Privacy Policy (GDPR)
Effective: 21 September 2026
English convenience translation — the Czech original (Zásady zpracování
osobních údajů) prevails in case of any discrepancy.
This policy describes how Invico processes personal data. We write it in plain language; if anything is unclear, write to [email protected].
1. Who is the controller
The controller of personal data is the service operator:
Tomáš Dvořák, registered office Kostelany nad Moravou 108, 686 01,
Czech Republic, Registration No. (IČO) 24330621, registered in the Trade
Licensing Register (sole trader)
e-mail: [email protected]
(the "controller").
2. Two processing roles — the distinction matters
a) Your data (service user). For your account data (e-mail, name, company details, settings) the controller is the Invico operator.
b) Your clients' data (document content). You enter personal data of your customers and suppliers into documents (names, addresses, registration/VAT IDs, contacts). You are the controller of that data — Invico acts as a processor on your behalf. That relationship is governed by a separate Data Processing Agreement (DPA). Responsibility for informing your clients rests with you.
3. What data we process (as controller)
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Identification & contact | e-mail, name, password (hash only) | account creation & management, sign-in | contract |
| Company data | registration no., VAT ID, address, bank account, document series | issuing documents, records | contract |
| Document & expense content | documents, items, attachments, notes | providing the service | contract |
| Technical data | IP address, access logs, document events | security, audit, abuse prevention | legitimate interest |
| Consent records | terms version, time granted, IP address, e-mail | consent demonstrability per Art. 7(1) & 5(2) GDPR | legitimate interest |
| Subscription payment data | payment confirmation, card identification (last digits, brand) | subscription billing | contract |
| Communications | e-mails to support | user support | legitimate interest |
Providing personal data is a contractual requirement for creating an account; without data marked as mandatory the contract cannot be concluded nor the service provided (Art. 13(2)(e) GDPR).
Transactional and commercial e-mails. Operational (transactional) e-mails — registration confirmations, subscription documents, renewal notices, payment demands and security alerts — are sent as part of contract performance and cannot be declined without cancelling the account. Commercial messages (news, tips) are sent only to existing customers based on legitimate interest under Section 7(3) of Czech Act No. 480/2004 Coll., or on consent; every such e-mail contains a working link for immediate unsubscribe.
4. What we record on public links and e-mails
For the public document link we record events (view, payment intent, PDF download) including time and technical metadata. Document e-mails a user sends through the service may contain a technical pixel signalling that the message was opened — only the fact and time of loading is recorded, never the content or the recipient's behaviour. These data serve the user for document status tracking and proof of delivery. We inform the recipient about the recording **directly on the public-link page and in the e-mail footer**; the user is additionally obliged to disclose it to the document recipient.
The optional reply detection (IMAP) feature accesses only the user's own mailbox — it reads exclusively the headers of unread messages (never their content), marks processed messages as read, and deletes or sends nothing. A detected client reply is recorded as an event on the corresponding document. Mailbox credentials are stored within the user's account settings.
5. Recipients and data transfers
Personal data is transferred only to the necessary extent:
- Hosting and infrastructure provider — OVHcloud (OVH SAS, https://www.ovhcloud.com/), EU region Poland (Warsaw),
- Payment gateway — Stripe Payments Europe, Ltd. (Ireland, EU) processes subscription payment data (card data is entered by the user directly in the gateway's form; we keep only the confirmation and card identification). Any transfer to the US takes place under standard contractual clauses or the EU-US Data Privacy Framework (Art. 45/46 GDPR),
- E-mail infrastructure — transactional e-mail sending (sign-in links, reminders) goes through the SMTP server configured by the user; for account system e-mails we use Resend (Plus Five Five, Inc.; EU data region),
- Public authorities — only to the extent required by law (in particular cooperation duties towards the tax administrator under §§ 57 and 58 of the Czech Tax Code). We verify the entitlement of every request before disclosing data.
Personal data is not transferred outside the EU/EEA, **except for transfers connected with Stripe payments** — those are covered by safeguards under Art. 45/46 GDPR.
6. Retention periods
- Account data — for the life of the account; after cancellation deleted or anonymised within 90 days, unless the law requires longer.
- User-entered content (documents, contacts, records) — we process it as a processor; after the account ends the user exports it and we then delete the copies under the DPA. The duty to retain tax documents after the account ends belongs to the user, not to us.
- The operator's own accounting documents (subscription invoices) — retained for the statutory period (10 years under the accounting act and tax code deadlines).
- Logs and audit events — typically 12 months, unless a longer period is needed (security incident).
- Backups — 30-day rotation, then overwritten.
7. Your rights
You have the right to:
- access your data and receive a copy,
- rectify inaccurate data (also directly in the app),
- erasure — to the extent not blocked by statutory retention periods for data we hold as controller (the operator's own accounting documents),
- restriction of processing and portability of data in a structured format (exports are part of the service),
- object to processing based on legitimate interest,
- withdraw consent — without affecting the lawfulness of prior processing,
- lodge a complaint with the Czech Data Protection Authority — ÚOOÚ, Pplk. Sochora 27, 170 00 Prague 7; data box:
qkbaa2n; e-mail: [email protected]; www.uoou.gov.cz. (EU users may also complain to their local supervisory authority.)
Exercise your rights at [email protected]. We respond typically within 30 days.
8. Security
- TLS encryption in transit, passwords stored only as bcrypt hashes,
- data access bound to sessions and roles, tenant data isolation,
- API keys stored as hashes, HMAC-signed webhooks,
- audit log of document events,
- database and storage backups.
9. Cookies and local storage
See the separate Cookie Policy. The service uses only essential technical cookies/storage (session, appearance preferences) — exempt from consent under Section 89(3) of Act No. 127/2005 Coll. Analytics tools will be introduced only with a consent mechanism.
10. Policy changes
We announce material changes by e-mail and in the app; a new version requires consent confirmation (in-app consent versioning). Version legal-v2.