Last updated 31 August 2026
Invo (Pty) Ltd (“Invo”, “we”, “us”) operates the website at getinvo.co.za and the Invo SaaS platform. This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have under the Protection of Personal Information Act, 2013 (POPIA).
By creating an account or using our services you agree to the practices described here. If you do not agree, please do not use Invo.
Invo (Pty) Ltd is the Responsible Party as defined in POPIA. We determine the purpose and means of processing your personal information.
We collect information in the following categories:
| Account data | Name, email address, password (hashed), business name, VAT number, banking details, logo |
| Client data | Names, email addresses, phone numbers, WhatsApp numbers, physical addresses and VAT numbers of your clients, entered by you |
| Transaction data | Invoices, quotes, expenses, job cards, purchase orders and line items you create |
| Payment data | Payment amounts, references and status recorded against your invoices, including payments your clients make online through a gateway you've connected, plus subscription payment data processed via Paystack. We do not store full card numbers; those are entered directly on the payment gateway's own page. |
| Payment gateway credentials | If you turn on online invoice payments, the API keys and secrets for the gateway(s) you connect (Paystack, PayFast, Peach Payments, Yoco or Ozow), stored encrypted and used only to create checkout sessions and confirm payments on your behalf |
| Usage data | Pages visited, features used, session duration, browser and device type, collected via PostHog analytics |
| Communications | Messages you send us via email or support channels |
| Uploaded documents | Files you store in the Invo Vault, project photos and client signoff signatures (encrypted at rest) |
| Free tool leads | Email, name and business name, if you use a free public tool (such as the free invoice generator) without creating an account, plus whether you opted in to marketing emails |
We do not collect sensitive personal information (as defined in POPIA section 1) unless you voluntarily provide it.
We process your personal information for the following purposes and on the following grounds:
| PURPOSE | DESCRIPTION | LAWFUL GROUND |
|---|---|---|
| Providing the service | Creating and managing your account, generating invoices and quotes, processing payments | Performance of contract |
| Online invoice payments | Storing your connected payment gateway credentials (encrypted) and using them to create checkout sessions and confirm payments, only if you turn this feature on | Performance of contract |
| Billing | Calculating and collecting subscription fees via Paystack | Performance of contract |
| Product improvement | Analysing usage patterns to improve features and fix bugs | Legitimate interest |
| Communication | Sending transactional emails (invoice sent, payment received, password reset) | Performance of contract |
| Marketing | Sending product update emails, you can unsubscribe at any time | Consent |
| Legal compliance | Retaining records as required by South African law | Legal obligation |
| Security | Detecting and preventing fraud and abuse | Legitimate interest |
Your account and business records are stored in Supabase's managed PostgreSQL database hosted in the EU (Stockholm, Sweden). Files you upload — Vault documents, project photos and client signoff signatures — are stored separately in Cloudflare R2 object storage. Your web application is served from Vercel's South African edge where possible.
We implement the following security measures:
No security measure is 100% foolproof. If you suspect unauthorised access to your account, contact us immediately at info@getinvo.co.za.
| DATA TYPE | RETENTION PERIOD |
|---|---|
| Active account and business data | Duration of your subscription |
| Invoice and financial records | Duration of your subscription, see note below |
| Usage and analytics data | 24 months |
| Support communications | 3 years |
| Vault documents | Until you delete them or close your account |
| Payment gateway credentials | Until you disconnect the gateway, then deleted immediately |
| Free tool leads | Until you ask us to delete your details or unsubscribe from marketing |
When you delete your account, all of your data, including invoices, quotes, and other financial records, is permanently and immediately deleted from our systems. We do not retain a copy after deletion. South African tax law (the Tax Administration Act) requires businesses to keep their own financial records for 5–7 years, so if you may need yours for that purpose, export or download them before closing your account.
Free trial accounts: If your free trial ends and you do not upgrade, your account and all associated data (invoices, clients, documents, etc.) will be retained for 120 days to allow you to return and upgrade. After 120 days of inactivity we will send a final notice and then permanently delete the account and all data. You will receive email reminders at 14 days and 90 days after your trial ends. To avoid deletion, upgrade to a paid plan at any time before day 120.
As a data subject you have the right to:
To exercise any of the first five rights, email us at info@getinvo.co.za. We will respond within 30 days.
Invo is a business tool intended for adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy from time to time. When we do, we will update the “Last updated” date at the top and, for material changes, notify you by email or via a banner in the dashboard. Continued use of Invo after the effective date constitutes acceptance of the updated policy.
For any privacy-related questions, requests or complaints:
We aim to respond to all requests within 30 days.