Privacy Policy

Who we are

This website is operated by Francisco Deus, trading as InvoiceBase. We are the data controller for the personal data described here. You can reach us at contact@invoicebase.dev.

What this policy covers

This policy covers this website: the launch list, the checkout, and emails you send us.

It does not cover the InvoiceBase software itself. InvoiceBase is self-hosted: you run it on your own server, and the invoices, receipts, and account data you put into it stay there. We have no access to them.

The waiting list

If you ask to be told when InvoiceBase launches, we collect your email address and, if you give it, your first name. We also record when you consented and which wording you agreed to.

Nothing is stored until you confirm your address from the email we send you.

The wording you agree to is: “Email me once, the day InvoiceBase launches. Nothing else, and I can unsubscribe at any time.” That is the limit of what this list is used for. Every email carries an unsubscribe link, and you can also ask us directly.

Legal basis: your consent (GDPR Art. 6(1)(a)).

Buying InvoiceBase

Payment is handled by Creem, the merchant of record and the legal seller of the software. Your card details, billing address, name, email, and any VAT number are collected by Creem on its own checkout pages. We never see your card details.

On our own checkout page we collect one thing: your GitHub username. We check with GitHub that it exists, so a typo does not turn into a failed delivery, and we pass it to Creem with the order so we know who to invite to the repository after you pay. We also record which version of the withdrawal-rights wording was shown to you.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)). We cannot deliver the software without it.

Emailing us

Mail you send to our support address is processed by Resend, our email provider.

Legal basis: our legitimate interest in answering people who contact us (GDPR Art. 6(1)(f)).

Cookies and analytics

This website sets no cookies and runs no analytics or tracking scripts. Our host keeps standard server logs, which include IP addresses, to serve the site and protect it from abuse.

Who your data is shared with

We do not sell personal data, and we do not share it for advertising.

Transfers outside the EEA

Some of the providers above are established in the United States. Where personal data is transferred outside the European Economic Area, it is done under the safeguards provided for in Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

• Waiting-list contacts — until you unsubscribe or ask us to delete them, and in any case not beyond the launch announcement the list exists for.
• Purchase records — for as long as needed to support the licence and to meet accounting and tax obligations.
• Support emails — until they are no longer needed to deal with the matter you wrote about.

Your rights

Under the GDPR you can:

• Ask what personal data we hold about you, and get a copy of it
• Have inaccurate data corrected
• Have your data deleted
• Ask us to restrict or stop processing it
• Receive the data you gave us in a portable format
• Object to processing carried out on the basis of our legitimate interests
• Withdraw consent at any time, where processing relies on consent. This does not affect anything done before you withdrew it

To exercise any of these, email contact@invoicebase.dev. We will respond within one month.

You also have the right to complain to your national data protection supervisory authority if you think we have handled your data wrongly.

Changes to this policy

If this policy changes, the date at the top changes with it. If the change materially affects people on the waiting list, we will say so rather than rely on you noticing.