Last updated 29 September 2026
Invo (Pty) Ltd (“Invo”, “we”, “us”) operates the website at getinvo.co.za and the Invo SaaS platform. This policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have under the Protection of Personal Information Act, 2013 (POPIA).
By creating an account or using our services you agree to the practices described here. If you do not agree, please do not use Invo.
Invo (Pty) Ltd is the Responsible Party as defined in POPIA. We determine the purpose and means of processing your personal information.
We collect information in the following categories:
| Account data | Name, email address, password (hashed), business name, VAT number, banking details, logo |
| Client data | Names, email addresses, phone numbers, WhatsApp numbers, physical addresses and VAT numbers of your clients, entered by you |
| Transaction data | Invoices, quotes, expenses, job cards, purchase orders and line items you create |
| Payment data | Payment amounts, references and status recorded against your invoices, including payments your clients make online through a gateway you've connected, plus subscription payment data processed via Paystack. We do not store full card numbers; those are entered directly on the payment gateway's own page. |
| Payment gateway credentials | If you turn on online invoice payments, the API keys and secrets for the gateway(s) you connect (Paystack, PayFast, Peach Payments, Yoco or Ozow), stored encrypted and used only to create checkout sessions and confirm payments on your behalf |
| Usage data | Pages visited, features used, session duration, browser and device type, collected via PostHog analytics |
| Communications | Messages you send us via email or support channels |
| Uploaded documents | Files you store in the Invo Vault, project photos and client signoff signatures (encrypted at rest) |
| Free tool leads | Email, name and business name, if you use a free public tool (such as the free invoice generator) without creating an account, plus whether you opted in to marketing emails |
We do not collect sensitive personal information (as defined in POPIA section 1) unless you voluntarily provide it.
We process your personal information for the following purposes and on the following grounds:
| PURPOSE | DESCRIPTION | LAWFUL GROUND |
|---|---|---|
| Providing the service | Creating and managing your account, generating invoices and quotes, processing payments | Performance of contract |
| Online invoice payments | Storing your connected payment gateway credentials (encrypted) and using them to create checkout sessions and confirm payments, only if you turn this feature on | Performance of contract |
| Billing | Calculating and collecting subscription fees via Paystack | Performance of contract |
| Product improvement | Analysing usage patterns to improve features and fix bugs | Legitimate interest |
| Communication | Sending transactional emails (invoice sent, payment received, password reset) | Performance of contract |
| Marketing | Sending product update emails, you can unsubscribe at any time | Consent |
| Legal compliance | Retaining records as required by South African law | Legal obligation |
| Security | Detecting and preventing fraud and abuse | Legitimate interest |
Your account and business records are stored in Supabase's managed PostgreSQL database hosted in the EU (Stockholm, Sweden). Files you upload — Vault documents, project photos and client signoff signatures — are stored separately in Cloudflare R2 object storage. Your web application is served from Vercel's South African edge where possible.
We implement the following security measures:
No security measure is 100% foolproof. If you suspect unauthorised access to your account, contact us immediately at info@getinvo.co.za.
| DATA TYPE | RETENTION PERIOD |
|---|---|
| Active account and business data | Duration of your subscription |
| Invoice and financial records | Duration of your subscription, see note below |
| Usage and analytics data | 24 months |
| Support communications | 3 years |
| Vault documents | Until you delete them or close your account |
| Payment gateway credentials | Until you disconnect the gateway, then deleted immediately |
| Free tool leads | Until you ask us to delete your details or unsubscribe from marketing |
When you delete your account, all of your data, including invoices, quotes, and other financial records, is permanently and immediately deleted from our systems. We do not retain a copy after deletion. South African tax law (the Tax Administration Act) requires businesses to keep their own financial records for 5–7 years, so if you may need yours for that purpose, export or download them before closing your account.
Free plan accounts: If your trial ends or a paid plan lapses, your account moves to the Free plan and your data is kept. We do not delete Free plan accounts for inactivity. You can delete your account yourself at any time from Settings.
As a data subject you have the right to:
To exercise any of the first five rights, email us at info@getinvo.co.za. We will respond within 30 days.
Invo is a business tool intended for adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has created an account, contact us and we will delete it.
We may update this policy from time to time. When we do, we will update the “Last updated” date at the top and, for material changes, notify you by email or via a banner in the dashboard. Continued use of Invo after the effective date constitutes acceptance of the updated policy.
For any privacy-related questions, requests or complaints:
We aim to respond to all requests within 30 days.