WhizInvoice Start free
Privacy policy

Your data stays yours.

This policy explains what WhizInvoice collects, why we need it, where it is kept, who helps us run the service, and the rights you have wherever you live.

Last updated 25 October 2026

1. Who we are

WhizInvoice is an invoicing service for small service businesses. In this policy, “WhizInvoice”, “we” and “us” mean the business that runs it.

This policy covers our website at whizinvoice.com, the app at app.whizinvoice.com, including on the phones of the team members who use it on jobs, the pages where your clients view, accept and pay your quotes and invoices, the WhizInvoice connector plugin for WordPress, the private addresses at in.whizinvoice.com that receive the enquiry emails you forward to us, and the emails we send.

For any privacy question or request, email privacy@whizinvoice.com. A real person reads every message.

2. Our two roles

We handle personal data in two different roles, and your rights work differently in each.

  • Account data, where we are the controller. This is data about the business owners and team members who use WhizInvoice. We decide how it is used, and this policy explains how.
  • Customer data, where we are the processor. This is the data our customers put into WhizInvoice or collect through it, such as enquiries from their website forms or forwarded enquiry emails and the names, emails, phone numbers and addresses of their own clients, and what their team records on jobs, such as check in times and places, job photos and signatures. Each customer is the controller of that data, and we use it only to provide WhizInvoice to them, under our Data Processing Addendum.

If you sent an enquiry to a business that uses WhizInvoice, or received a quote or invoice from one, that business decides how your data is used. Please contact them first. If you contact us, we will pass your request to them and help them answer it.

3. What we collect

3.1 Account data you give us

  • Your business name, your name, email address, country, currency, time zone and trade.
  • Your password, which we store only as an Argon2id hash. We never store the password itself.
  • If you turn on two factor sign in, the secret for your authenticator app, which we store encrypted.
  • The name, email address and role of team members you invite.
  • Messages you send to our support team, including through the help form on the sign in page.

3.2 Data we record when you use WhizInvoice

  • The time and IP address of your last sign in.
  • The devices you are signed in on: whether each is a phone, tablet or computer, whether you opened WhizInvoice from its home screen icon, the app version, its last IP address and when it was last used, so you can see them and sign any of them out. Each device signs in with its own key, which we store only as a hash.
  • So that a change sent twice from a phone, for example when the signal comes back, is only acted on once, we keep a short record of each change the phone sends for 30 days.
  • An audit log of sign ins, billing changes and security events, such as connecting or pausing a website.
  • While you are signed in, the IP address and browser details linked to your session, so we can keep it secure.
  • Standard technical logs kept by our hosting provider, such as IP address, time and the page requested, which help keep the service running and secure.

3.3 Billing data from Freemius

Freemius, Inc. sells our paid plans as our reseller and merchant of record. It collects your payment details directly, and your card details never touch our servers.

Freemius sends us your name, email address, plan, licence and subscription ids, billing status and country, so we can switch your plan on and keep it in step with your billing.

3.4 Customer data

When you use WhizInvoice, you put in or collect enquiry fields as submitted on your website forms or read from the enquiry emails you forward to us (such as name, email, phone, postcode, suburb, address, service, message and any other fields on your form), the address of the page each form was sent from, your connected website addresses, customer records, quotes, invoices, jobs, visits and calendar entries, time off you record for your team, what your team records on jobs (check in times and places, timesheet changes, checklists, photos, materials and signatures), and the payments you record. We also send the emails you ask for or switch on, such as visit confirmations and reminders to your clients. We process this data for you, as explained in section 2. Sections 3.5 to 3.10 explain what we keep from some features in more detail.

3.5 Enquiry emails you forward to us

On the Starter plan and up, you can turn on enquiry forwarding. We then give your business a private address at in.whizinvoice.com. Emails sent or forwarded to that address, such as the notification emails your website forms send, are received for us by Brevo, our email provider, which passes each email to WhizInvoice. From each email we keep:

  • the sender’s name and email address, the subject, the time it was sent and its message id, which we use so the same email is never added twice;
  • the text of the email, as plain text;
  • what we read from it to make the enquiry, such as name, email, phone, address, the service asked about and the message, with the form name and page address when the email shows them;
  • the names and sizes of any attachments. We do not keep the attachments themselves, which stay in the original email;
  • a spam score from Brevo and the result of our own spam check.

If an email cannot be read as a form, the enquiry carries the whole text of the email, so nothing is lost. Emails that look like spam are held in your settings and do not become enquiries unless you release them. Emails sent from whizinvoice.com itself, and bounce messages, are ignored and never become enquiries. If Gmail or Outlook sends a “confirm forwarding” email to your address, we show it to you in your settings and never act on it ourselves. Emails sent to an address that does not belong to any business are not stored.

You can make a new private address at any time. The old one stops working at once, and the enquiries already received stay in your account.

3.6 Getting paid

On the Starter plan and up, WhizInvoice can help you see when an invoice is paid. We never take, hold or move money.

  • “I’ve paid”: when your client taps I’ve paid on their invoice page, we record how they say they paid, the date they give, any note they type, the amount owing at that moment, the time and their IP address. Nothing is recorded as a payment until you confirm it.
  • Bank statement files: when you upload a bank statement file to match payments to invoices, the file goes to our server, is read in memory to suggest matches, and is not saved. Only the lines you confirm are recorded, as payments on the matching invoices, each with a scrambled (hashed) reference to its line so it is never recorded twice. Lines that match nothing are shown to you once and then discarded.
  • Your own Stripe: if you connect a Stripe Payment Link from your own Stripe account, our Pay now button adds only a random reference and the amount to it, never your client’s name, email address or the private link to the invoice. Your Stripe account then tells a private WhizInvoice address when a client pays through that link. We check each notice with the signing secret you gave us, which we store encrypted. From each notice we keep the Stripe event and checkout session ids, the reference, the amount, the currency, whether it was paid by card or bank debit, and what we did with it. We do not keep your client’s name, email address or card details, even when Stripe includes them in the notice. We never ask for your Stripe keys. Stripe is your own provider, under your own agreement with Stripe.

3.7 Quote acceptances and signatures

When your client accepts a quote on its page, we record the name they type, the option and extras they chose, the visit time they picked if they picked one, the time they accepted, their IP address and a fingerprint of the terms shown to them. If they draw their signature instead of typing their name, we keep the drawing as a small image with the quote. All of this is kept as part of the quote, as customer data.

3.8 Sending on WhatsApp

When you choose Send on WhatsApp, WhizInvoice opens WhatsApp on your own phone or computer with a message and the link to your quote or invoice filled in. You press Send yourself, from your own WhatsApp account. We do not send WhatsApp messages, and we never see your messages or chats. We record only that you sent the document on WhatsApp, the number it went to and when. If your client had no phone number saved, we save the number you used on their customer record.

When the link is shared, WhatsApp fetches the page to show a preview card with your business name or logo, the document number, the amount and the due date. That fetch is not counted as your client opening the document. WhatsApp is your own provider, under your own agreement with WhatsApp.

3.9 Importing from another tool

When you import customers, jobs or prices from another tool or a spreadsheet, we keep what you upload only to run the import. The rows of a customer or price spreadsheet are held for the import for 30 minutes and then expire. The files for a jobs import are deleted as soon as it has finished, and an import you set up but never run is deleted after a day. If a jobs import fails, we keep its files so the problem can be looked into, and you can ask us to delete them at any time. What an import brings in becomes part of your customer data.

3.10 On the job: the team phone app and job check ins

A business and its team can use WhizInvoice on their phones while they work on jobs. The business decides which of these features are switched on, so what is recorded is customer data that the business controls (section 2).

  • Times: when a team member taps On my way, Check in or Check out on a visit, we record the time of each tap. These times make the record of the visit and the team member’s timesheet.
  • Places: only when the business has switched on job check ins, and only for a team member who agreed in the app, we also save where the phone was at each of those three taps: its latitude, longitude and how accurate the phone says that is. Nothing is saved between taps, and nothing while the app is closed. The app asks each person once. Someone who chooses No thanks has times saved only, and anyone can change their answer at any time in the app. We record the answer and when it was given.
  • The notice: before check ins can be switched on, the business confirms the day it gave its team written notice of what is saved and why. We record that day and who switched check ins on. In New South Wales, Australia, no place is saved until 14 days after that day.
  • Timesheet changes: when the owner or office adds or changes a time, we keep who changed it, the old and new time, the reason they gave and when.
  • The work itself: checklist items and who ticked them and when, photos taken on a job with their captions and the time they were taken, materials used, and, when a job asks for one, the customer’s name and drawn signature. Photos are made smaller on the phone before they are sent.
  • On my way message: if the business switches it on, its customer receives an email saying who is on the way, by first name, and about when they will arrive.
  • Working without signal: so the app works on a job with no signal, the phone keeps that person’s visits for today and the next two days, and any changes still waiting to be sent, in the browser’s own storage on that phone. It is cleared when they sign out.

The owner and the office of the business see check in times and places, timesheets and what came back from each job. A technician sees their own visits, never another person’s places. We use this data only to provide WhizInvoice to the business, never for anything of our own.

3.11 Forms and records on jobs

A business on Starter or a higher plan can switch on Records. Its team then fills in forms on its jobs, such as a safety check, a job sign off or a change to the job. What goes into a form is customer data that the business controls (section 2), kept for the business as its own records.

  • Answers and photos: what is typed or ticked in each form and the photos added to it, with who filled it in and when.
  • Signatures: when a customer or a team member signs a form, we keep a picture of the signature drawn on the screen and the name typed with it. If the customer was not there or chose not to sign, the form records that instead.
  • Changes: a record locks when the job is checked out. A later change needs a reason, and we keep every version with who changed it and when.
  • A copy for the customer: when the job is finished, the business’s customer can be emailed a PDF copy of the record. It is sent from our verified sending address, and replies go to the business.
  • No identity numbers: our forms never ask for identity numbers, such as a passport, driver licence or tax number, and records have no place to store them.

The business decides how long to keep its records, and they are included when it downloads its data. An accountant login does not see records. We use records only to provide WhizInvoice to the business, never for anything of our own.

3.12 Our website

whizinvoice.com sets no cookies on visitors’ devices and runs no analytics, advertising pixels or other tracking. If you click a button to buy a plan, the Freemius checkout opens on the page and Freemius collects what it needs to take payment. Our Cookie policy has the details.

We do not ask for sensitive personal data about you, such as health information, and WhizInvoice is not designed to hold it.

3.13 Free templates and our emails

When you ask for a free template on whizinvoice.com, we email it to you. To send it, and to run our mailing list, we record:

  • your email address, the template you asked for and the page you asked from, with the trade that template is for;
  • the time, your IP address, your approximate country and your browser details, which also help us stop automated abuse of the form;
  • the campaign tags and the referring site that brought you to the page, if there were any;
  • whether you ticked the box for tips and offers, and the exact wording you saw next to it;
  • whether our emails to you were delivered and opened, and which of their links you clicked, as reported to us by our email provider Brevo;
  • if you later create a WhizInvoice account through the link in our email, or with the same email address, the fact that you signed up.

We keep this in our own customer relationship system, which runs on the same hosting as WhizInvoice. Asking for a template does not create a WhizInvoice account.

If you make an invoice, quote or receipt with one of our free tools and press Email it to me, the document you made is sent to our server so we can turn it into a PDF and email it to you through Brevo. We do not keep the document, its lines, its logo or its signature. We record only your email address, the tool and design you used, the type of document, its currency, its total and how many lines it had, together with the details in the list above.

4. How we use account data

  • To create and run your account, sign you in and keep your account secure.
  • To provide the features you use, including sending the emails you ask us to send, such as invoices and quotes to your clients.
  • To send service emails, such as sign up confirmation codes, password resets and important notices about your account, billing or our policies.
  • To manage your plan, billing and any refund with Freemius, and to keep the billing records the law requires.
  • To answer your support messages.
  • To prevent fraud, spam and abuse, to enforce our terms and to protect our users.
  • To comply with the law and to establish, exercise or defend legal claims.

We do not sell personal data. We do not share it for advertising, and we do not use it to build advertising profiles.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

If we send you news about WhizInvoice, we do so only where the law allows it, and every such email has a link to unsubscribe.

4.1 How we use template requests

  • To email you the template you asked for, or the document you made with a free tool. The same email briefly introduces WhizInvoice and its Free plan, with a link to start.
  • If you ticked the box, to send you invoicing tips and WhizInvoice offers until you unsubscribe. Every such email has a one click unsubscribe link and a link to your email preferences.
  • To learn which templates, pages and campaigns bring people to WhizInvoice, so we can improve them.
  • To stop abuse of the form, such as automated requests and throwaway addresses.

If you did not tick the box, we send you no further marketing emails. You can turn tips and offers on or off at any time from the preferences link in our emails.

5. AI features

We plan to add optional AI features. None are live yet, and we will update this policy before any of them launch. When they are available, they will use the APIs of OpenAI and Anthropic. AI will only suggest drafts, and nothing it writes is sent to your customers until you review and approve it. We will send data to OpenAI or Anthropic only when you or a team member chooses an AI feature, and only the text needed for that action. Under their API terms, they do not use it to train their models.

AI output can be wrong. Always check it before you rely on it or send it to a client.

6. Who we share data with

We share personal data only with the service providers that help us run WhizInvoice, and only what each one needs.

  • Hostinger International Limited, a company in Cyprus, hosts WhizInvoice and its database on servers in Frankfurt, Germany. Traffic to our website, whizinvoice.com, passes through Hostinger’s content delivery network.
  • Brevo (Sendinblue SAS, France) sends our emails: sign up confirmation codes, password resets, the invoices, quotes and visit messages, such as On my way, that our customers send, the free templates people ask for and our tips and offers. It tells us whether those emails were delivered and opened and which links were clicked. Brevo also receives the enquiry emails forwarded to our in.whizinvoice.com addresses and passes them to WhizInvoice.
  • Freemius, Inc. (USA) sells and bills our paid plans as our reseller and merchant of record, and charges and pays sales tax, GST and VAT.
  • OpenAI and Anthropic (USA) will power our planned AI features, and will receive data only when an AI feature is used. No AI features are live yet.

Services you connect or use yourself, such as your own Stripe account and your own WhatsApp, are your providers, not ours. They handle data under your own agreements with them. We share nothing with them ourselves, beyond the reference and amount our Pay now button adds to your own Stripe link.

We may also share data with professional advisers, such as lawyers and accountants, who owe us a duty of confidentiality; with courts, regulators or police when the law requires it; and with a buyer or successor if our business is sold or reorganised. In that case this policy keeps protecting your data, and we will tell you before your data becomes subject to a different policy.

The full list of service providers that process customer data, with what each does and where, is in Annex 3 of our Data Processing Addendum. We give 30 days notice before adding a new one.

7. Where your data is kept

Your data is stored on servers in Frankfurt, Germany, in the European Union. Some of it leaves the EU in limited cases:

  • billing data is handled by Freemius in the United States;
  • the text needed for an AI action goes to OpenAI or Anthropic in the United States, only when an AI feature is used;
  • our team may access data from where we are based, to run the service and answer support.

Where data leaves your country, we protect it with the safeguards your law requires, such as the Standard Contractual Clauses adopted by the European Commission. The regional sections below give the details for your part of the world.

8. How long we keep data

  • Account data is kept while your account exists. Cancelling a paid plan does not close your account: it moves to the Free plan, and nothing is deleted.
  • If you ask us to delete your account or your data, we delete it within 30 days, and copies roll out of our backups within a further 30 days.
  • Billing records are kept for as long as tax law requires.
  • Audit logs are kept for 12 months.
  • Support messages are kept while your account exists and are deleted with it.
  • Customer data is kept for as long as the customer keeps it in WhizInvoice, and is deleted as our Data Processing Addendum sets out.
  • An enquiry made from a forwarded email is kept like any other enquiry. The copy of the email’s text and fields kept beside it is cleared after 30 days, and a short record of the sender, subject, time and message id stays while the account exists, so the same email is never added twice.
  • Held spam, “confirm forwarding” emails and ignored emails are deleted after 30 days. Emails waiting because forwarding is paused or not in your plan are kept until forwarding works again, when they become enquiries, or until the account is deleted.
  • Bank statement files are never saved. Only the payments you confirm from them are kept.
  • Notes from “I’ve paid”, Stripe paid notices and quote signatures are kept in your account with your other customer data.
  • Places saved at job check ins are deleted after 90 days. The times stay with the visit and the timesheet. Timesheet changes, checklists, job photos, materials and signatures are kept with the job, as customer data.
  • Form records, with their answers, photos, signatures and every earlier version, are kept with the job as customer data for as long as the business keeps them, and are part of its data download.
  • A phone’s copy of upcoming visits is cleared when that person signs out. Signing a device out, or removing a team member, stops it working at once.
  • If you asked for a template and did not agree to tips and offers, we delete your details after 12 months in which you have not asked for another template, clicked a link in our emails or signed up.
  • If you agreed to tips and offers, we keep your details until you unsubscribe. After that we keep them, with the records of your consent and of your unsubscribe, for 5 years so we can show we had your permission, and then delete them.
  • When you unsubscribe, we also keep a scrambled (hashed) copy of your email address, and nothing else, so we never email you marketing again by mistake.

We keep data longer only where the law requires it or where we need it to establish or defend a legal claim, and only for as long as that need lasts.

You can download all your data at any time, even after you stop paying. If you plan to ask us to delete your account, download your data first.

9. Security

We protect data with measures such as HTTPS, passwords hashed with Argon2id, optional two factor sign in, sign in rate limits, a strict Content Security Policy and encrypted website connection secrets. Each account’s data is kept separate, and automated tests on every release check that one account can never read another’s data. Our Security page has the details.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Your rights

Wherever you live, you can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct data that is wrong or incomplete;
  • delete your data;
  • give you your data in a format you can take to another service;
  • stop or limit some uses of your data, or withdraw a consent you gave.

You can do much of this yourself in the app, where you can edit your details and download your data. For anything else, email privacy@whizinvoice.com from the email address on your account. If you write from another address, we may ask you to confirm your identity before we act. Requests are free.

We answer within one month at the latest, and sooner where your local law sets a shorter time. If we cannot do what you ask, we will explain why. The regional sections below set out your local rights, deadlines and the authority you can complain to.

If your request is about customer data, such as an enquiry you sent to a business that uses WhizInvoice, we will pass it to that business and help them answer it.

11. Children

WhizInvoice is for businesses. You must be 18 or over to use it, and it is not directed at children. If we learn that we hold account data about a child, we will delete it.

12. Europe and the United Kingdom

12.1 European Economic Area

If you are in the European Union, Iceland, Liechtenstein or Norway, the General Data Protection Regulation (GDPR) applies. For account data, the controller is WhizInvoice.

Our legal bases for using account data are:

  • running your account, providing the features you use, sending service emails and the emails you ask us to send, and running the AI features you choose to use: performance of our contract with you (Article 6(1)(b));
  • billing, and keeping billing and tax records: performance of our contract and our legal obligations (Article 6(1)(b) and (c));
  • security, sign in rate limits, audit logs, technical logs, and preventing fraud, spam and abuse: our legitimate interest in keeping WhizInvoice and its users safe (Article 6(1)(f));
  • team member accounts: the legitimate interest of the account owner, and ours, in letting a business work together in one account (Article 6(1)(f));
  • answering support messages: performance of our contract, or our legitimate interest in helping people who contact us (Article 6(1)(b) or (f));
  • news about WhizInvoice: your consent or, where the law allows it for existing customers, our legitimate interest (Article 6(1)(a) or (f));
  • emailing you a template you asked for: taking the step you requested (Article 6(1)(b)); the short introduction to WhizInvoice in that email, and learning which templates and pages bring people to us: our legitimate interest in telling people who contact us about our service and improving it (Article 6(1)(f)), which you can object to at any time;
  • tips and offers after you ticked the box: your consent (Article 6(1)(a)), which you can withdraw at any time from any of our emails;
  • complying with the law and handling legal claims: our legal obligations and legitimate interests (Article 6(1)(c) and (f)).

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Articles 15 to 21). You can object at any time to processing based on our legitimate interests and to direct marketing. Where we rely on consent, you can withdraw it at any time without affecting what we did before. We do not make decisions about you based solely on automated processing (Article 22).

To use your rights, email privacy@whizinvoice.com. We reply within one month. If a request is complex, or we receive many, we may extend this by up to two more months, and we will tell you why within the first month.

Your data is stored in Germany. When it goes to a country without an EU adequacy decision, we use the Standard Contractual Clauses adopted by the European Commission. Where a US provider is certified under the EU US Data Privacy Framework, we may rely on that certification instead. You can ask for a copy of the relevant safeguards at privacy@whizinvoice.com.

You can complain to the data protection authority in the EU or EEA country where you live or work, or where you think the problem happened. The European Data Protection Board lists them all at edpb.europa.eu. We would welcome the chance to put things right first, so please tell us too.

12.2 United Kingdom

The UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, apply. Our legal bases are the same as in section 12.1, under the matching articles of the UK GDPR, and you have the same rights.

To use your rights, email privacy@whizinvoice.com. We reply within one month, which we may extend by up to two more months for complex requests.

You can complain to us about how we use your personal data at privacy@whizinvoice.com. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

The UK recognises the EEA, including Germany, as giving adequate protection. For transfers to other countries we use the UK International Data Transfer Addendum to the Standard Contractual Clauses or the International Data Transfer Agreement. Where a US provider is certified, we may rely on the UK Extension to the EU US Data Privacy Framework.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

12.3 Switzerland

The Federal Act on Data Protection (FADP) applies. You have the right to information about your data, to correction and deletion, to receive your data in a common electronic format, and to object to processing. We answer requests for information within 30 days.

Switzerland recognises the EEA, including Germany, as giving adequate protection. For other countries we use the Standard Contractual Clauses, adapted for Swiss law. Where a US provider is certified, we may rely on the Swiss US Data Privacy Framework.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

13. United States

Some US privacy laws apply only to larger businesses, and some do not cover people acting in a business role. We give the rights in this section to every US resident anyway.

13.1 Notice at collection for California residents

This is our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). We collect these categories of personal information:

  • identifiers: name, email address, IP address, and account, licence and subscription ids;
  • customer records: your business name, contact details and support messages;
  • commercial information: your plan, and subscription, billing and refund history;
  • internet or other electronic network activity: sign in times, session and browser details, audit logs and technical logs, and for template requests the page, referring site and campaign tags, and whether our emails were opened and their links clicked;
  • professional information: your business name, trade and role in your team;
  • sensitive personal information: your account log in, meaning your email address together with your password (which we store only as a hash), and your two factor secret if you use one.

We collect it from you, from the account owner who invites you to a team, from Freemius, from our email provider Brevo, and from your device when you use WhizInvoice or ask for a template. We use it for the purposes in section 4, which are business purposes under the CCPA, and disclose it for those purposes to the service providers in section 6. We keep each category for the periods in section 8.

We do not sell or share personal information, and we have not done so in the past 12 months. Sharing here means sharing for cross context behavioural advertising. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

We use sensitive personal information only to provide WhizInvoice and to keep accounts secure, which the CCPA allows without a right to limit. We do not use it to infer characteristics about you.

13.2 Your California rights

  • The right to know and access the categories and specific pieces of personal information we hold about you, where it came from, why we use it and who we disclose it to.
  • The right to delete personal information we collected from you.
  • The right to correct inaccurate personal information.
  • The right to opt out of the sale or sharing of personal information. We do neither, but you can still send an opt out request, and we honour the Global Privacy Control (see section 13.4).
  • The right to limit the use of sensitive personal information. This does not apply to us, because we use it only for the purposes the CCPA allows.
  • The right not to be discriminated against. We will not deny you service, charge you a different price or give you a lower quality of service because you used your rights.

To use your rights, email privacy@whizinvoice.com. We verify your identity by matching what you tell us with the details on your account, usually by asking you to reply from your account email. We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we may extend by up to 45 more days and will tell you why.

Someone you authorise can make a request for you. We will ask for your signed permission and may ask you to confirm your identity with us directly, unless your agent holds a valid power of attorney.

We do not disclose personal information to third parties for their own direct marketing.

If you are not happy with our answer, you can contact the California Privacy Protection Agency at cppa.ca.gov.

13.3 Other US states

Comprehensive privacy laws are in force in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Laws passed in Oklahoma, Louisiana, Alabama and Vermont take effect later. We give residents of these states, and of every other state, the right:

  • to confirm whether we process your personal data, and to access it;
  • to correct it;
  • to delete it;
  • to get a copy in a portable format;
  • to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects, none of which we do;
  • where your state law provides it, as in Oregon and Minnesota, to get a list of the specific third parties we have disclosed your personal data to.

To use your rights, email privacy@whizinvoice.com. We respond within 45 days. If we need more time, we may extend once by up to 45 more days and will tell you why.

If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We will send you our written decision within 45 days. If we still decline, we will tell you how to contact your state Attorney General.

13.4 Global Privacy Control and Do Not Track

We honour the Global Privacy Control (GPC) as a valid request to opt out of the sale and sharing of personal information and of targeted advertising, for the browser that sends it and, if we know who you are, for your account. Because we do none of these things, nothing else changes.

We do not track you across other websites, so a browser Do Not Track signal does not change anything either.

13.5 Data our customers put into WhizInvoice

For customer data, we are a service provider and processor to the business that uses WhizInvoice. Please send requests about that data to the business. If you send them to us, we will pass them on.

14. Canada

14.1 PIPEDA and provincial laws

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and Alberta, British Columbia and Quebec have their own private sector privacy laws. By creating an account, you consent to the uses described in this policy. You can withdraw consent at any time, subject to legal and contract limits, but we may then be unable to provide WhizInvoice.

You can ask to access and correct your personal information. We reply within 30 days. If we need more time, the law lets us extend once by up to 30 days, and we will tell you.

Your data is stored in Germany and some is handled in the United States, as section 7 explains. While it is outside Canada, courts and authorities there may be able to access it under their laws.

You can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the privacy commissioner of your province.

14.2 Quebec

Under Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, you also have the right to receive your computerised personal information in a structured, commonly used technological format, to ask us to stop disseminating your information or to de-index a link to your name where the law allows, and to be told about any decision based exclusively on automated processing. We make no such decisions.

The person in charge of the protection of personal information at WhizInvoice is the person with the highest authority in our business. You can reach them at privacy@whizinvoice.com.

You can complain to the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.

14.3 Emails and CASL

Canada’s Anti Spam Legislation (CASL) covers commercial electronic messages. Our service emails, such as confirmation codes, password resets, receipts and account notices, are not marketing. The email that sends you a template you asked for is our response to your request. We send news about WhizInvoice only with your express or implied consent. Every such email identifies us and has a working unsubscribe link, and we act on an unsubscribe within 10 business days.

15. Australia and New Zealand

15.1 Australia

We handle personal information in line with the Privacy Act 1988 and the Australian Privacy Principles (APPs). This policy is our APP privacy policy.

You can browse our website without telling us who you are. To use the app, we need your name and email address.

We store personal information in Germany and disclose it to service providers in France (email), the United States (billing and AI features) and Cyprus (where our hosting provider is based). Our team may also access it from where we are based. We take reasonable steps, including binding contracts, to make sure these recipients handle it in line with the APPs.

To access or correct your personal information, email privacy@whizinvoice.com. We respond within 30 days, and access is free.

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

We do not use automated processes to make decisions that could significantly affect your rights or interests.

If a business switches on job check ins for team members in New South Wales, WhizInvoice saves no place until 14 days after the notice day the business enters, in line with the Workplace Surveillance Act 2005 (NSW). The business is responsible for giving that notice and for meeting the workplace laws that apply to it.

Please complain to us first at privacy@whizinvoice.com. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

15.2 New Zealand

We handle personal information in line with the Privacy Act 2020 and its Information Privacy Principles (IPPs).

We disclose personal information overseas only to recipients that are subject to comparable safeguards, or that are bound by contract to protect it in a way comparable to the Privacy Act (IPP 12).

Where we collect information about you from someone else, for example when an account owner adds you as a team member or Freemius tells us about your subscription, this policy is our notice to you.

To access or correct your personal information, email privacy@whizinvoice.com. We respond as soon as reasonably practicable, and no later than 20 working days.

If a privacy breach has caused or is likely to cause you serious harm, we will notify you and the Privacy Commissioner.

You can complain to the Office of the Privacy Commissioner at privacy.org.nz.

16. Asia

16.1 India

The Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 are coming into force in stages, and we already follow them. You have the right to a summary of the personal data we process and how we process it, to correction, completion, updating and erasure, to have your grievances addressed, and to nominate someone to use your rights if you die or become unable to.

For questions and grievances, contact privacy@whizinvoice.com. We respond to grievances within 30 days. The law asks you to use our grievance process first. If you are not satisfied, you can complain to the Data Protection Board of India.

16.2 Singapore

We comply with the Personal Data Protection Act 2012 (PDPA). You can ask for access to and correction of your personal data, and withdraw consent. Our data protection officer can be reached at privacy@whizinvoice.com. We respond to access requests within 30 days, or tell you within that time when we will.

When we transfer personal data outside Singapore, we make sure it gets a standard of protection comparable to the PDPA. You can complain to the Personal Data Protection Commission at pdpc.gov.sg.

16.3 Japan

We handle personal information in line with the Act on the Protection of Personal Information (APPI). You can ask us to disclose, correct, add to or delete your retained personal data, to stop using it or providing it to third parties, and to disclose our records of providing it to third parties.

We provide personal data to service providers in Germany, France, Cyprus and the United States under contracts that require measures equivalent to those of the APPI. On request, we will tell you about these measures and about the data protection systems of those countries. Our security measures are on our Security page, and the name and address of our business are in section 1.

You can contact the Personal Information Protection Commission at ppc.go.jp.

16.4 Philippines

Under the Data Privacy Act of 2012, you have the right to be informed, to access, to object, to erasure or blocking, to rectification, to data portability and to damages. You can complain to the National Privacy Commission at privacy.gov.ph.

16.5 Malaysia

Where the Personal Data Protection Act 2010, as amended in 2024, applies, you can ask to access and correct your personal data, withdraw consent, ask us to stop processing that is likely to cause you damage or distress, and ask for your data to be sent to another controller. We respond to access and correction requests within 21 days. You can complain to the Personal Data Protection Commissioner at pdp.gov.my.

16.6 Hong Kong

Under the Personal Data (Privacy) Ordinance, you can ask to access and correct your personal data. We respond within 40 days. We do not use your personal data for direct marketing without your consent. You can complain to the Privacy Commissioner for Personal Data at pcpd.org.hk.

16.7 Other countries in Asia

Many other countries in Asia, including mainland China, South Korea, Indonesia, Thailand and Vietnam, have their own data protection laws. Where they apply, we honour the rights they give you, in the way section 10 describes.

17. Middle East and Africa

17.1 United Arab Emirates

Under the federal Personal Data Protection Law (Federal Decree Law No. 45 of 2021), you have the right to information, access, correction, erasure, restriction, portability and objection, including objection to automated processing. You can complain to the UAE Data Office.

In the Dubai International Financial Centre and Abu Dhabi Global Market, the DIFC Data Protection Law 2020 and the ADGM Data Protection Regulations 2021 apply instead, with complaints to the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection. If your business is based there, you are the controller of the customer data you put into WhizInvoice, and our Data Processing Addendum covers our duties as your processor.

17.2 Saudi Arabia

Under the Personal Data Protection Law, you have the right to be informed, to access your personal data and get a copy in a readable format, to correct it, and to have it destroyed when it is no longer needed. We respond within 30 days. You can complain to the Saudi Data and Artificial Intelligence Authority (SDAIA) at sdaia.gov.sa.

17.3 South Africa

Under the Protection of Personal Information Act 2013 (POPIA), you can ask whether we hold your personal information and for access to it, ask us to correct or delete it, object to its processing, and not be subject to decisions based solely on automated processing. You can complain to the Information Regulator at inforegulator.org.za.

17.4 Nigeria

Under the Nigeria Data Protection Act 2023, you have the right to information, access, rectification, erasure, restriction, portability and objection, and to withdraw consent. You can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

17.5 Kenya

Under the Data Protection Act 2019, you have the right to be informed, to access, to object, to correction and deletion, and to data portability. You can complain to the Office of the Data Protection Commissioner.

17.6 Other countries in the region

Other countries, such as Egypt, Israel, Qatar, Bahrain and Turkey, have their own data protection laws. Where they apply, we honour the rights they give you, in the way section 10 describes.

18. Latin America

18.1 Brazil

Under the Lei Geral de Proteção de Dados (LGPD), you have the right to confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information about who we share data with and about the consequences of refusing consent, withdrawal of consent, and review of decisions taken solely by automated processing.

We confirm and give access in simplified form straight away, or give a complete answer within 15 days. Our contact for LGPD matters (encarregado) can be reached at privacy@whizinvoice.com. When we transfer data outside Brazil, we use the safeguards the LGPD allows, such as standard contractual clauses. You can complain to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

18.2 Mexico

Under the Federal Law on the Protection of Personal Data Held by Private Parties of 2025, you have the rights of access, rectification, cancellation and opposition (ARCO rights), and you can withdraw consent. We tell you our decision within 20 business days and carry it out within 15 business days after that. The data protection authority is the Secretaría Anticorrupción y Buen Gobierno.

18.3 Argentina

Under Personal Data Protection Law 25,326, you can access your data free of charge, and we respond within 10 calendar days. You can ask us to correct, update or delete it, and we do so within 5 business days. The Agency for Access to Public Information, as the supervisory body of Law 25,326, handles complaints about breaches of the data protection rules: argentina.gob.ar/aaip.

18.4 Colombia

Under Law 1581 of 2012, you can know, update, correct and delete your data, ask for proof of your authorisation, and revoke it. We answer queries within 10 business days and claims within 15 business days. You can complain to the Superintendencia de Industria y Comercio.

18.5 Chile

Law 19,628 gives you the rights of access, correction, deletion and blocking. The new Law 21,719, due to take effect in December 2026, adds rights such as objection and portability and creates the Personal Data Protection Agency, which will handle complaints. We already honour these rights.

18.6 Other countries in the region

Peru, Ecuador, Uruguay, Costa Rica, Panama and other countries in the region have their own data protection laws. Where they apply, we honour the rights they give you, in the way section 10 describes.

19. Everywhere else

Wherever you live, we apply the same standard. We collect only what we need, use it only for the purposes in this policy, keep it secure, and give you the rights in section 10.

We reply within one month, or sooner if your law requires it. If your country gives you extra rights, we honour them. If you are not happy with our answer, you can complain to the data protection authority in your country.

20. Changes to this policy

We update this policy when our service or the law changes. If a change is material, we will tell you by email or in the app at least 30 days before it takes effect. The date at the top shows when it last changed.

21. Contact us

Email privacy@whizinvoice.com for privacy questions and requests, or support@whizinvoice.com for anything else.

See how we keep your data safe →