Privacy Policy

1. Information We Collect

We collect the following categories of personal data, mostly the data you give us when you sign up and use the Service:

• Account data. Your email address, name, password (hashed), authentication tokens, and language preferences.
• Profile and business data. Company name, address, tax IDs, default currency, branding (logo, colors), and document numbering settings you provide.
• Document data. Invoices, estimates, line items, client records, and the recipient details you enter on each document.
• Payment integration data. The IDs and connection state for the Stripe account you connect. We never see card numbers, bank-account credentials, or full payment instruments.
• Subscription data. Your plan, trial state, and billing identifiers from Polar.sh (web) or Apple via Adapty (iOS).
• Usage data. Pages viewed, clicks, errors, device and browser type, IP address, approximate location, session recordings, and similar diagnostics.
• Communications. Messages you send through the contact form, support email, or in-app feedback.

2. How We Use Information

We use personal data to:

• operate the Service: authenticate you, store your data, render invoices and PDFs, send transactional email on your behalf, and update document status when payments clear;
• run our business: bill you, prevent fraud and abuse, comply with legal obligations, enforce our Terms, and resolve disputes;
• improve the product: monitor performance and errors, understand which features are used, and prioritize what to build next;
• communicate: send service announcements, security alerts, billing notices, and (only with your opt-in) marketing email.

3. Subprocessors and Third Parties

We use trusted vendors to operate the Service. Each receives only the data needed for their part, under contracts that include confidentiality and security obligations:

• Supabase, Inc.: application hosting, authentication, and primary database.
• Stripe, Inc. (via Stripe Connect): payment processing on your behalf when you connect Stripe.
• Resend, Inc.: transactional and contact-form email delivery.
• Polar Software Inc.: subscription billing for Simple Invoice itself (web).
• Adapty Tech Inc.: App Store subscription metering (iOS).
• Mixpanel, Inc.: product analytics, session replay, and heatmaps.
• Functional Software, Inc. (Sentry): error and performance monitoring.

We do not sell personal data, and we don't share it with advertisers.

4. Cookies and Similar Technologies

We use a small number of first-party cookies for sign-in sessions, theme/language preferences, and short-lived event flags. Mixpanel sets cookies and similar identifiers to support analytics and replay. Where required by law, we ask for your consent before non-essential cookies are set.

5. Your Rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal data we hold about you, and to lodge a complaint with a supervisory authority. Email cs [at] fbaterminal [dot] com to exercise any of these rights. We'll respond within 30 days.

If you're a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information.

6. International Transfers

Our infrastructure providers primarily store data in the United States and may also process it in the European Union. When required, we use standard contractual clauses or other recognized transfer mechanisms to protect your data.

7. Data Retention

We keep your account data for as long as your account is active.

When you delete your account, your invoices, estimates, clients, items, and uploaded files are deleted within 30 days, except where we must retain copies to meet tax, accounting, or legal obligations (typically up to 7 years for financial records under U.S. tax and accounting requirements).

Backups are retained on a rolling basis and overwritten on a normal schedule.

8. Security

We use TLS in transit, encryption at rest where supported by our providers, role-based access controls, audit logging, and least-privilege secrets handling. No system is perfect, but we treat security failures seriously and will notify affected users without undue delay if a breach occurs.

9. Children

The Service is not directed at people under 18 and we don't knowingly collect their personal data. If you believe a child has given us personal data, email cs [at] fbaterminal [dot] com and we'll delete it.

10. Changes to This Policy

We may update this policy from time to time. Material changes are announced in the app or by email at least 14 days before they take effect.

11. Contact

Questions about your privacy? Email cs [at] fbaterminal [dot] com or write to FBA Terminal LLC, 90 Dayton Ave, Passaic, NJ 07055, United States.