Privacy Policy

XYZ All In One Invoice ("we", "us", "our") is an online invoicing and business management service. It allows businesses to create and send invoices and quotations, record payments, manage customers and products, and view reports.

This policy explains what information we collect, why we collect it, how it is protected, and the choices you have. It applies to anyone who visits this website, registers an account, or uses the app.

Account information: your email address and password (stored only as a secure hash), and your name if you choose to provide one.

Business information: the business name, logo, contact details, physical address, banking details and branding settings you enter so your documents can be created correctly.

Customer and transaction data: the customers, products or services, invoices, quotations, payments and payment records you create in the app. This information is entered by you or your team.

Document activity data: when someone opens a secure invoice or quotation link, we record the date and time it was opened and how many times it has been viewed, so the sender can see document status.

Email delivery data: when we send an email on your behalf, we keep delivery status information (for example whether it was sent or failed) so you can see what happened.

Uploaded files: logos and payment proof images or documents you upload, which are stored privately and scanned before being accepted.

Technical data: standard security and usage logs such as IP address and device/browser type, used to keep the service secure.

To provide the service: creating, storing and displaying your invoices, quotations, customers, products and payments.

To send documents and notifications: emailing invoices, quotations and payment receipts to your customers, and notifying you of activity such as a document being opened or approved.

To keep data separate and secure: every record is scoped to the business it belongs to, so one business cannot see another business's data.

To operate and improve the service, prevent abuse, and respond to support requests.

We do not sell your personal information.

Your information is shared only in these limited cases: with the people you invite to your business (with roles you control); with your customers when you send them an invoice, quotation, receipt or payment link; with the service providers that run the service (hosting, database and email delivery) strictly to operate it; and when required by law.

When a customer receives a document from you, they see the information in that document, including your business details and banking details if you included them.

Invoices, quotations and payment pages can be shared using a unique, unguessable link. Anyone with the link can view that specific document, but the link does not give access to any other document or to your account.

Views of these pages are recorded (date, time and view count) so the sender knows the document was received. We do not use tracking cookies or advertising trackers on these public pages.

Data is stored in a managed cloud database with row-level access controls so that records are only readable by the business that owns them.

Passwords are stored as secure hashes and are never visible to us. Sessions are protected with secure tokens.

Uploaded files are stored privately, are validated and scanned before being accepted, and can only be read through secure, expiring links or by authorised members of the business.

We keep your information while your account is active so the service keeps working.

You can delete individual records (customers, invoices, quotations, payments, files) at any time from within the app. If you want your account and all associated business data deleted, contact us using the details below and we will delete it.

You may request access to the personal information we hold about you, ask us to correct it, or ask us to delete it. You may also object to certain processing or withdraw consent for optional features.

If you are in South Africa, you have these rights under the Protection of Personal Information Act (POPIA). If you are in the EU/UK, you have equivalent rights under the GDPR. To exercise any right, contact us using the details below.

The app uses essential browser storage only, to keep you signed in between visits and to remember which business you are working in. We do not use advertising or third-party analytics cookies.

If we change this policy, we will update this page. Significant changes will be communicated in the app. The version on this page is the current one.

For questions about this policy or to exercise your rights, email us at jdw.services@outlook.com.