Privacy Policy
Last updated: 19 October 2026
This Privacy Policy explains how InvoiceDrop ("InvoiceDrop", "we", "us" or "our") collects, uses and protects personal data when you visit invoicedrop.net, join our waitlist, contact us or use the InvoiceDrop service (together, the "Service"). It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) as applied in Cyprus and the UK GDPR.
1. Who we are
InvoiceDrop is based in the Republic of Cyprus and is the controller of the personal data described in this policy, except where section 6 says otherwise. For any privacy question or request, contact us at info@invoicedrop.net.
2. The personal data we collect
When you join the waitlist
- your full name, business name and email address;
- if you choose to give them, the accounting software you use, the number of documents you process each month and any comments or questions;
- the language of the page you used and the date and time you joined.
When you contact us
Your email address, name and anything you include in your message.
When you visit the website
Technical information such as your IP address, browser type, device information and the pages you request. This is used to deliver the website, keep it secure and prevent abuse. For example, we limit how often forms can be submitted from one IP address, and we use a bot-protection service to check that a form is being submitted by a person rather than a bot.
When you use the Service
Once the Service launches, we will also process account details (such as name, email and login information), usage information, and the documents you upload and the data extracted from them (see section 6).
We do not use analytics or advertising trackers on the website, and we do not intentionally collect sensitive information such as health data, biometric data or government identification numbers.
3. How and why we use it
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Adding you to the waitlist, sending a confirmation email, and telling you about early access and the launch | Steps you asked us to take before a possible contract, and our legitimate interest in responding to your request |
| Using the information you share (such as software and volumes) to decide which features and formats to build first | Our legitimate interest in developing a useful product |
| Replying to your messages and questions | Our legitimate interest in responding to enquiries |
| Providing the Service and managing your account | Performance of our contract with you |
| Keeping the website and Service secure, preventing spam and abuse, and fixing problems | Our legitimate interest in protecting the Service and its users |
| Keeping records and responding to authorities where required | Compliance with legal obligations |
We will only send you marketing beyond waitlist and launch updates if the law allows it or you have agreed, and every such email will let you opt out. We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We do not sell your personal data. We share it only with service providers that help us run the Service, who may use it only on our instructions:
- Cloud hosting provider – hosting the website and storing data, in the EU;
- Email delivery provider – sending confirmation and service emails, in the EU;
- Bot-protection provider – checking that our forms are submitted by people rather than bots;
- Content delivery networks – delivering fonts and style files to your browser, which means they receive your IP address;
- when the Service launches, providers of document processing and customer support, which we will add to this policy before we use them.
We may also disclose personal data if the law requires it, to protect our rights or the safety of others, or to a buyer or successor if the Service is sold or reorganised, in which case this policy will continue to apply.
5. International transfers
We store waitlist and service data in the European Union. Some of our providers, such as our bot-protection provider and content delivery networks, may process data in the United States or other countries. Where personal data is transferred outside the EU or UK, we rely on adequacy decisions (such as the EU-US Data Privacy Framework and its UK extension) or Standard Contractual Clauses, together with any additional safeguards needed.
6. Documents you upload to the Service
Invoices and receipts you upload may contain personal data about other people, such as your clients, their suppliers or their staff. For that data, you (or your client) are the controller and InvoiceDrop acts as your processor. We process it only to provide the Service to you and on your instructions, keep it confidential and secure, and delete it when you delete it or your account closes, unless the law requires us to keep it. Data processing terms setting this out will be available to customers when the Service launches.
7. How long we keep it
- Waitlist details: until the Service launches and for up to 12 months afterwards, or until you ask us to remove them, whichever is sooner;
- Emails and enquiries: for as long as needed to deal with them, and then for up to 2 years;
- Account records: for as long as your account is open, and then for as long as the law requires;
- Technical and security logs: for a short period, unless needed to investigate a security incident.
8. How we protect it
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, and limits on who can access data. No system is completely secure, but if a data breach affects you and the law requires it, we will notify you and the relevant authorities.
9. Cookies
We only use cookies and similar technologies that are strictly necessary for the website to work, such as a security cookie that protects our forms against cross-site request forgery, and the technical signals our bot-protection provider needs to detect bots. We do not use advertising or analytics cookies, so we do not show a cookie banner. If we add any non-essential cookies in future, we will ask for your consent first where the law requires it.
10. Your rights
EU, Cyprus and UK
You have the right to access your personal data, have it corrected or deleted, restrict or object to how we use it (including objecting at any time to direct marketing), receive it in a portable format, and withdraw any consent you have given. You also have the right to complain to a data protection authority. In Cyprus this is the Commissioner for Personal Data Protection (dataprotection.gov.cy); in the UK it is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to deal with your concern first.
Making a request
Email info@invoicedrop.net. We may need to verify your identity before acting on a request, and we will respond within the time the law requires (usually one month). You may also use an authorised agent where the law allows it.
11. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time, for example when the Service launches. We will post the new version on this page and change the "Last updated" date, so please check back from time to time.
13. Contact
Questions or requests about your personal data? Email us at info@invoicedrop.net.