Your Data Rights in the EU and UK (GDPR)

What this page is

This page is for people in the European Economic Area (EEA) and the United Kingdom. It explains, in plain words, why we use your personal data, who we share it with, how it travels, and the rights you have under the GDPR and the UK GDPR. It adds to our Privacy page and does not replace it. It is not legal advice.

Who is responsible

Abrar Kanekar, trading as InvoiceWren, Khed, Ratnagiri, Maharashtra 415709, India, is the controller of the personal data of account holders and website visitors. Write to us at hello@invoicewren.com.

If you are a business using InvoiceWren to bill your own clients, you are the controller of your clients’ data and we are your processor. That part is covered by our Data processing terms.

Why we use your data, and our legal basis

To give you your account and the service (your email, name, sign-in method, business details, clients, documents, payments, files): to carry out our contract with you.
To take payment for Pro: to carry out our contract with you. Paddle (web) or Google Play (Android) sells Pro and takes your payment, and we receive the plan, dates and status, not your card details.
To keep the service safe and to keep proof of approvals (device checks, links that open only for the right client, the record of who approved or declined a document and from which device and internet address, abuse prevention): our legitimate interest, and the interest of you and your client, in a secure service and a reliable record. You can object (see below).
To answer you (messages from the Contact page and from the app): our legitimate interest in helping you, or our contract with you.
To send the reminders you switch on to your clients: we act for you as your processor, on your instructions.
Google Analytics on this website: only with your consent, which you can take back at any time in “Cookie settings”.
Job facts for our data analysis and annual report (sharing a few facts about finished jobs): only with your consent. For accounts that choose the EU or UK country setting, the switch starts off, and you can turn it on or off at any time (You, then Your data).
Where your account came from (a word for how you reached us, the first public page and campaign tags, kept only if you accepted analytics before you made your account): with your consent, the same one you gave for analytics on the website. Kept until you delete your account.
Counting how the app is used (counts by day without your name, and totals from our own database such as how many accounts made a first invoice): our legitimate interest in knowing whether the app works and which parts are used. No documents, clients, names or amounts are included.
Usage statistics in the Android app (Google Analytics for Firebase counts which screens are used): only with your consent. For accounts that choose the EU or UK country setting the switch starts off, and you can turn it on or off at any time (You, then Your data).
Error reports (Sentry, from the app and the web app): our legitimate interest in finding and fixing faults. Names, emails, amounts, addresses and links are taken out before a report leaves your device or browser.
Why you left (an optional answer when you cancel or delete): our legitimate interest in improving InvoiceWren. It is saved without your account or name.
Our accounts records (the amount, currency, tax, date and payment company reference of each payment, refund or chargeback): legal obligation and our legitimate interest in keeping our books. After you delete your account they stay, with no name or email; only the payment company’s own reference remains.
Emails about Pro: only with your consent, in one tap to stop.
To follow the law (for example keeping records we must keep, and answering a valid legal request): legal obligation.

We never sell your personal data and never use it to show you advertising. We do not make decisions about you by automated means that have legal or similarly significant effects.

Who we share it with

Only the companies that help us run InvoiceWren, each for its own job: Cloudflare, Supabase, Resend, Paddle, Google, Sentry, Apple (once sign-in with Apple is on) and Expo. The list, with what each does and where it works, is on Our vendors. We do not share your data with anyone else, unless the law makes us.

Where your data goes

Our database (Supabase) is in Frankfurt and our file storage (Cloudflare) is in the EU. We run and support InvoiceWren from India, so the data can be reached from India. India is outside the EEA and the UK. We do not rely on an adequacy decision for India.

Data you give us directly about yourself (your account): you send it to us yourself. We protect it as this page and our Privacy page describe.
Your clients’ data that you put into InvoiceWren as a business in the EEA or UK: our Data processing terms include the European Commission’s standard contractual clauses for transfers from a controller to a processor (Module 2), and the UK’s International Data Transfer Addendum for UK data.

Some of our vendors may handle data in other countries. Our vendors gives each one’s privacy notice.

How long we keep it

While your account exists. When you delete your account it locks at once and everything is erased 30 days later; encrypted backups are overwritten within 30 more days. A waitlist address stays until you leave or ask us to delete it, and Google Analytics counts are deleted after 2 months. The Privacy page has the full list.

Your rights

You have the right to:

see the personal data we hold about you and get a copy (in the app: You, then “Export all my data”; it is free);
have wrong data corrected;
have your data erased (in the app: You, then Delete account, or invoicewren.com/delete-account);
restrict how we use it;
receive your data in a form you can move to another service;
object to a use that rests on our legitimate interest;
take back a consent at any time, as easily as you gave it (“Cookie settings”, the price-guides switch, the Pro emails link). This does not undo what happened before.

To use a right, write to hello@invoicewren.com with “Data rights” in the subject. We confirm within 48 hours and answer fully within one month. We may ask you to write from the email address of your account, or to sign in, so that nobody can use your rights in your name. It is free unless a request is clearly baseless or excessive.

If your data is the data of a client of one of our business users, ask that business first: it decides what happens to your data. We will help it answer you.

If something goes wrong

If your data is lost or someone gets it without permission and this is likely to put you at risk, we will tell you by email without delay, and we will tell the data-protection authority where the law requires it (within 72 hours of becoming aware, where the GDPR applies).

Complaints

You can complain to the data-protection authority in the country where you live, work, or where you think the problem happened. In the UK, that is the Information Commissioner’s Office. In the EEA, the European Data Protection Board lists every authority. We would like the chance to put it right first, so write to us.

Children

InvoiceWren is for people who run a business. It is not for anyone under 18, and we do not knowingly collect the data of anyone under 18.

Sources

Regulation (EU) 2016/679 (GDPR), Articles 6, 13, 15 to 22, 27, 28, 33 and 44 to 46: EUR-Lex, read Nov 12 2026.
UK GDPR Article 27: legislation.gov.uk, read Nov 12 2026.
European Commission, standard contractual clauses, questions and answers: commission.europa.eu, read Nov 12 2026.
Information Commissioner’s Office, international transfers: ico.org.uk, read Nov 12 2026.

Your data rights in the EU and UK.