Privacy Policy

1.1 Information you provide directly

• Account registration data — when you create an account, we collect your name, email address, phone number, company name, business address, and any other information you provide in your profile. Your password is stored securely by our identity provider and is never visible to us.
• Business data — clients, invoices, estimates, job descriptions, materials lists, uploaded photos, rate books, branding presets, templates, payment terms, and related documents you create, upload, or import. This may include names, email addresses, phone numbers, billing addresses, and payment information of your customers, which you provide on their behalf.
• Lead data — leads collected through the Lead Gen Engine (from sources such as Craigslist, Nextdoor, Facebook, or other platforms you integrate), including contact details, job descriptions, images, scope of work, and post content. This also includes automated responses, email delivery records, and engagement metrics for those leads.
• Communication data — when you contact us via email, support chat, feedback forms, or other channels, we collect the content of your message, your contact information, and any attachments you include.
• Payment data — billing address, subscription plan selected, and invoice history. Payment processing is handled entirely by Stripe, our payment processor. We do not collect, store, or have access to your credit card numbers or full payment card data. Stripe provides us only with payment status, transaction ID, and billing metadata.
• API and MCP server usage — when you or your AI agents use the MCP server or REST API, we log the action taken (for example "estimate created", "invoice sent", or "email sent"), the resource type, timestamp, user identity, IP address, API key used, and outcome/status. This audit trail allows you to review, monitor, and revoke agent activity.

1.2 Information collected automatically

• Device and browser information — device type, operating system, browser type and version, device identifiers, and user agent information.
• Usage and activity data — pages viewed, features used, time spent on the Service, clicks, interactions, searches, filters applied, and other actions you take within the Service.
• Connection and location data — IP address, approximate geolocation based on IP, connection type (e.g., WiFi, cellular), and referring website or link.
• Log data — server logs containing access times, request types, response codes, error messages, and other technical information related to your use of the Service.
• Email engagement data — for estimate and invoice emails sent through the Lead Gen Engine or the Service, we track whether the email was delivered, opened, bounced, or marked as spam. We also track whether links and attachments in those emails were clicked or downloaded, along with the recipient's browser, device, and approximate location when available.
• Tracking pixels and web beacons — estimate emails sent to leads include a transparent tracking pixel that allows us to detect when an email is opened.

1.3 Information from third parties

• Lead sources — when you integrate lead-scraping sources (Craigslist, Nextdoor, Facebook, etc.), we receive lead information from those platforms on your behalf, subject to their terms of service and API policies.
• Service providers — Stripe provides payment-related information; email delivery services provide delivery and bounce data; and our cloud infrastructure provider may provide security and usage logs.
• Public information — we may collect publicly available business information to improve service recommendations or to support fraud prevention.

For users in jurisdictions with data protection laws (such as the GDPR), we process your personal information on the following legal bases:

• Contract — to perform the Services you have requested and to fulfill our obligations under our Terms of Service.
• Consent — where you have opted in to marketing communications, analytics, or other optional data collection.
• Legitimate interests — to operate, improve, and secure our Service; to prevent fraud and abuse; to enforce our legal rights; and to communicate with you about your account.
• Legal obligation — to comply with applicable laws, regulations, court orders, or government requests.

• To operate and provide the Service — create, store, retrieve, edit, and send invoices, estimates, proposals, and related documents; manage your account; process subscriptions and payments; and enable core functionality.
• To power AI features — generate itemized line items, materials lists, measurements, cost estimates, and assumptions from job descriptions and photos you submit. AI processing is performed by third-party providers (OpenRouter, NVIDIA NIM) as described in Section 4.
• To improve the Service — analyze aggregated, de-identified usage patterns to identify trends, understand user behavior, and develop new features and improvements.
• To communicate with you — send transactional emails (invoices, estimates, password resets, billing notifications, and account confirmations); respond to your inquiries; provide customer support; and send service updates or announcements.
• To prevent fraud and abuse — detect, prevent, and address fraudulent transactions, unauthorized access, abuse, or other violations of our Terms of Service. This includes analyzing patterns, monitoring for suspicious activity, and cooperating with law enforcement.
• For security and compliance — maintain the security and integrity of the Service; comply with legal obligations; respond to lawful requests from government authorities; enforce our legal agreements; and protect the rights, property, and safety of our users, the public, and our Company.
• For marketing and analytics — with your consent, we may send promotional emails about new features, special offers, or resources. You can unsubscribe from marketing emails at any time.

We do not sell, trade, rent, or share your personal information with third parties for their independent marketing purposes. We do not use your data for targeted advertising on social media or other platforms unless you have explicitly opted in.

When you use AI-powered estimating (available on Pro and Business plans), the following information is transmitted to third-party AI providers solely to generate your estimates:

• Job description and scope of work text
• Uploaded photos and images
• Materials and rate-book entries you reference
• Any custom prompts or instructions you provide

Current AI providers:

• OpenRouter (https://openrouter.ai) — routes your request to various large language models (LLMs).
• NVIDIA NIM (https://www.nvidia.com/en-us/ai-data-science/nvidia-nim/) — provides AI inference services.

How your data is protected: We transmit only the minimum information necessary to generate your estimate. AI providers are contractually restricted from using your content to train their models or for any purpose other than generating your estimate. Access to your data is scoped to your specific request and is not retained by the AI provider after processing. However, we cannot guarantee that AI providers do not retain logs or metadata. If you have concerns, please review their respective privacy policies.

Important: Do not include sensitive personal information in job descriptions, photos, AI prompts, or client details. Examples include:

• Social Security numbers or other tax identification numbers
• Financial account numbers, credit card numbers, or banking information
• Health information or medical records
• Passwords or security credentials
• Confidential or proprietary business information not intended for AI processing

AI-generated content can be inaccurate, incomplete, or biased. You are solely responsible for reviewing, validating, and correcting all AI-generated estimates before sending them to clients or using them for business decisions.

We share your personal information only with service providers and partners necessary to operate the Service, and only to the extent required for them to perform their function. These recipients are contractually obligated to protect your data and use it only for the purposes we specify.

• Stripe (https://stripe.com) — payment processing. Subscription billing, payment links, and invoice history are processed through Stripe. Your clients pay Stripe directly; we never receive or handle credit card numbers or full card data.
• Resend (https://resend.com) — transactional email delivery. We send your account notifications, password resets, transactional invoices, and estimates through Resend's infrastructure. Resend does not use your data for marketing.
• Supabase (https://supabase.com) — backend infrastructure including PostgreSQL database, authentication, file storage (for photos and documents), and hosting. Supabase is hosted on Amazon Web Services (AWS) in the United States.
• AI providers (OpenRouter, NVIDIA NIM) — AI-generated estimates, as described in Section 4.
• Analytics and monitoring — we may use third-party services for error tracking, performance monitoring, and security logging to maintain and improve the Service.
• Lead sources — when you connect to lead-scraping platforms (Craigslist, Nextdoor, Facebook, etc.), your API credentials and connection preferences are stored to enable lead retrieval. We do not share your business data with these platforms.

Legal and regulatory disclosure: We may also disclose your personal information where required by law, legal process, or government request (including subpoenas, court orders, and law enforcement demands). We will notify you of such requests unless legally prohibited from doing so. We may also disclose information to protect the rights, property, or safety of Honest Invoice, our users, or the public; to enforce our Terms of Service or other agreements; or to prevent fraud or other illegal activity.

Business transfers: If Honest Invoice is involved in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction or proceeding, your personal information may be transferred as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.

No sale of personal information: We do not sell, rent, trade, or otherwise transfer your personal information to third parties for their own marketing or commercial purposes.

We use cookies, web beacons, local storage, and similar tracking technologies to enhance your experience with the Service. These are used for the following purposes:

• Authentication and security — to keep you signed in, remember your preferences, and prevent unauthorized access.
• Functional purposes — to enable core features such as form persistence, language preferences, and UI state.
• Analytics — with your consent, we may use analytics cookies to understand how users interact with the Service and to improve performance.

No advertising cookies or third-party trackers: We do not use cookies for targeted advertising, behavioral tracking, or sharing with third-party ad networks. We do not use Google Analytics or similar cross-domain tracking.

Your cookie choices: You can disable cookies in your browser settings or use private/incognito mode. Note that disabling cookies may prevent you from signing in or using certain features of the Service. Most browsers provide instructions on how to clear cookies and manage cookie preferences.

When you send estimate emails, invoices, or other communications through the Service, we collect the following engagement data:

• Email open tracking — estimate emails include a transparent tracking pixel. When a recipient opens the email, we record the open event (timestamp, recipient email, device, browser, approximate geolocation).
• Link and attachment tracking — we track when recipients click links, download attachments, or interact with buttons embedded in emails.
• Delivery status — we track whether emails were delivered, bounced, or marked as spam.
• Recipient data — name, email address, and any other recipient information you include.

This engagement data is displayed in your Lead Board and account dashboard so you can measure lead interest and track follow-up actions. This data is not shared with third parties for advertising purposes and is used only to provide analytics and insights within your account.

We implement industry-standard security measures to protect your personal information from unauthorized access, disclosure, and misuse:

• Encryption in transit — all data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest — sensitive data stored in our database is encrypted at rest using industry-standard algorithms.
• Access control — access to your data is restricted to authorized personnel and is scoped to your account via row-level security policies. API keys are stored as one-way hashes and cannot be reversed.
• Authentication — user accounts are protected by email-based authentication. We recommend using strong, unique passwords and enabling additional security features when available.
• Secure development practices — our development practices follow the OWASP Top 10 guidelines and industry best practices for secure coding.
• Vulnerability management — we conduct regular security testing and respond promptly to identified vulnerabilities.

Important limitation: No method of transmission or storage over the internet is completely secure. While we use best efforts to protect your personal information, we cannot guarantee absolute security. Any transmission of data is at your own risk. You are responsible for maintaining the confidentiality of your account credentials.

Security incident notification: If we discover a security breach or unauthorized access to personal information, we will notify affected users as promptly as possible, consistent with the requirements of applicable law.

We retain your personal information for as long as necessary to provide the Service and to fulfill the purposes outlined in this Privacy Policy. Retention periods vary by data type:

• Account data — retained while your account is active. After account deletion, account data is retained for 30 days to cover backups and ensure data consistency, then permanently deleted.
• Business data (invoices, estimates, clients, leads) — retained while your account is active and for 30 days after account deletion, then permanently deleted, unless you have downloaded or exported the data.
• Payment and billing data — retained for 7 years to comply with tax, accounting, and legal record-keeping obligations that may apply to you.
• Audit logs and API activity — retained for up to 12 months to support security, fraud prevention, and troubleshooting. Some audit logs may be retained longer if required by law.
• Email engagement data — retained while your account is active, and for 30 days after account deletion.
• Log data and technical information — typically retained for 30–90 days, unless retention is required for security or legal reasons.
• Marketing and support communications — retained for as long as necessary to respond to your inquiry or as required by law.

If you are subject to industry-specific regulations (such as construction or tax law), you may be legally required to retain certain records longer. You are responsible for understanding and complying with your own record-keeping obligations.

Depending on where you live, you may have certain legal rights regarding your personal information. You can exercise these rights by contacting us at privacy@honestinvoice.com or through your account settings. We will respond to verified requests within the timeframes required by applicable law.

10.1 Rights available to all users

• Access and portability — request a copy of the personal information we hold about you in a portable, machine-readable format.
• Correction — request correction of inaccurate or incomplete personal information.
• Deletion — request deletion of your personal information (subject to legal record-keeping obligations).
• Marketing communications — opt out of promotional emails at any time by clicking "Unsubscribe" in the email footer or updating your preferences in your account settings.

10.2 California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know — request the categories and specific pieces of personal information we collect, the sources of that information, our purposes for collection, and the categories of third parties with whom we share it.
• Right to delete — request deletion of personal information we have collected from you, subject to certain exceptions (such as record-keeping obligations).
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sales and sharing — we do not sell or share your personal information for targeted advertising, so there is nothing to opt out of. However, if you wish to confirm this, you may submit a request.
• Right to limit use and disclosure — request that we limit our use of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination — we will not discriminate against you for exercising your CCPA/CPRA rights by denying services, charging different prices, or providing a different quality of service.

To exercise these rights, email us at privacy@honestinvoice.com with "California Privacy Request" in the subject line. We will verify your identity before fulfilling your request. You may authorize an agent to submit a request on your behalf; we will require proof of authorization.

10.3 Virginia, Colorado, Connecticut, Utah, and other state residents

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with comprehensive privacy laws may have similar rights, including:

• Right to access your personal information
• Right to correct inaccurate information
• Right to delete your personal information (subject to exceptions)
• Right to opt out of targeted advertising and data sales (which we do not conduct)
• Right to appeal our response to your request

To exercise these rights, contact us at privacy@honestinvoice.com.

10.4 European residents (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR), UK Data Protection Act 2018, or Swiss Federal Data Protection Act provide you with the following rights:

• Right of access to your personal data
• Right to rectification (correction) of inaccurate data
• Right to erasure ("right to be forgotten") in certain circumstances
• Right to restrict processing of your data
• Right to data portability
• Right to object to processing, including for direct marketing
• Rights related to automated decision-making and profiling

To exercise these rights, contact our Data Protection Officer or privacy contact at privacy@honestinvoice.com. You also have the right to lodge a complaint with your local data protection authority.

International transfers: The Service is hosted in the United States. Your personal data will be transferred to, stored in, and processed in the United States. The United States has not been deemed to have an adequate level of data protection under GDPR, but we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) to enable lawful transfers.

The Service is not directed to individuals under the age of 16 and we do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will promptly delete that information and terminate the child's account if applicable. If you believe a child has provided us personal information, please contact us immediately at privacy@honestinvoice.com.

The Service is primarily hosted in the United States on Amazon Web Services (AWS) infrastructure managed by Supabase. If you access the Service from outside the United States, your personal information will be transferred to, stored in, and processed in the United States. By using the Service, you consent to the transfer of your personal information to the United States, which may have different data protection laws than your home country.

For users in the European Economic Area, United Kingdom, or Switzerland, we implement appropriate safeguards for these transfers (such as Standard Contractual Clauses) consistent with GDPR and similar laws. You may contact us to inquire about the specific safeguards in place.

The Service may contain links to third-party websites and services that are not operated by Honest Invoice. This Privacy Policy applies only to the Service and does not cover the privacy practices of third-party sites. We are not responsible for the privacy practices or content of external links. We encourage you to review the privacy policies of any third-party sites before providing your personal information.

Third-party integrations (such as lead-scraping sources) may have their own privacy policies and terms of service. Your use of those services is subject to their respective policies.

We may update this Privacy Policy as the Service evolves, as our business changes, or as required by law. Material changes will be posted on this page with an updated "Last updated" date. For significant changes, we will notify you by email or by displaying a prominent notice on the Service. Your continued use of the Service after any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy, our data practices, or your personal information, please contact us:

• Email: privacy@honestinvoice.com
• Mailing address: [Insert your company's mailing address]
• Response time: We will respond to all privacy inquiries and data rights requests within 30 days (or as required by applicable law). For complex requests, we may need additional time.

For European users: If you have an unresolved privacy or data use concern that we have not satisfactorily addressed, please contact your local data protection authority or file a complaint with your supervisory authority.