Hitasoft Invoix Privacy Policy

What is Hitasoft Invoix?

Hitasoft Invoix is a free invoice generator and business invoicing application developed by Hitasoft Technology Solutions Pvt Ltd. It is used to create invoices, manage customers, record payments and review financial reports.

Who operates Hitasoft Invoix?

Hitasoft Invoix is operated by Hitasoft Technology Solutions Pvt Ltd, Madurai, Tamil Nadu, India.

What information can Hitasoft Invoix collect?

Your account details (name, email address and a hashed password), the business details you enter (such as business name, address, GSTIN, PAN and bank details), the customer, invoice, payment, expense and income records you create, and the technical records needed for sign-in and security, such as the IP address and browser of each session and activity log entry.

Can users delete their Hitasoft Invoix account?

Yes. Signed-in users can delete their account from Account, Delete account, after confirming their password. Business records that belong to an organization, such as invoices and customers, stay with that organization. If you were its only member, the organization is closed and you can ask for its records to be deleted.

Does Hitasoft Invoix sell personal information?

No. Hitasoft Invoix does not sell personal information and does not use it for advertising.

Does Hitasoft Invoix process customer information?

Yes, on behalf of its users. Users can enter details about their own customers, such as names, contact details, addresses and tax numbers, to create invoices and manage customer records. The user who enters that information is responsible for having the right to use it.

Does Hitasoft Invoix process payment information?

Hitasoft Invoix stores the payment records users enter, such as amount, date, method and reference. It does not process card or bank payments and does not collect card numbers. Recording a payment does not mean the payment was made through Hitasoft Invoix.

Hitasoft Invoix is a free invoice generator and business invoicing application. It is developed and operated by Hitasoft Technology Solutions Pvt Ltd, Madurai, Tamil Nadu, India ("Hitasoft", "we", "us").

This Privacy Policy applies to:

• the Hitasoft Invoix website and web application,
• the Hitasoft Invoix iOS app and Android app, when they are released, and
• related Hitasoft Invoix services, such as the emails the service sends.

It does not cover the Hitasoft company website or other Hitasoft products and client projects, which have their own terms. We handle the information entrusted to Hitasoft Invoix responsibly and use it only to provide, secure and support the service as described below.

Hitasoft Invoix collects the information you and your team enter, and a limited amount of technical information needed to keep accounts secure. It does not use advertising, analytics or crash-reporting tools.

2.1 Account information

• Your name and email address, provided when you register or accept an invitation to an organization.
• Your password, which is stored only as a one-way hash and is never visible to us.
• Account status details: whether your email address is verified, when you last signed in, and failed sign-in counts used to lock an account temporarily after repeated wrong passwords.
• Your organization memberships and roles (owner, admin, accountant, staff or viewer), and invitations sent to your email address.
• Session information: a sign-in session record for each device, including its IP address, browser or app user agent, and creation, last-use and expiry times.

Hitasoft Invoix does not ask for your personal phone number, date of birth or government ID.

2.2 Business and organization information

When you set up and use an organization, you may provide:

• business name, legal name and display name;
• business address, email address, phone number and website;
• GSTIN, PAN and tax registration status;
• bank and payment details printed on invoices: bank name, account name, account number, IFSC, branch, account type, UPI ID and SWIFT code;
• branding: logo, signature and seal images, colors, fonts and invoice template;
• preferences such as currency, time zone, date format, invoice prefix and numbering, default due days, notes and terms.

2.3 Customer and client information

You may enter information about your own customers in customer records and on invoices, such as:

• customer name and business name;
• email address, mobile and alternate phone numbers and website;
• billing and shipping addresses;
• GST type, GSTIN and PAN;
• internal notes (visible only inside your organization, never printed on invoices or emails);
• invoice, payment and statement history for that customer.

2.4 Invoice and financial information

• invoice details: number, invoice, supply and due dates, status, notes and terms;
• line items: product or service name and description, HSN/SAC code, quantity, unit, rate, discount and tax rate;
• amounts and taxes: subtotal, discounts, CGST, SGST or IGST, and totals;
• a copy of the customer and business details as they were when the invoice was created, including the bank details printed on it;
• payment records you add: amount, date, method, reference, notes, who recorded it and any reversal;
• recurring invoice schedules: frequency, dates and invoice contents;
• expenses: title, description, category, amount, date, payment method, vendor, reference and notes;
• direct income: amount, source, category, date, payment method, payer, reference and notes;
• financial and GST reports, which are calculated from the records above.

These are records you create. Hitasoft Invoix does not connect to your bank and does not collect bank transaction data.

2.5 Activity and security records

• Audit log entries for important actions in an organization (for example sign-ins, created or changed invoices, recorded payments and team changes). An entry records the action, the record affected, the values before and after a change where relevant, who performed it, and the IP address and user agent of the request. Sign-in entries include the email address used.
• Server request logs containing the time, method, path (without query parameters), response status and duration of each request. Request bodies, cookies, passwords and tokens are not written to these logs.
• The web server that hosts the service may keep standard access logs, which typically include IP address, requested address, time and user agent.

We use information only to provide and protect Hitasoft Invoix:

• creating, editing and printing invoices, and generating PDF invoices;
• managing customers, customer statements and team members, including team invitation links;
• recording invoice payments, expenses and income, and generating reports;
• running recurring invoice schedules you set up;
• creating and signing in to accounts, and sending the only three emails the service sends: a one-time welcome email when you sign up, email address verification and password reset;
• securing the service: keeping sessions valid, limiting repeated attempts, locking accounts after repeated failed sign-ins, and keeping audit records;
• responding to support and privacy requests;
• diagnosing errors and keeping the service reliable.

We do not sell personal information, and we do not use it for advertising or advertising profiles. Invoice PDFs are generated on your own device and are not stored on the server. Hitasoft Invoix does not email invoices, statements, reports or reminders.

We share information only when necessary to operate the service or when required:

• Within your organization. Members see organization data according to their role. Owners and admins can see the team list and the audit log, including the IP addresses and user agents recorded for actions.
• Service providers that operate infrastructure on our behalf: hosting and database infrastructure, the email delivery (SMTP) provider that sends welcome, verification and password reset emails, and Google Fonts, which serves the typeface used by the website. See section 15.
• Legal obligations. When disclosure is required by applicable law, regulation, legal process or a lawful request from authorities.
• Security and fraud prevention. To investigate or prevent abuse, security incidents or fraud, and to protect our users and the service.
• Business transfers. If Hitasoft Invoix is part of a merger, acquisition or sale of assets, information may be transferred as permitted by law, and this policy would continue to apply to it.

We do not share information with advertisers, data brokers or analytics companies.

Hitasoft Invoix lets you enter information about your own customers and clients. We process that information on your behalf to provide invoicing, customer management and reporting features, and for no other purpose.

As the Hitasoft Invoix account holder or organization, you remain responsible for:

• collecting your customers' information lawfully and having the right to enter it;
• keeping it accurate and up to date;
• using it appropriately, including the invoices and statements you send;
• meeting any privacy obligations that apply to your business;
• responding to your customers' requests about their information where required by law.

If one of your customers contacts us about their information, we may refer them to you. You can edit or deactivate customer records at any time, and delete customers that have no invoices; invoices keep the customer details they were issued with.

There is an important difference between payment records and payment processing:

• Payment records stored in Hitasoft Invoix. You can record a payment against an invoice (amount, date, method such as cash, bank transfer, UPI, cheque or card, and an optional reference). This updates the invoice's paid amount, balance and status.
• Payment processing. Hitasoft Invoix does not process payments. It has no payment gateway, does not move money and does not collect card numbers, CVVs, bank passwords or UPI PINs.

Recording a payment inside an invoice does not mean Hitasoft Invoix processed the underlying payment. The bank details and UPI ID you add are printed on your invoices so your customers can pay you directly.

Hitasoft Invoix is free to use, and we do not collect payment details from you.

Hitasoft Invoix uses only what is needed for sign-in, security and basic preferences. It sets no advertising, analytics or tracking cookies.

You can clear cookies and site data in your browser settings. Blocking the refreshToken cookie will prevent you from staying signed in.

Hitasoft Invoix apps for iOS and Android are planned. They will use the same account and the same service as the web application, and this policy applies to them. The apps process the information described in section 2 in order to:

• sign you in and keep your session active;
• display, create and edit invoices, customers and other records;
• generate, download and share invoice documents;
• keep your account and organization data in sync with the service.

This policy does not describe any access to your contacts, location, camera, microphone, photos, Bluetooth or health data, because Hitasoft Invoix does not use them. If a future version of an app needs a device permission for a feature, the app will ask for it first and we will update this policy before releasing that feature.

Push notifications

Hitasoft Invoix does not currently send push notifications. If they are introduced, this policy will describe the notification services used and the device identifiers they process. Notifications would be used for service updates about your account and invoices, not for advertising.

In the apps, this policy will be available under Settings → Privacy Policy, and account deletion under Settings → Delete Account.

We use reasonable technical and organizational measures to protect information, including:

• encrypted HTTPS/TLS connections for the production service;
• passwords stored as one-way bcrypt hashes; password reset, email verification, invitation and session tokens stored only as hashes;
• authenticated API access with short-lived access tokens and HttpOnly session cookies;
• organization-level isolation, so each organization's records are available only to its own members;
• role-based access control inside each organization;
• session management that ends sessions on sign-out, password changes, member removal and account deletion;
• rate limiting and temporary account locks after repeated failed sign-ins;
• audit and security logging, and protected server infrastructure with restricted access.

No method of transmitting or storing information over the internet is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and sign out on shared devices.

We retain information for as long as reasonably necessary to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security. In practice:

• Account information is kept while your account exists. When you delete your account, your name, email address and password are removed as described in section 11.
• Sessions expire after 7 days and expired sessions are removed automatically. All of your sessions are deleted when you delete your account.
• Email links expire: password reset links after 30 minutes, email verification links after 24 hours and team invitations after 7 days.
• Invoices, customer records, payment records, expenses, income and reports belong to the organization and are kept while the organization exists, including after an individual member leaves or deletes their account. Invoices can be cancelled, payments reversed and expenses voided, but they are kept as financial history.
• Audit and security logs are kept with the organization's records. There is currently no fixed automatic deletion period.
• Backups of the service database may contain information for a limited time after it is deleted, until those backups are replaced in the normal backup cycle.

You can:

• Access your information in the app, and download invoices as PDFs and reports as CSV or PDF files.
• Correct business, customer and invoice information in the app. To change your account name or email address, contact us.
• Delete customer records that have no invoices (customers with invoices can be deactivated), cancel invoices and reverse payments or void expenses (these remain as financial history), or delete your account as described in section 11.
• Close your account by deleting it, or ask an organization owner to remove you from their organization.
• Ask questions or make a privacy request by contacting us.

Depending on where you live, you may have additional rights under applicable data protection law. Contact us to exercise them; we may need to verify your identity before responding.

Hitasoft Invoix is a business productivity and invoicing application. It is not intended for children, and we do not knowingly collect personal information from children. If you believe a child has provided information to Hitasoft Invoix, contact us and we will delete it.

Hitasoft is based in India. The infrastructure and service providers that help us run Hitasoft Invoix, including hosting, email delivery and font delivery, may process information in locations outside your state or country. Where information is processed elsewhere, we take reasonable steps to keep it protected as described in this policy.

Hitasoft Invoix currently relies on the following services. It does not include advertising, analytics, crash-reporting, payment or social-login SDKs.

When the iOS and Android apps are released, they will be distributed through the Apple App Store and Google Play, which process download information under their own privacy policies. We will update this section before any additional service is added to the apps.

We may update this policy when Hitasoft Invoix changes or when required. The updated version will be posted on this page and the "Last updated" date will change. For material changes, we may also give additional notice, such as a message in the app or an email, where appropriate.

For privacy questions, requests or account deletion, contact: