Privacy policy.

01Who we are#

InvoiceAuto is an invoicing and payment-follow-up service operated by PT Invoiceauto Digital Indonesia, a company registered in the Republic of Indonesia. For the purposes of Indonesia’s Personal Data Protection Law (UU No. 27/2022, “UU PDP”) and, where it applies, the EU General Data Protection Regulation, we act as the data controller for the personal data described here.

02What this policy covers#

This policy covers personal data processed through the InvoiceAuto web application, the invoice delivery links we send on your behalf, our support channels, and this website. It does not cover third-party services you choose to connect — a shop platform, an accounting tool, or a payment provider each has its own policy, and we recommend reading it before connecting.

When you use InvoiceAuto to invoice your customers, you are the controller of your customers’ data and we act as your processor. In that role we handle data only on your documented instructions, which are set out in our terms of service and in the data processing addendum available on request from [email protected].

03Data we collect#

We collect what an invoicing service needs to issue a document, deliver it, and prove later that it was paid. Nothing more.

What we do not collect

• Full payment card numbers, CVV codes, or bank credentials. These stay with the licensed payment provider.
• Special-category data (health, biometric, religious, political). Our terms prohibit uploading it.
• Data from children. The service is for businesses and is not offered to anyone under 18.

04Why we process it#

Each processing activity rests on one of the legal bases recognised by Article 20 of the UU PDP. Where the GDPR applies, the equivalent basis is shown in brackets.

We do not sell personal data, and we do not share it with advertising networks. There is no third-party tracking pixel on this website; the fonts we use are served by Google Fonts, which receives your IP address when the page loads.

05Cookies and local storage#

We use the smallest set of cookies that lets the product function.

There are no advertising or cross-site tracking cookies. You can block or delete cookies in your browser; blocking the first two will prevent sign-in.

06Who we share it with#

We use a small number of processors. Each is bound by a written agreement that limits it to processing on our instructions, and each is reviewed at least once a year.

We also disclose data where we are legally required to: a court order, a request from a competent Indonesian authority, or a demand from a tax office in connection with an audit. Where the law allows it, we notify you before complying. If InvoiceAuto is acquired or merged, data may transfer to the successor entity; you will be told at least 30 days beforehand and may delete your account in that window.

07Where your data is stored#

Primary storage is in Singapore, chosen for latency from Jakarta. Backups are encrypted and stored in Jakarta. Two processors (email delivery and error telemetry) operate outside Indonesia; transfers to them rely on the safeguards in Article 56 of the UU PDP and, for EU residents, on Standard Contractual Clauses together with a transfer impact assessment that we review annually.

You can request a copy of the safeguards in force at any time by writing to [email protected].

08How long we keep it#

Retention is set by what the record is for, and by Indonesian tax law, which requires accounting documents to be kept for ten years.

When a retention period ends, the data is erased or irreversibly anonymised. Encrypted backups roll off within 35 days of deletion from the primary store.

09How we protect it#

• In transit: TLS 1.3 with HSTS, including on invoice download links, which are signed, single-purpose and expire after seven days.
• At rest: AES-256 for databases and object storage. Backups are encrypted with a separate key held in a hardware security module.
• Access: role-based, least privilege, mandatory hardware-backed second factor for every employee. Production access is logged and reviewed weekly.
• Engineering: peer review on every change, dependency scanning on every build, annual penetration test by an external firm.
• Isolation: each tenant’s data is separated at the row level and enforced in the query layer, not in application code alone.

If a breach affects your personal data, we notify the supervisory authority within 3×24 hours as required by Article 46 of the UU PDP, and we notify you without undue delay with what happened, what data was involved, and what we have done.

10Your rights#

Under Articles 5 to 13 of the UU PDP you may ask us to:

1. Confirm whether we hold your data and give you a copy, in a portable format.
2. Correct data that is inaccurate or incomplete.
3. Delete data that is no longer needed for the purpose it was collected for.
4. Restrict or object to processing based on legitimate interest.
5. Withdraw consent you previously gave, without affecting processing already carried out.
6. Receive your data in a machine-readable format and have it sent to another controller.
7. Ask for human review of a decision made solely by automated means.

Write to [email protected] from the address on the account, or by post to the registered office. We respond within 14 calendar days and may extend once by a further 14 days for complex requests, telling you why. There is no fee unless a request is manifestly unfounded or repetitive.

If you are not satisfied with our answer, you may complain to the Ministry of Communication and Digital Affairs (Komdigi) as the supervisory authority for the UU PDP, or to the data protection authority in your country of residence.

11Automated decisions#

InvoiceAuto schedules reminders automatically: an invoice that is unpaid at 7, 14 and 30 days past its due date enters a queue, and each queued message re-checks the live invoice state before it is sent, so a payment that lands in the meantime cancels the reminder. This scheduling does not produce legal effects and does not profile you; the only variable is the invoice’s own state. Fraud screening may flag an account for manual review, and a human always makes the final decision.

12Children#

The service is sold to businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will close it and erase the data.

13Changes to this policy#

When we change this policy we publish the new version here and update the date at the top. If the change materially affects how we use data you have already given us, we email account holders at least 30 days before it takes effect, and you may close your account in that window.

14Contact#

Questions about this policy, a data request, or a security report — all reach a person, not a ticket queue.