Privacy policy

Invoice Collector lets small businesses ("merchants") create invoices from WhatsApp, collect payment, and send reminders. This page explains what we collect, who handles it, how long we keep it and how to have it deleted.

Who is who

For merchants' own account data we are the controller. For the personal details of a merchant's customers (name, phone number, what they were invoiced for) the merchant decides why it is used and we process it on their behalf.

What we collect

• Merchant account: business name, email address, a password hash (never the password), WhatsApp phone number, country and currency.
• Payout details: the bank or mobile money provider, account holder name where the bank returns it, the account number (stored encrypted, we show only the last 4 digits) and the payment-provider sub-account code.
• Invoices and payments: customer name and WhatsApp number, amount, currency, description, due date, status, and payment references and amounts from Paystack. We never see or store card numbers.
• Messages: a log of WhatsApp messages (and SMS, if the optional fallback is on) sent or received through our business number: invoices, reminders, receipts, commands from merchants and replies from customers, with delivery status.
• Billing: your subscription plan, status and renewal date. Card details are handled by Dodo Payments.
• Technical: a session cookie that keeps you signed in, IP addresses for rate limiting and abuse prevention, and error reports. Our logs keep only the last 4 digits of phone numbers and no email addresses.

Who processes it (our providers)

• Paystack: customer payments and merchant payouts (sub-accounts).
• Meta (WhatsApp Business Platform): delivering and receiving WhatsApp messages.
• Dodo Payments: subscription billing, as merchant of record for our subscriptions.
• Resend: sending account emails (confirmation, password reset, notices).
• Twilio: SMS fallback, only if we have switched it on.
• Sentry: error monitoring, only if we have switched it on. It does not receive request bodies or cookies.
• Our hosting provider: the server and database the product runs on.

We do not sell personal data and we do not use it for advertising.

Reminders and opting out

Customers can reply STOP to any reminder to stop further reminders from that merchant. Reply START to turn them back on.

How long we keep it

• Account, invoice, payment and message data: while the account is open.
• After you delete your account: everything listed above is deleted straight away, and your subscription is cancelled. Backups are overwritten on their normal cycle.
• Login and email links: expire within an hour to a day and are cleared regularly. Rate-limit counters: about an hour.
• Records our payment providers keep under their own legal duties follow their policies.

Your choices

• Change your email, password and payout details, sign out of every device, and download your invoices and payments as CSV (Shop plan) in Settings.
• Delete your account from Settings. It removes your data as described above.
• Customers who want their details removed should contact the merchant who invoiced them or write to us.

Security

Traffic is encrypted in transit, passwords are hashed, account numbers are encrypted at rest, and webhooks from providers are signature-checked. No system is perfectly secure; tell us at once if you think your account is compromised.

Contact

Questions or deletion requests: support@kentehq.com.