Your Data Rights in India (DPDP Act)

What this page is

This page is for people in India. It explains, in plain words, what InvoiceWren does with your personal data and what you can ask us to do, under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025.

Where the law stands: the Act was passed in August 2023, and the Rules were notified on Nov 13 2025. The rules about notice, consent, security, breaches and your rights start to apply on May 13 2027, and the rules about consent managers on Nov 13 2026. We do not wait for those dates. What this page says is what the app does today.

This page does not replace our Privacy page or our Terms. It is a summary in plain words, not legal advice. If this page and the law ever disagree, the law wins.

Who is responsible for your data

For your own account, InvoiceWren decides why and how your data is used. In the words of the DPDP Act, we are the “Data Fiduciary”. Our address is Khed, Ratnagiri, Maharashtra 415709, India, and you can reach us at hello@invoicewren.com.

If you run a business and use InvoiceWren to bill your clients, you decide what happens to your clients’ details, and we only store them and send what you ask us to send. For your clients’ data, the law treats you as the Data Fiduciary and us as your “Data Processor”. We give you the tools: you can export, correct and delete, and your clients can stop the emails. The law may also ask you to do things, for example to tell your clients why you keep their details. We cannot give you legal advice about that.

What personal data we handle, and why

Your account. Your email, your name if you give it, how you sign in (Google, Apple, an emailed code, or a password), your time zone and the country you choose. We use them to make your account and to sign you in. If you choose a password, we never keep it as you typed it: our sign-in provider, Supabase, stores only a scrambled form of it, and nobody at InvoiceWren can read it.
Your business details. Business name, logo, address, signature, a tax number such as a GSTIN, and the bank, UPI or payment-link details you add. We use them to put them on your documents and to show your clients how to pay you. We never move money: your client pays you directly.
Your clients’ details that you add. Name, address, mobile number and email. We use them to write documents, to open the right link for the right client and to send the reminders you switch on. To check who opens a link, we keep a client’s mobile number or email in a scrambled form (a hash), not as plain text.
Your documents, photos and payments. Estimates, invoices, change orders, receipts, photos and files, and the payments you confirm. This is the service itself.
What happens on a client’s link. Which device opened it, how the client got in, and when. Their internet address is kept only when they approve, decline, say they paid or report a problem. We keep it as proof for you and for them.
Emails we send for you. The client’s email, the facts of the document in the message, which email went out and when, whether it bounced, and whether the client chose to stop. Nothing else, and never for another purpose.
Your device. A notification token if you allow notifications, and error reports from the app and the web app with personal details taken out before they are sent (Sentry).
How the app is used. Counts by day, without your name, of how far people get in setting up and whether a free-limit screen was shown, and totals from our own database of how many accounts reached early steps. In the Android app, if you switch on “Share usage statistics”, Google Analytics for Firebase counts which screens are used. For accounts on the India setting this switch starts off.
Where your account came from. Only if you said yes to analytics on our website before you made your account: a word for how you reached us, the public page you landed on, campaign tags and the name of the sending site. Kept until you delete your account.
Why you left. An optional answer from a short list when you cancel or delete. Saved with your plan and how long you were a customer, but not with your account or name.
Buying Pro. Paddle (on the web) or Google Play (in the Android app) takes your payment. We receive the plan, the dates and the status, never your card or UPI details. For a rupee purchase we also check that you are in India (see below) and keep only whether the check passed.
Job facts for our data analysis and annual report, only if you choose. A few facts about finished jobs: trade, country, the total, whether it was approved or paid, how long it took to get paid, the kinds of lines on it and how you were paid. For accounts that choose India, this switch starts off. We never share names, addresses, phone numbers, emails, notes, photos or bank details. We use them only for our own data analysis and our annual report, which we email to people who share them once we have enough data to write it.
On our website. Nothing is counted until you say yes to Google Analytics, which keeps its counts for 2 months. See our cookie policy.

We use your data only for these purposes. We never sell it, never license it to anyone, never use it for advertising, and never track or profile children.

Your consent, and taking it back

We ask for your permission in plain words, one thing at a time, before we use your data for anything the service does not need. The price-guide switch and Google Analytics are separate choices. They are never joined to the Terms, and for accounts that choose India they are never switched on for you in advance. Reminders to your clients are on by default, and you control them.

You can take your permission back at any time, as easily as you gave it:

Job facts: You, then Your data, then “Share job facts”. New jobs stop being shared at once. “Delete the jobs I shared” removes the jobs already shared.
Google Analytics: “Cookie settings” in the footer of any page.
Usage statistics in the Android app: You, then Your data, then “Share usage statistics”. For accounts on the India setting it starts off and you turn it on if you want it.
Reminders: turn them off for everyone, for one invoice, or pause them. Each client can also stop them with the link in every email.
Emails about Pro: one tap in the email, or in the app.
Everything: delete your account (below).

Taking your permission back does not undo what we did while you had given it.

Your rights

The DPDP Act gives you these rights. Here is how to use each one with InvoiceWren.

See your data. In the app, choose You, then “Export all my data”. It is free, any time, and gives you everything in one file. You can also write to us and we will tell you what we hold about you and which companies help us run InvoiceWren (they are listed below).
Correct or update your data. Change it in the app. If you cannot, write to us and we will do it.
Erase your data. In the app choose You, then Delete account, or use invoicewren.com/delete-account. Your account locks at once and every client link stops. After 30 days everything is erased, and you can cancel by signing in before then. Backups are overwritten within 30 more days. Records of what you paid can stay for as long as tax and accounting law asks us to keep them. Tax law may also ask you to keep your own invoices, so export them first.
Make a complaint. Write to hello@invoicewren.com with “Data rights” in the subject. We confirm within 48 hours and give you a full answer within 30 days. If you are not happy with the answer, you can complain to the Data Protection Board of India. The law asks you to use our process first.
Name someone to act for you. If you die or cannot act for yourself, you may name a person who can use these rights for you. Write to us to name them. We will ask for proof before we act.

To keep your data safe from someone pretending to be you, we may ask you to write from the email address of your account, or to sign in, before we act on a request.

The law also asks something of you: to follow the law, not to pretend to be another person, not to make false complaints, and to give correct information.

Buying Pro in rupees

Pro in rupees is for buyers in India only, and only as a yearly plan. When you buy it, we check that you are in India. We look at the country of your internet connection, the time zone of your device, and the billing address and the UPI payment you give Paddle. We do not keep your internet address for this. We keep only whether the check passed. If it does not pass, we cancel the purchase and refund it in full.

How we protect your data

Only your account can read your data. The database enforces this, not just the app.
Links to documents are long random codes. We keep them in a scrambled form (and, for the reminder emails, in a sealed form that only our servers can open), and a client also needs their mobile number or an emailed code to open one.
Changing bank or payment details needs a code we email to you.
Everything travels over HTTPS. Our database (Supabase, in Frankfurt) and our file storage (Cloudflare, in the EU) encrypt what they store, and our backups are encrypted.
Crash reports have personal details taken out before they leave your device.
The companies that help us run InvoiceWren work under contract, and each only gets what it needs to do its job.

If something goes wrong

If your data is lost, or someone gets it without permission, we will tell you by email without delay, and we will tell the Data Protection Board of India, as the Rules require (a full report within 72 hours). We will say what happened, what it means for you and what you can do.

Children

InvoiceWren is for people who run a business. It is not for anyone under 18. We do not knowingly collect the data of anyone under 18, and we do not track, profile or show advertising to anyone. If a parent tells us that a child has an account, we delete it.

Who helps us run InvoiceWren, and where your data goes

Supabase: our database, in Frankfurt (the EU).
Cloudflare: hosting and file storage (the files are kept in the EU).
Resend: delivers our emails, including the reminders you send to your clients through us.
Paddle: takes web payments and sells Pro for us. Google Play does the same in the Android app.
Google and Apple: sign-in. Expo: notifications. Sentry: crash reports with personal details removed.
Google Web Risk: checks that a web address you put on a document is safe. It sees the address, not the document.
Google Analytics: only if you allow it.

We are in India, our database is in the EU, and some of these companies handle data in other countries. The DPDP Act allows this unless the Government restricts a country. We follow any restriction the Government makes.

How long we keep your data

Your account, documents, files and clients are kept while your account exists. When you delete it, everything is erased after 30 days, and backups are overwritten within 30 more days. Short-lived technical records, such as sign-in codes and sync records, are kept from 24 hours to 90 days. If you take back your permission to share job facts, new jobs stop being shared at once, and the jobs already shared are removed when you ask us to delete them or when your account is erased.

Who to ask about your data

You can ask us anything about your data. Write to hello@invoicewren.com, use our Contact page, or write to us at Khed, Ratnagiri, Maharashtra 415709, India. We read every message and confirm within 48 hours. A message sent from the app also carries your account number, plan, app version, phone model and the screen you were on, so we can help you faster; it never carries your invoices or your clients’ details.

We will update this page when the law or the app changes, and the date at the top will change with it.

Sources

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), on India Code: indiacode.nic.in. Read for the chapters on notice, consent, a fiduciary’s duties, a person’s rights, children and transfers abroad. Checked Nov 09 2026.
The Digital Personal Data Protection Rules, 2025, notified Nov 13 2025, in the Press Information Bureau’s note: pib.gov.in. The dates (Nov 13 2025, Nov 13 2026, May 13 2027), the 72-hour report to the Board, the notice, the person to contact and the rule for children were read in two explainers of the Rules and should be checked against the Gazette text. Checked Nov 09 2026.

Your data rights in India.