Privacy Policy
Last updated: 15 September 2026
Invocket is an online workspace for invoices and delivery notes. This page describes account access, document storage, usage analytics and support.
Operator and support
Google sign-in
Google authenticates your account and provides an ID token. Invocket uses the account identifier, verified email address, display name and profile image URL to create or access your account. Invocket does not receive your Google password or request access to Gmail, Google Drive or contacts.
Workspace data
Your company details, customers, products and services, documents, manual payment records, settings and document images are saved in the server database associated with your account. This data is processed to provide the workspace and load your saved work on your other devices. Saving requires an internet connection. While the page is open, the editor holds a working copy in memory; it does not maintain a persistent offline document cache.
Images, PDF and QR
Background removal, PDF generation and payment QR generation run on your device. Images you add to the workspace, including originals retained for restoring a signature or stamp, are stored with your account when saved. The app does not send these images to an external background-removal service. Downloaded PDF files are held on your device or wherever you choose to share them. Invocket does not initiate the payment represented by a QR code.
Product analytics
Invocket records registration, sessions, screen views, action types, use of search and filters, document creation, deletion, sharing, PDF downloads, printing and creation of catalogue, customer or payment records. Usage events can include account and workspace references, time, interface language, broad device class and acquisition information such as UTM source, medium, campaign and referral host.
The app excludes invoice amounts, customer names, addresses, bank details, item names, notes, document contents and typed search queries from these event payloads. Document references used for internal event correlation are workspace-scoped hashes. Authorized administrators can view account and usage information to operate and improve the service.
Google Tag Manager
After you allow optional analytics, the production site loads Google Tag Manager and its configured measurement tags. Before that choice, the container is not loaded; admin and sign-in pages are excluded. The app supplies fixed event names and limited attributes such as document type, language and device class; its event bridge does not supply account emails, document numbers, amounts or document contents. Data collected by tags depends on the tags configured in the container. Google's handling of data is described in the Google Privacy Policy.
Microsoft Clarity
With your analytics permission, Microsoft Clarity records page interactions, clicks, scrolling, device/browser information and page addresses to help us understand usability problems. Workspace text and images are explicitly masked, including document previews, bank details, signatures and stamps. Payment QR codes are rendered as masked images. We do not call Clarity's Identify API or attach your account details to recordings. Recording is suspended while a document is printed.
You can allow or decline analytics and change your choice using Cookie settings in the app Settings or the preference button on this page. Your choice is stored in this browser for up to 180 days. Declining stops Clarity recording and removes its first-party cookies; it does not delete previously collected recordings. Advertising storage permission is denied. These preferences do not affect sign-in, saving documents or the internal service analytics described above. Other tags in the GTM container must also respect consent. See the Microsoft Privacy Statement.
Feedback and support
When you submit feedback, Invocket stores the message, any attached photo, interface language, submission time and account/workspace reference. Authorized administrators can read these together with your account name and email to handle the request. Message text and photos are not included in product analytics. An administrator can remove an attached photo while retaining the message. Account deletion removes the account's feedback, attached photos and beta-invitation record.
Cookies and browser preferences
A session cookie keeps you signed in for up to 30 days, with its lifetime renewed as you use the service. Language and region preferences and a session marker for usage counting may also be held in the browser. A first-visit attribution cookie lasts up to 90 days. Clearing browser data can sign you out or reset preferences; it does not delete saved account documents. Signing out ends the current authenticated session.
Hosting and security
Hostinger provides the hosting and database infrastructure. The service uses HTTPS on its production domain, authenticated sessions, workspace membership checks, CSRF protection for account changes and security audit records. Hosting systems may keep technical request logs.
Retention and deletion
Account and workspace data is retained while the account exists. You can export a workspace backup and delete the account from Settings. Deletion removes the account, its owned workspace and related feedback from the active database. Other sessions lose access to the deleted account. Technical usage and audit records may remain with their user and workspace references detached. Copies you downloaded or shared are not deleted by deleting your Invocket account. Hosting backups, where enabled, follow the hosting backup schedule.
Your choices and requests
You can edit your workspace, export a backup, sign out and delete your account in Settings. For questions or requests concerning access, correction, deletion, portability or an objection to data processing, use the support contact above. You may also contact the data protection authority responsible for your jurisdiction.
Changes
This page is updated when the service's data handling changes. The date above identifies the current revision.