Privacy Notice

Last updated: 15 October 2026

This notice covers InvoisLaju: Invoice Maker, provided by LedgerBridge Digital, on Android and the browser workspace. They keep separate local document stores. Website Pro payments are processed by Stripe hosted Checkout.

Where your invoice data is stored

Businesses, clients, products, documents, logos and signatures are stored locally on your device: in app storage on Android or site storage in your browser. InvoisLaju does not send this content to our own application server.

Browser storage can be removed when you clear site data, use private browsing, reset the browser or change devices. Keep an exported copy of important documents and backups.

Optional Google account and Drive backup

You may use core invoicing features without an account. If you choose Google sign-in, Firebase Authentication receives your Google account identifier, display name, email address and profile photo so InvoisLaju can recognize the signed-in account.

If you separately connect Google Drive or start a Drive backup, InvoisLaju uploads a JSON backup containing your businesses, clients, products, documents, settings, logos and signatures to the private appDataFolder area of your Google Drive. After Drive is connected, manual or automatic backups may run when local data changes. The app keeps up to the latest ten backups. These files are processed by Google under your Google account and are not visible in your normal Drive file list.

You can delete Drive backups from the app’s account deletion flow. Deleting a Firebase account, clearing browser data and deleting Drive backups are separate actions; select each data location you want removed.

Android membership and feature trials

Our authenticated membership backend uses Firebase Authentication and Cloud Firestore. It verifies Google Play purchase tokens and stores product and base-plan identifiers, purchase status, expiry and processing times, acknowledgment, replacement and cancellation state, and account ownership links. It derives a stable pseudonymous Google identity by hashing the Google provider's account identifier, not your Gmail address. This supports paid-rights recovery and prevents duplicate or fraudulent ownership claims; it is still account-related data, not anonymous data.

Owner-managed grants use the verified Google email and grant status. Membership results are associated with your Firebase UID. Premium-template and signature trials store document identifiers in Cloud Firestore to count each account's included uses, without invoice contents or signature images. Monthly footer-free export usage is local device or browser state.

Stripe Web payments

When you purchase Web Pro, we send Stripe your verified purchase email and a stable pseudonymous Google identity hash to associate the Stripe Customer with your account. Stripe collects payment-card and billing information directly through hosted Checkout and its Customer Portal. Our application does not receive or store full card numbers or security codes. Stripe processes information under its Privacy Policy.

Our Firebase backend stores account ownership links, Stripe Customer, Checkout, payment, invoice and subscription identifiers, selected plan, payment and refund/dispute status, paid access expiry, cancellation state, and webhook event identifiers and processing times. These records support payment verification, Pro access, billing support and fraud/duplicate-claim prevention. Invoice documents, customer lists, logos and signatures created in InvoisLaju are not sent to Stripe.

Account deletion removes current Stripe entitlements and Checkout records and detaches retained billing identifiers from the deleted Firebase account. Minimal stable ownership linkage and purchase records remain for paid-rights recovery and billing reliability; there is no automatic billing-record purge or fixed retention deadline. Stripe retains its own financial records under its policies. Deleting an InvoisLaju account does not cancel Stripe billing: use Membership → Manage subscription in Stripe in the Web workspace before deletion, or contact support.

Feedback

Android feedback opens your email app and does not attach invoice or client data automatically. Signed-in Web Trial users can submit feedback to Cloud Firestore. A submission can contain its category, message, optional reply email, account UID, status and timestamps. It is visible to the authorized InvoisLaju operator for support and product improvement.

The Android membership account-deletion service removes feedback authored by the deleting UID with ordinary account records. On an older app or the separately deployed Web Trial, contact us to complete server-record deletion if its account control removes only the sign-in identity.

Analytics and crash diagnostics

The website and Web Trial use Google Analytics for basic usage statistics automatically, without a consent popup. Revised Android releases also enable basic usage statistics automatically; earlier releases may ask first or keep collection disabled. Previous off choices are respected. Basic statistics include pages or features used, document type, template choice, export format and outcome, backup results and membership actions. These records use technical or pseudonymous identifiers and are not described as anonymous. New automatic Android collection does not attach your Firebase account ID; an existing or later explicit analytics opt-in can associate signed-in activity with that ID, not your email or name. Android Settings provides a usage analytics switch; its choice stays on that device outside document backups. Turning it off stops future collection and clears local Analytics identity/data; previously received server data is separate. On the website, the control below turns off future usage statistics in this browser. Previously declined browser choices and Global Privacy Control are respected. Advertising storage, advertising user data, Google signals and ad personalization are disabled for website statistics; Android advertising collection also stays disabled. Android beta and production builds may send technical crash diagnostics through Firebase Crashlytics.

Turn off usage statistics in this browser

We do not intentionally send invoice content, document numbers, amounts, customer or business names, contact details, addresses, notes, bank details, PDF files or backup content to Analytics or Crashlytics. Google may process technical identifiers needed to provide these services.

Deletion and retention

Completed membership account deletion removes the Firebase identity, current entitlement, feature-use records, authored feedback, the matching original gift and account-related audit/index fields. A recreated account starts fresh feature usage after those records are removed; an erased gift needs owner regrant. Local documents and private Drive backups are separate optional deletions.

Limited billing records remain: purchase token and hash, product/base plan, status and times, original obfuscated Play account binding, stable Google-identity hash, replacement links, acknowledgment/cancellation state and hashed deletion linkage. They support continuing paid access and restoration, subscription lifecycle handling and fraud/duplicate-claim prevention. There is currently no automatic billing-record purge or fixed deletion deadline; lifetime recovery may require long-term retention. Contact us for review of retained data. We do not claim a statutory minimum retention period.

Pending deletion jobs temporarily retain the UID/email, hashed Google identity, request and retry/lease details and record-version boundaries needed to finish safe cleanup. On completion they retain only status and completion time under a hashed old UID, to prevent stale work. A separate security deny marker contains the old UID and an expiry set 24 hours after the request; Firestore TTL removal is eventual, not guaranteed exactly at 24 hours. Minimal billing retry metadata and processed-notification purchase hashes/times remain for reliable processing. These records do not contain invoice content. Recovery support case files are operator-controlled; the backend recovery audit retains the case reference, evidence hash, operator identity and target UID until that target account's cleanup.

Analytics/crash records follow the configured Google service retention and are not promised immediate erasure by account deletion. The app clears its user association; already recorded diagnostics may remain. See deletion choices and support. Deleting an account does not cancel Google Play billing: manage or cancel subscriptions in Google Play.

Your choices and responsibilities

You can use Clear trial data to remove browser records, delete local Android data from account settings, delete Drive backups when offered, and delete the linked Firebase account. Contact us for help with feedback removal or other privacy requests.

Only enter personal or business information that you are authorized to process. You remain responsible for the documents you create and send.

Support

Questions can be sent to noyolosia@gmail.com.