Privacy Policy

Who we are

This notice explains how StitchInvoice handles personal data when you use our website, workspace, document tools, client portal, and billing and payment features. StitchInvoice is not currently structured as a registered company; we're working on formalizing that, and this notice will be updated once it is.

Who this notice covers

This notice covers website visitors, StitchInvoice account holders, and — where an account holder enters information about their own clients into the Service — the clients and recipients that information relates to.

Information you provide

Depending on how you use StitchInvoice, we may process:

• Account information: name, email address, and authentication identifiers
• Business information: business name, contact details, branding, and default settings
• Client and document information: client names, emails, addresses, line items, notes, and payment terms you enter
• Billing information: your subscription plan, billing interval, and payment status
• Anything you send us directly, such as a support request

Information about your clients

If you use StitchInvoice to send documents to your own clients, you decide what information to enter about them and why. In that relationship, you are typically the controller of your clients' personal data, and StitchInvoice processes it on your behalf to provide the Service — for example, rendering a document or sending a portal link. Whether this framing applies exactly this way can depend on the law that governs your business specifically.

Payment information

Card and payment details are entered directly on Stripe's hosted payment page and are processed by Stripe, not StitchInvoice. StitchInvoice does not receive or store full card numbers. We may receive payment status, identifiers, amounts, currency, and similar metadata needed to keep your invoice and payment records accurate.

Automatically collected information

We may process IP address, browser and device information, request and error logs, timestamps, and usage events needed to operate and secure the Service, along with the authentication session information described in the Cookies section below.

How we use information

We use personal data to:

• Provide StitchInvoice and authenticate users
• Create, render, and deliver documents and client portals
• Process subscription billing and connected-account payments
• Send transactional emails, such as a sent document or a payment receipt
• Detect abuse and secure the Service
• Provide customer support and troubleshoot problems
• Improve reliability and product functionality
• Comply with legal obligations

Lawful bases (EEA/UK users)

Where the UK or EU GDPR applies, we rely on performance of a contract to provide the Service you signed up for, legitimate interests for things like securing the Service and preventing abuse, legal obligation where the law requires it, and consent only where we genuinely ask for it. We don't rely on consent as the basis for processing that a contract or legitimate interest already covers.

Sharing and service providers

We share personal data with the service providers that help run StitchInvoice: Stripe for payments, Clerk for authentication, Supabase for our database, Resend for transactional email, and Vercel for hosting and analytics. They receive only what they need to provide their service to us. We do not sell personal data.

International transfers

Some of our service providers may process data outside the country you're in. Where that requires a safeguard under applicable law, we rely on the mechanisms those providers make available.

How long we keep data

We keep account and workspace information while it's needed to provide the Service, plus any period required for legitimate operational, accounting, or legal reasons. If you delete data or close your account, some information may remain briefly in backups or where we're required to retain it.

Security

Sign-in is handled by Clerk; StitchInvoice does not store your password directly. Traffic is encrypted with TLS. Business and client data is scoped to your workspace at the database and application level. Client portal links use a 256-bit token, and only a one-way hash of that token is stored, never the token itself.

No online service can guarantee absolute security. See our Security page for more detail.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to receive a portable copy of it, to withdraw consent where we rely on it, and to complain to your local data-protection authority. Some of these are subject to legal conditions and exceptions.

Requests involving a business's clients

If StitchInvoice holds your data only because a business you deal with entered it into their account, we may direct your request to that business, or help them respond to it directly.

Automated processing

StitchInvoice does not make solely automated decisions that produce legal or similarly significant effects about individuals. Features like Payability Check and Payment Intelligence are rule-based recommendations built from the data in your own account, intended to assist your judgment, not replace it.

Cookies

StitchInvoice uses only the storage needed to run the Service. Clerk sets strictly necessary session and security cookies so you can sign in and stay signed in. A small local-storage flag remembers that you've dismissed the cookie notice. We use Vercel Analytics and Speed Insights to understand aggregate usage and performance; as configured here, they do not use tracking cookies or build cross-site profiles.

We do not use advertising or marketing cookies. You can block or delete cookies in your browser settings, though this may prevent you from signing in.

Children's privacy

StitchInvoice is a business tool and isn't directed at children. We don't knowingly invite children to create an account.

Changes to this notice

We may update this notice as the Service or applicable requirements change. The date above shows the current version, and we'll provide notice of material changes where required.