Privacy Policy

Last updated: 10 August 2026

Invio is operated by Bakhtiyar Duganov, trading as Invio ("we", "us", "our"), a New Zealand business. This policy explains how we collect, use, and protect the personal information of our customers and website visitors in Australia.

Our home jurisdiction is New Zealand, and our primary legal obligations for handling personal information are under the New Zealand Privacy Act 2020. Businesses with an annual turnover of A$3 million or less are generally outside the scope of Australia's Privacy Act 1988 (Cth), and Invio is well below that threshold - so we are very likely not directly regulated under that Act or by the Office of the Australian Information Commissioner (OAIC). Even so, we have chosen to handle the personal information of our Australian customers consistently with the Australian Privacy Principles, and this policy sets out how.

1. Information We Collect

Information You Provide:

• Account information (name, email, password)
• Business details (business name, address, ABN, bank account)
• Invoice and quote data, and payment records
• Voice recordings and audio you dictate when using the optional voice-to-invoice feature
• Communications with our support team

Information Collected Automatically:

• IP address and browser type
• Device information
• Usage data (pages visited, features used)
• Cookies and similar technologies

2. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Process your invoices, quotes, and payments
• Draft invoices from your voice using AI, when you choose to use the voice-to-invoice feature
• Send transactional emails (invoice reminders, quotes, receipts)
• Improve our Service
• Respond to support requests
• Comply with legal obligations
• Detect and prevent fraud

3. How We Handle Your Information (Australian Privacy Principles)

As a voluntary commitment, we aim to handle your personal information consistently with the Australian Privacy Principles. In practice that means:

• Collecting only the information reasonably necessary to provide the Service
• Using and disclosing your information only for the purposes described in this policy, or purposes you would reasonably expect
• Taking reasonable steps to keep your information accurate, secure, and up to date
• Giving you access to, and the ability to correct, your own information
• Being open about how we handle personal information, including where it is stored

4. Data Sharing

We may share your information with service providers (hosting, email, payment processing), professional advisors, and law enforcement when legally required.

We do NOT sell your personal data or share data with advertisers.

Third-party services we use: see our Subprocessors page for the current, specific list of who they are, what each one does, and where they process data. We keep that list on its own page so it can be updated when a provider changes without needing a rewrite of this policy.

AI Features and Voice Data

Our optional voice-to-invoice feature uses artificial intelligence to turn what you say into a draft invoice. When you use it, the audio you record and the related invoice context (such as the client name and the line items needed to build the draft) are sent to our AI provider, Google Cloud (Vertex AI), for processing.

• Invio does not store your voice recordings. They are processed to create your draft and are not kept on our systems.
• Under Google Cloud's enterprise terms, your data is not used to train Google's AI models. Google may retain it only briefly for safety, abuse detection, and legal compliance.
• AI output is a draft you review and confirm before anything is sent. We do not guarantee the accuracy of AI-generated drafts, and you are responsible for checking them before use.

Overseas Data Processing

Some of our providers process data outside Australia. Invio itself is based in New Zealand, so your information is also processed there. Our database (MongoDB Atlas) is hosted in Sydney, Australia. Our web hosting (Vercel), our AI provider (Google Cloud Vertex AI), and our product analytics provider (PostHog) primarily process data in the United States. Our error-monitoring provider (Sentry) processes data in Germany. Our email delivery provider (Brevo) processes data primarily in France and the European Union. Our payment processor (Stripe) processes data in Ireland and the United States, and may use local processing entities in other countries where it operates. Our file-storage provider (Cloudflare R2) does not pin storage to a single country. We only use providers that are subject to privacy protections comparable to the Australian Privacy Principles, for example through data processing agreements and standard contractual clauses. By using these features you acknowledge that your information may be processed overseas.

5. Data Retention

• Active accounts: Data retained while account is active
• Scheduled account deletion: Data deleted after 30 days unless you cancel before then
• Backups: We keep encrypted backups on a rolling 30-day cycle. Data you delete stays in any backup that was taken before the deletion, until that backup reaches 30 days old and is removed automatically
• Invoices and Quotes: Export and retain your own records as needed, including where tax law applicable to your region requires it (currently 5-7 years depending on jurisdiction)
• Voice recordings: Not stored by Invio - processed transiently to create your draft, then discarded

6. Data Security

We protect your data with encryption in transit (HTTPS/TLS), encryption at rest, secure password hashing, and periodic security reviews (most recently in July 2026).

7. Data Breach Notification

As a New Zealand business, our legal breach-notification duty is under the New Zealand Privacy Act 2020: if we experience a breach that has caused, or is likely to cause, serious harm, we must notify the New Zealand Privacy Commissioner and affected individuals as soon as practicable - the Commissioner expects this within 72 hours of us becoming aware. For the small-business reason described above, we are very likely also outside Australia's Notifiable Data Breaches scheme. Even so, we apply the same standard to Australian users as a voluntary commitment: if a breach involving your information is likely to result in serious harm, we will notify you without undue delay. If you believe your information may have been affected by a breach, contact us at support@invio.co.nz.

8. Your Rights

You can ask us to access, correct, or delete your personal information at any time. To exercise these rights, contact us at support@invio.co.nz. We apply the same access and correction rights to Australian users as we do to our New Zealand customers.

9. Cookies

We use cookies for authentication, preferences, and analytics. You can control cookies through your browser settings.

10. Contact Us

Privacy contact: Bakhtiyar Duganov trading as Invio
Email: support@invio.co.nz
Address: Auckland, New Zealand

11. Complaints

If you have concerns about how we have handled your personal information:

1. Contact us first. Email support@invio.co.nz with details of your concern. We will acknowledge your complaint within 5 business days and aim to investigate and respond within 30 days.

2. If you are not satisfied, or want independent guidance. As a New Zealand business, our privacy supervisory authority is the Office of the New Zealand Privacy Commissioner (privacy.org.nz). Australian users can raise a complaint there by email or through the website - the Commissioner's 0800 freephone number is a New Zealand-only line and is not reachable from Australia. Australians seeking general guidance on their privacy rights can also refer to the Office of the Australian Information Commissioner (oaic.gov.au). As explained above, we are very likely not within the OAIC's jurisdiction, so this is a source of information rather than a body that supervises us.