Privacy Policy

Invotory ("we", "us", "our") is operated from Amman, the Hashemite Kingdom of Jordan, and provides two products under one brand: the Invotory Platform — a web-based accounting and inventory system at www.invotory.com, whose accounts are created by invitation from our team — and the Invotory Invoicing app for Android ("the App"), distributed through Google Play. The App is a standalone product that runs on its own secure cloud backend, separate from the Platform.

This policy explains what information we collect, how we use and protect it, and the rights you have — whether you use the Platform, the App, or simply visit this website.

By using any Invotory service you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the services.

We collect the information you provide directly and the records generated by your use of the services:

• Account information: your name, email address, phone number (App accounts), and password — passwords are stored only as a secure hash, never in plain text.
• Business information: business name, address, tax number, income source number (App), registrant type, logo, and business settings.
• Operational records: the customers, suppliers, products, stock movements, invoices, payments, expenses, quotes, purchase orders, and similar records you create in either product.
• E-invoicing credentials: your JoFotara client ID and secret, stored encrypted and used solely to submit your invoices to the national system.
• Payment records: subscription details agreed with our team, such as CliQ or bank-transfer references, and — for the App — payment receipt images you send us by WhatsApp. We never collect or store card numbers.
• Usage and audit data: login timestamps and actions performed in your workspace, kept for security and accountability.
• AI feature data: prompts and responses when you use AI-assisted features. Your business data is never used to train AI models.
• Website messages: the name, email address, phone number, and message content you submit through our demo and support forms.

We use this information solely to:

• Provide, operate, and maintain the Platform and the App.
• Submit the invoices you approve to JoFotara, Jordan's national e-invoicing system.
• Send transactional messages: invoice emails, payment confirmations, invitations, and account notices.
• Enforce role-based access control, package limits, and the security of each workspace.
• Protect the services from abuse, and respond to your questions and support requests.

Invoices you issue through either product are submitted to JoFotara, Jordan's national e-invoicing system, as required by Jordanian regulations. The invoice data — seller, buyer, amounts, and tax details — is shared with the Income and Sales Tax Department through that system.

Records held by the national system are outside our control: we cannot modify or delete them, and their retention is governed by the tax authority's own rules, not this policy.

We do not sell or rent your personal data to anyone, and we never share it with advertisers. Your data is processed only by providers acting on our instructions, or where the law obliges us to disclose it:

• Supabase — database hosting, authentication, and file storage. Platform data is stored in the European Union (Frankfurt); the App runs on its own separate secure backend.
• Vercel — hosting and delivery of the website and applications.
• Resend — delivery of transactional email such as invitations, invoices, and notifications.
• Google Cloud (Vertex AI) — processes AI prompts without retaining your data and without using it for model training.
• Google Play — distributes the App, under Google's own terms and privacy policy.
• Public authorities — only where we are under a legal obligation to disclose, such as a court order.

We apply appropriate technical and organizational measures to protect your data:

• All data in transit is encrypted with TLS, and data at rest is encrypted by our infrastructure providers.
• Business data is isolated per workspace with database-level row-level security: users of one workspace cannot reach another's data.
• Authentication uses secure session tokens; passwords are hashed, and JoFotara credentials are stored encrypted.
• Access to internal systems is restricted and audited, and sensitive operations are logged.

We retain your data for as long as your account is active and as needed to provide the services. When you request account deletion, we carry it out within 30 days of verifying the request, and backups are purged within 90 days at most — except records that Jordanian law obliges us to keep, such as invoice and financial records retained for the statutory record-keeping period and used for legal compliance only.

Audit logs are kept for a limited period for security and accountability, then deleted.

You have the following rights over your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that inaccurate or incomplete data be corrected.
• Deletion: request deletion of your account and data — App users can follow the steps on our account deletion page at www.invotory.com/delete-account; Platform users can contact us directly. Legal retention requirements described above still apply.
• Export: download your business data in standard formats (CSV) from within the Platform at any time.

Invotory uses essential cookies only: they keep you signed in, secure your session, and remember your language preference. The service cannot function without them, and we use no advertising or tracking cookies of any kind.

If we ever adopt analytics tools to understand how the service is used, we will update this policy and give clear notice first.

We may update this Privacy Policy from time to time. Material changes will be announced by publishing the updated policy on this page with a new "Last updated" date. Your continued use of the services after publication constitutes acceptance of the updated policy.

For questions about this policy, data requests, or privacy concerns, contact us at info@invotory.com. We reply from Amman, Jordan.