Data processing terms.

What this is

These terms apply when you, a business, use InvoiceWren and put personal data about other people into it (your clients, their contacts and the people who open your links) and the GDPR, the UK GDPR or a similar law covers that data. They are part of our Terms. In them, “you” are the controller, and Abrar Kanekar, trading as InvoiceWren (“we”) is your processor. For your own account details, we are the controller: see Privacy and EU and UK data rights.

What we do, and for how long

We store, show, send and delete your clients’ data so that you can write estimates, change orders and invoices, share them with your clients, record approvals and payments, and send the reminders you switch on. We do this for as long as your account exists, and for 30 days after you delete it (then everything is erased; encrypted backups are overwritten within 30 more days).

The data

People: your clients and their contacts, and people who open your links. Data: name, email, phone number, address, the contents of documents and messages, photos, payments you record, the signature or typed name given on an approval, and the device details and internet address kept as proof. We do not ask for special categories of data, and you must not put them in InvoiceWren.

What we promise

• We use your clients’ data only to give you the service and on your instructions. Your instructions are these terms, your use of the app and the settings you choose. We tell you if we think an instruction breaks the law.
• We never sell it, never use it for advertising, and never combine it with other data for our own purposes.
• Only people who need it to run or support InvoiceWren can reach it, and they are bound to keep it confidential.
• We keep it safe: only your account can read it (the database enforces this), data is encrypted in transit and where it is stored, backups are encrypted, links are long random codes kept in scrambled form, and changing bank or payment details needs a code sent to you. The India data rights page lists these measures in plain words.
• We help you answer a person who uses their rights (see, correct, delete, export, object). You can export and delete in the app; for anything else, write to hello@invoicewren.com.
• If we learn that your clients’ data has been lost or reached someone it should not, we tell you by email without delay, so that you can meet your own duty to tell the authority (72 hours under the GDPR).
• When your account is deleted, we erase the data as set out above, or on request give you a copy first.
• We give you what you need to show that we follow these terms, and we allow an audit by you or by someone you choose, by written agreement on timing and scope, no more than once a year unless there has been a breach.

Other companies we use

You allow us to use the companies on Our vendors. They work under written contracts that give them the same data-protection duties as these terms. When we add or replace one, we update that page and its date. You may object on reasonable data-protection grounds; if we cannot find another way, you may stop using InvoiceWren and delete your account. We stay responsible to you for what they do for us.

Transfers outside the EEA and the UK

We work from India, which is outside the EEA and the UK, and we do not rely on an adequacy decision for India. Where the GDPR applies to your clients’ data and it is made available to us in India, the European Commission’s standard contractual clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), are part of these terms, with you as exporter and us as importer. Clause 7 (docking) is not used; option 1 of clause 9(a) with 30 days’ notice; the competent authority is the one that supervises you; the law of Ireland governs, and the courts of Ireland decide. For UK data, the ICO’s International Data Transfer Addendum to those clauses applies. Annex I is the “What we do”, “The data” and “What we promise” sections above; Annex II is the security list above; Annex III is Our vendors.

If these terms and the Terms disagree

These data processing terms win for the handling of your clients’ personal data. If the standard contractual clauses and these terms disagree, the clauses win. Nothing here limits a person’s rights under the clauses.

Sources

• GDPR Article 28 and Chapter V: EUR-Lex, read Nov 12 2026.
• European Commission, standard contractual clauses, questions and answers: commission.europa.eu, read Nov 12 2026.
• ICO, international transfers: ico.org.uk, read Nov 12 2026.