Data Protection & GDPR / CCPA

Privacy & Data Protection Policy

Version 2.4 — Last updated: September 2026

Privacy Index

Legal Center

→ Terms of Service ✓ Privacy Policy (Current) → Refund Policy → Cookie Policy
Privacy Assured

We never sell or share commercial data. Contact: [email protected]

Privacy Pledge: At Fast Invoice, we deeply respect the confidentiality of contractors, tradespeople, and independent business operators. Our architecture adheres strictly to Privacy by Design principles in full alignment with the European Union General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and international privacy frameworks.

1. Data Controller & Privacy Commitment

This Privacy Policy details the data handling practices conducted through Fast Invoice (available via fastinvoice.online, referred to as "Fast Invoice", "we", "us", or "our").

We are committed to processing personal data fairly, lawfully, and transparently for the sole purpose of operating our estimating and invoicing software, without monetizing, reselling, or leasing commercial client databases.

2. Privacy Roles: Data Controller vs. Data Processor

Under GDPR and comparable privacy laws, our legal responsibilities fall into two clear distinctions:

  • Fast Invoice as Data Controller: We determine the purposes and means of processing for our registered users' account registration, subscription billing, and technical telemetry data.
  • Fast Invoice as Data Processor: For the personal and business data of end clients entered by contractors onto estimates, invoices, and digital signature records, the contractor acts as the Data Controller, and Fast Invoice functions strictly as a Data Processor, executing tasks solely to compile, deliver, and host documents on the contractor's explicit behalf.

3. Categories of Personal Data We Collect

We collect only the data strictly necessary for system execution and legal documentation:

Category Specific Data Points Source / Collection Method
Contractor / User Data Full name, business trade name, email, phone/WhatsApp, physical business address, corporate logo, and optional tax identification (EIN/VAT). Provided directly by the merchant during account sign-up and business profile configuration.
Client Records Recipient client name, company name, billing/shipping address, itemized goods/services, project scopes, amounts, and tax totals. Inputted directly by the contractor when generating quotes, estimates, and invoices.
E-Signature Metadata Handwritten digital signature stroke vector, exact UTC timestamp, and the signer's network IP address. Recorded automatically when the end client signs an estimate or receipt via the online portal view.
Financial & Billing Data Gateway customer ID, subscription token, card brand, last 4 digits, expiration month/year, and country code. Securely captured and tokenized via Stripe and Paddle (Fast Invoice never stores raw credit card numbers).
Technical & Telemetry Data IP address, browser type and version, operating system, preferred language, server request logs, and technical session cookies. Collected automatically via standard web server logs and HTTP header protocols.

4. Legal Bases for Processing (GDPR Article 6)

We process personal data under the following legitimate grounds:

  • Contractual Necessity (Art. 6.1.b GDPR): Required to administer your account, render downloadable PDF invoices, deliver customer portal views, and fulfill paid subscriptions.
  • Compliance with Legal Obligations (Art. 6.1.c GDPR): Mandatory retention of transaction logs, financial accounting books, and statutory tax compliance.
  • Legitimate Interests (Art. 6.1.f GDPR): Protecting system integrity, preventing fraudulent abuse, mitigating security vulnerabilities, and refining software performance.
  • Consent (Art. 6.1.a GDPR): When you explicitly consent to non-essential cookies or specific opt-in updates.

5. Purposes of Data Processing

Your information is utilized exclusively for:

  • Generating, editing, converting to PDF, and emailing professional estimates and invoices.
  • Powering interactive public web links where clients view invoices and execute digital signatures.
  • Authenticating user access, verifying credentials, and securing user sessions.
  • Executing subscription billing cycles and managing plan entitlements via authorized payment channels.
  • Dispatching mission-critical system alerts, billing receipts, and password reset communications.

6. Payment Processing & PCI-DSS Financial Security

All financial transactions are managed by certified PCI-DSS Level 1 payment gateways: Stripe Inc. and Paddle.com Market Ltd.

Zero Cardholder Storage: Payment checkouts communicate directly with gateway servers through encrypted iframes and tokenization. Fast Invoice does not collect, view, or retain raw credit or debit card numbers, expiration dates, or CVV security codes on our application servers.

7. Authorized Sub-processors & Third-Party Service Providers

To ensure dependable service availability, we engage reputable infrastructure providers who operate under Data Processing Agreements (DPAs):

  • Payment Infrastructure: Stripe Inc. (US) and Paddle.com Market Ltd. (UK/US).
  • Email Delivery: Mailgun Technologies Inc. (US) for delivery of transactional invoice dispatch and alerts.
  • Cloud Hosting & Data Centers: ISO 27001-certified enterprise server facilities equipped with continuous perimeter defense and firewall protections.

8. Cookies & Local Storage Technologies

We utilize essential cookies required for session stability, CSRF attack prevention, and remembering language selections.

For an itemized table of all cookies, storage durations, and guidance on configuring your browser preferences, please review our dedicated Cookie Policy.

9. International Data Transfers

Fast Invoice server infrastructure operates primarily within the United States and the European Union. Whenever personal data from individuals residing in the EEA, Switzerland, or the UK is transferred across borders, we implement Standard Contractual Clauses (SCCs) adopted by the European Commission along with robust cryptographic encryption to safeguard data privacy.

10. Data Retention Schedules & Deletion

We preserve records only for the durations necessary to support the purposes outlined or fulfill statutory tax and bookkeeping requirements:

Data Category Retention Timeline Disposal Process
Account Profile & Settings Active duration of user account. Purged within 30 days upon confirmed deletion request.
Commercial Invoices & Estimates Active plan lifetime or up to 12 months post-cancellation to allow seamless reactivation. Permanently deleted after grace window or immediately upon formal erasure request.
Financial & Tax Transaction Logs 5 to 7 years in accordance with applicable fiscal regulations. Isolated in read-only audit archives until statutory expiration.
Security & Web Server Logs 90 days. Overwritten via automated rolling log retention cycles.

11. Your Statutory Privacy Rights (GDPR & CCPA/CPRA)

Depending on your location, you hold comprehensive rights over your personal data:

  • Access & Correction: You may request confirmation of whether we process your data and review or modify inaccurate information in your profile.
  • Right to Erasure ("Right to Be Forgotten"): You may request the deletion of your personal records where no overriding legal retention ground exists.
  • Data Portability: You may request a machine-readable copy of your commercial data records.
  • Restriction & Objection: You may object to or restrict processing operations under certain conditions.
  • California Rights (CCPA/CPRA): California residents have the right to know what personal information is collected, request its deletion, experience non-discriminatory service, and the explicit affirmation that Fast Invoice does not sell ("Do Not Sell") or share ("Do Not Share") your personal data.

To exercise any statutory right free of charge, email our Data Protection team at: [email protected]. We will respond within thirty (30) days.

12. Cybersecurity & System Safeguards

We maintain industry-grade technological, physical, and procedural security measures:

  • In-Transit Encryption: All traffic is encrypted using 256-bit TLS 1.3 / SSL encryption standards.
  • Password Hashing: User passwords are encrypted using one-way adaptive Bcrypt hashing algorithms with unique cryptographic salts.
  • Redundant Backups: System records are backed up automatically in encrypted storage environments to defend against catastrophic hardware failure.
  • Access Controls: Granular administrative access controls enforcing the principle of least privilege across databases and hosts.

13. Children's Online Privacy (COPPA Compliance)

Fast Invoice is strictly intended for adult business owners, trade contractors, and commercial entities. We do not knowingly solicit or collect data from individuals under 18 years of age. If we learn of an unauthorized minor registration, we will take immediate steps to delete the account and associated records.

14. Updates to this Privacy Policy

We may amend this Privacy Policy to reflect enhancements in technology, service modifications, or evolving legal frameworks. Any revisions become effective upon posting, denoted by the "Last updated" date. Material changes impacting user rights will be highlighted through your registered email or dashboard notices.

15. Data Protection Officer (DPO) & Contact Desk

For inquiries, privacy questions, or data rights requests, please contact our dedicated Data Protection team:

Fast Invoice — Data Protection Office (DPO)

Website: fastinvoice.online

Direct Privacy Email: [email protected]

General Support: [email protected]