This Privacy Policy explains how Ekspose BV ("we", "us", "our"), the company behind Invoice Grabber, collects, uses, shares, and protects personal data when you use the website invoice-grabber.com, the Invoice Grabber web application, the Invoice Grabber Chrome extension, and related services (together, the "Service").

What Invoice Grabber does. Invoice Grabber is an invoice-collection tool for businesses and bookkeepers. It finds supplier invoices and receipts in the sources you connect (such as your Gmail inbox, Microsoft 365/Outlook mailbox, IMAP mailboxes, and supplier billing portals via our Chrome extension), extracts key invoice details (supplier, date, amount, invoice number), organises the invoices per company or ledger, and delivers them to the destinations you choose (for example your accounting software, a Google Drive folder, or Peppol e-invoicing).

1. Information We Collect

We collect only what we need to operate the Service.

1.1 Information you provide

• Account information: name, email address, company name, and VAT or company number
• Authentication data: login credentials or OAuth identifiers when you sign in with a third party
• Billing information: handled by our payment provider (Stripe); we do not store card details
• Invoices and documents you upload or forward to the Service
• Support communications you send us

1.2 Information collected automatically

• Log data: IP address, timestamps, device and browser information
• Usage data: features used and actions taken in the application
• Cookies and similar technologies for authentication and, with your consent, analytics

1.3 Data from services you connect

When you connect an external service (email, storage, accounting software, billing portals), we access only the data needed to perform the function you requested. The way we handle Google user data is described in detail in section 2.

2. Google User Data (Gmail and Google Drive)

You can optionally connect your Google account to Invoice Grabber. This section explains exactly which Google data we access, why, and how it is handled.

2.1 Data we access

• Basic profile (openid, email, profile): your Google account email address, name and profile identifier, used to identify which Google account is connected to your Invoice Grabber account.
• Gmail (read-only, gmail.readonly): we search your mailbox for messages that contain invoices or receipts. For matching messages we read the message metadata (sender, subject, date) and download the invoice attachments (for example PDF or UBL/XML files). We never send, delete, modify, or label your emails.
• Google Drive (drive.file): if you choose Google Drive as a destination, we create an "Invoice-grabber" folder in your Drive and upload your collected invoices to it. This scope only gives us access to files and folders that Invoice Grabber itself created; we cannot see or access any other files in your Drive.

2.2 How we use Google user data

• To detect and collect invoices and receipts from your Gmail inbox
• To extract invoice details (supplier, invoice number, dates, amounts, VAT) from the collected attachments so they can be organised and searched in your Invoice Grabber account
• To deliver the collected invoices to the destinations you configure, such as your accounting software or your Google Drive folder
• To show you the collected invoices in your dashboard

We use Google user data only to provide and improve these user-facing features. We do not use it for advertising, we do not sell it, and we do not use it to build user profiles.

2.3 Sharing of Google user data

We share Google user data only:

• With the destinations you explicitly configure (for example your accounting software or bookkeeper), to deliver your invoices
• With our sub-processors that are needed to run the feature: our database and file-storage hosting provider (Supabase) and our document-recognition (OCR) provider, which extracts invoice details from attachments. These sub-processors act only on our instructions and under data-processing agreements.
• When required by law, or to protect the security of the Service and its users

We never transfer or sell Google user data to data brokers, advertisers, or information resellers.

2.4 Storage, protection and retention of Google user data

• OAuth access and refresh tokens are stored encrypted and are only used by our backend services
• Collected invoice files and extracted invoice data are stored encrypted at rest
• We store only the emails that contain invoices (their attachments and basic metadata); we do not keep a copy of the rest of your mailbox
• Collected invoices are kept for as long as your account is active, or until you delete them

2.5 Revoking access and deletion

You can disconnect your Google account at any time from the integrations page in Invoice Grabber, or from your Google Account at myaccount.google.com/permissions. When you disconnect in Invoice Grabber, we delete the stored tokens and stop accessing your Google data. You can delete individual invoices in the application, or request deletion of all your data by emailing support@invoice-grabber.com; we complete such requests within 30 days.

2.6 Google API Services User Data Policy (Limited Use)

Invoice Grabber's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only use Google user data to provide or improve the user-facing features described above
• We do not transfer Google user data to others except as needed to provide or improve those features, to comply with law, or as part of a merger or acquisition with your notice
• We do not use Google user data to serve advertisements
• No human reads your Google user data unless you give us explicit permission (for example for a support request), it is necessary for security purposes, or it is required by law
• We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine-learning models

3. How We Use Data

We use personal data to:

• Provide and operate the Service
• Authenticate users and secure accounts
• Collect, process, and deliver invoices and documents as instructed by you
• Improve product performance and reliability
• Communicate about service updates or support requests
• Meet legal and compliance obligations

We do not sell your data.

4. Legal Basis (GDPR)

We process data based on:

• Contractual necessity (providing the Service)
• Legitimate interest (security, product improvement)
• Consent (where required, e.g. optional integrations such as Gmail and analytics cookies)
• Legal obligation (for example accounting and tax law)

5. Data Sharing

We share data only with:

• Infrastructure and hosting providers (database, file storage, servers)
• Document-recognition (OCR) providers that extract invoice data
• Analytics and error-monitoring tools
• Payment processors
• Third-party integrations explicitly enabled by you

All processors are bound by confidentiality and data-processing agreements.

6. Data Retention

We retain personal data only as long as necessary:

• Account data and collected invoices: while your account is active, or until you delete them
• Integration tokens: until you disconnect the integration or delete your account
• Logs and usage data: limited retention for security and diagnostics
• Legal or billing data: as required by law

You may request deletion at any time, subject to legal constraints.

7. Security

We implement industry-standard security measures:

• Encryption in transit (TLS) and at rest
• Access controls and least-privilege principles
• Regular monitoring and auditing

No system is 100% secure, but we take security seriously.

8. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict or object to processing
• Data portability
• Withdraw consent, including disconnecting any integration
• Lodge a complaint with your data-protection authority

Requests can be sent to support@invoice-grabber.com.

9. International Transfers

If data is transferred outside the EEA, we use appropriate safeguards such as standard contractual clauses.

10. Cookies

We use cookies for:

• Authentication
• Essential functionality
• Analytics (optional, where applicable)

You can control cookies via your browser settings.

11. Children

The Service is intended for businesses and is not directed at children under 16.

12. Changes

We may update this policy from time to time. Material changes will be communicated via the Service.

13. Contact

Ekspose BV
support@invoice-grabber.com