under your Google account and can be deleted by you at any time from Google Drive. We do not share your Google Drive data with any third party.

Compliance Note: We comply with the Google API Services User Data Policy, including the Limited Use requirements. We only use the information obtained from Google APIs to provide or improve user-facing features in our Application. This data is not used for advertising or analytics and is never sold or shared with third parties.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

Cloud Sync data. If you enable Cloud Sync, your synced records and your Cloud Account remain stored for as long as your account exists. They are not deleted automatically after a period of inactivity. They are removed when you delete your account, as described below.

Deleted records. When you delete an invoice, customer or item while Cloud Sync is enabled, the record is immediately hidden and stops syncing to your devices, but a marked-as-deleted copy is retained on our servers so that the deletion can be reliably applied to your other devices. These marked-as-deleted copies are permanently removed when you delete your cloud data or delete your account.

When you delete your account, nothing is retained. Account deletion removes your Cloud Account and every piece of data associated with it — all synced records, all marked-as-deleted copies, and your uploaded logo and signature images. Deletion from within the Application takes effect immediately; deletion requested through our web deletion page is completed within 7 days of us verifying the request. We do not merely deactivate or freeze accounts. We retain data after deletion only where we are required to by law, and only for as long as that obligation lasts.

Purchase records. Paddle and Google Play keep their own records of your purchases, as the law requires for tax and accounting, under their own privacy policies. Deleting your account does not cancel an active subscription; please cancel it first (Manage Subscription in the desktop application, or Google Play on Android).

Usage Data. The Company will retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, in accordance with Google Firebase's standard retention periods, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer.

Data on your device. Data stored locally in the Application remains on your device until you delete it within the Application, clear the Application's data, or uninstall the Application.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. Data synchronised through Cloud Sync is stored on cloud infrastructure operated by our Service Providers, which may be located outside of Pakistan and outside of Your state, province, country, or other governmental jurisdiction, where the data protection laws may differ from those in Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy, and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Delete Your Personal Data

You have the right to delete, or to request that We assist in deleting, the Personal Data that We have collected about You. The Application gives you these controls:

The web deletion page is available at https://invoice-maker-6246e.web.app/delete-account and does not require you to have the Application installed. For your security, we only act on requests sent from the email address registered to the account.

Deleting your Cloud Account does not delete the copy of your data held locally on your device — that remains yours, and you can remove it by clearing the Application's data or uninstalling the Application. Likewise, it does not delete backup files you have created in your own Google Drive or saved to your device's storage; you can delete those yourself.

You may also contact Us at the address at the end of this policy to request access to, correction of, or deletion of any personal information You have provided to Us. Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

The measures we apply include:

• Encryption in transit. All communication between the Application and our servers, Google Drive, Firebase and Paddle uses HTTPS/TLS. The Website is served over HTTPS only.
• Encryption on your device. The Application's local database is stored in encrypted form, on Android and on Windows.
• Account isolation. Every synced record is tagged with your account identifier, and our servers enforce access rules so that your records and your uploaded logo and signature images can only be read by your signed-in account.
• Private file storage. Logo and signature images are held in a private storage area that is not publicly accessible.
• No passwords to steal. Cloud Sync uses one-time email codes rather than stored passwords.
• No automatic device backup. The Android Application opts out of Android's automatic cloud backup, so your business database is not copied to Google's backup service without your involvement.

Please note that Cloud Sync is not end-to-end encrypted. Your data is encrypted in transit and protected by access controls at rest, but it is stored in a form that our infrastructure can process in order to provide the sync service.

Backup files stored in Google Drive are under your Google account and are protected by Google's security protocols. We do not store your Google account credentials or access any data beyond what is required for backup functionality.

You are responsible for keeping access to your device and to your email account secure, since anyone with access to your email inbox could request a sign-in code.

Your Privacy Rights

If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, our legal bases for processing your Personal Data are:

• Performance of a contract — to provide the Application, your Cloud Account, Cloud Sync and subscriptions.
• Your consent — for optional features that rely on device permissions (contacts, camera, Bluetooth/location for printers) and for optional Google Drive backup. You may withdraw consent at any time in your device settings or within the Application.
• Our legitimate interests — to keep the Application and Website secure, diagnose crashes, and understand aggregate feature usage so we can improve the Service.
• Compliance with a legal obligation — where we must retain or disclose information by law.

You have the right to:

• Access the Personal Data we hold about you
• Rectify inaccurate or incomplete data — most of which you can correct directly in the Application
• Erase your data — see Delete Your Personal Data
• Restrict or object to our processing of your data
• Data portability — you can export your invoices, customers, items and reports to PDF or Excel from within the Application at any time, without contacting us
• Withdraw consent at any time, without affecting processing carried out before withdrawal
• Lodge a complaint with your local supervisory authority

Controller and processor. We are the controller of your own account information and Usage Data. For Customer Data — information about your clients and suppliers — you are the controller and we act as your processor, processing that data only to provide the Service to you. If one of your customers contacts us about their data, we will refer them to you. For purchases made through Paddle, Paddle is the controller of the payment information it collects.

To exercise any of these rights, contact us at the address below. We will respond within the time limits set by applicable law.

If you are a California resident (CCPA / CPRA)

In the past twelve months we have collected the following categories of personal information:

• Identifiers — email address, account identifier, app instance identifier, IP address
• Commercial information — subscription and purchase records, and the business records you create in the Application
• Internet or other electronic network activity information — feature usage, crash and performance diagnostics

We collect this information for the business purposes described in Cloud Sync and Use of Your Personal Data above, and we disclose it only to the Service Providers listed above.

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age.

You have the right to know what personal information we collect and how we use it, the right to request deletion, the right to request correction, and the right not to receive discriminatory treatment for exercising these rights. You can exercise the deletion right directly through Delete Account in the Application, or by contacting us at the address below. You may use an authorised agent to make a request on your behalf.

Google Play Data Safety

This section summarises how this policy maps to the Data Safety information shown on our Google Play store listing, so that the two remain consistent:

• Data collected: email address (only with Cloud Sync enabled), app activity and diagnostics, and the business and financial records you enter — including your customers' contact details — when Cloud Sync is enabled.
• Data shared with third parties for their own purposes: none.
• Data encrypted in transit: yes.
• Users can request that data be deleted: yes, by two routes — Menu → Delete Account within the Application, and, without needing the Application installed, our web deletion page at https://invoice-maker-6246e.web.app/delete-account.
• Data collection is optional: yes — Cloud Sync, Google Drive backup, contacts access, camera access and Bluetooth printing are each optional and off until you enable them.

Children's Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from anyone under the age of 13 without verification of parental consent, We take steps to remove that information from Our servers.

If We need to rely on consent as a legal basis for processing Your information and Your country requires consent from a parent, We may require Your parent's consent before We collect and use that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party's site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top.

Where the changes are significant — for example, if we begin collecting a new category of personal information — we will give you a prominent notice within the Application before the change takes effect.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

This Service is provided by Invoice Maker, the developer and publisher of the Invoice Maker App. On Google Play, the Android app is listed under the developer name StarItZone.

If you have any questions about this Privacy Policy, or wish to exercise any of your privacy rights, You can contact us:

• Privacy point of contact — by email: shahhussain3435365@gmail.com
• To delete your account and data: https://invoice-maker-6246e.web.app/delete-account

We aim to respond to all privacy enquiries within 30 days, and to complete verified account deletion requests within 7 days.