Privacy Policy

Summary

This Privacy Policy explains how FlexInvoice collects, uses, shares, and keeps Personal Information. FlexInvoice is operated by Corey J. Mahler, an individual (“we,” “us,” or “our”). This Privacy Policy is part of our Terms of Service, and words defined there, such as Merchant, Client, Client Data, and Client Portal, have the same meaning here.

In short, we hold information about Merchants and their staff, which we control, and Client Data, which we hold on behalf of the Merchant that entered it. For Client Data, the Merchant decides what to collect, and Client requests go to the Merchant first.

We do not sell Personal Information or use it for advertising. We use a small set of service providers to run FlexInvoice: Stripe for payments, Mailgun for email, DigitalOcean for hosting, and Cloudflare for content delivery and security. We also use Cloudflare to store backups.

There is no in-app way to delete a Merchant account or Client records. Deletion is requested by mail, and Clients go through their Merchant first. Deleted information may remain in our backups for a period after deletion.

We use only functional cookies. We have no analytics or advertising cookies.

This summary is for convenience. The full Privacy Policy below controls.

1. Who This Policy Covers and Our Role

Merchants and Merchant Users. For information about Merchants, their owners, and their staff, we decide how the information is used, and this Privacy Policy describes our practices.

Clients. When a Merchant uses FlexInvoice to bill you, the Merchant decides what information about you to collect, enter, and keep, and how to use it. We store and process that Client Data on the Merchant’s behalf, following its instructions, as its service provider. The Merchant’s own privacy practices govern its use of your information. If you have questions or requests about your information, please contact the Merchant first.

Visitors. If you only visit the Site, we receive the limited technical information described in Sections 4 and 7.

2. Information About Merchants and Merchant Users

Account details. When a business signs up, we collect the business name, the owner’s name, email address, and password, and the business’s timezone and country. When an owner invites staff, we collect each staff member’s name and email address. We store passwords only as salted one-way hashes.

Business settings and records. We store the settings and records a Merchant creates, such as charge days, late-fee settings, catalog items with prices and costs, recurring templates, invoices, and payments.

Capacity Subscription. If a Merchant subscribes to Capacity, Stripe creates a customer record on our Stripe account with the owner’s email address and the business name. We store the Stripe customer and subscription identifiers, subscription status, trial dates, discounts, and purchased capacity. Card details are entered on Stripe’s pages and stay with Stripe. We store only Stripe identifiers, not card details.

Stripe Connect. To accept card payments, a Merchant connects a Stripe account. Identity, tax, and bank details for onboarding are given directly to Stripe, and we do not store them. We store the Connected Account identifier and whether it is ready to accept charges.

3. Client Data We Hold for Merchants

Merchants and, in the Client Portal, Clients enter and generate the following Client Data, which we hold on the Merchant’s behalf.

Contacts and addresses. Client names, email addresses, phone numbers, and billing addresses; property labels and service addresses; and notes the Merchant writes about Clients and properties.

Billing records. Recurring templates, invoices and line items, payments (card, check, cash, other, and credit) and refunds or reversals of them, with any payment or refund notes, Client Credit, late fees, and each Client’s charge-day and automatic-charge settings. For card refunds, we also store the Stripe payment and refund identifiers and, if a refund fails, the reason Stripe gives.

Property history. Service and maintenance events tied to each property, with a title, notes, the date performed, and the related invoice and catalog item. Merchants see this history in the app, and Clients see it in the Client Portal.

Portal logins. A login record with the Client’s name and email address. Clients sign in with single-use email links that expire after 30 minutes, and we store only a one-way hash of each link.

Profile revisions. Whenever a Merchant edits or archives a Client, or a Client updates the profile in the Client Portal, we save a copy of the earlier details (name, email address, phone, billing address, notes, and billing preferences) so the Merchant can see what changed. Editing a Client profile keeps these prior versions, and they are kept as long as the Client record exists.

Card setup through Stripe. When a Client saves a card in the Client Portal or pays a balance, the card details are entered on a Stripe-hosted page, and the card data stays with Stripe on the Merchant’s Connected Account. To set this up, we send Stripe the Client’s name, email address, billing address, and service address. FlexInvoice stores only Stripe identifiers, such as Stripe’s customer identifier, and never card numbers, expiration dates, or security codes.

The Merchant decides which Clients to add and what to enter about them. We do not use Client Data for our own purposes, except as needed to operate, secure, and back up the Service, or to comply with the law.

4. Logs and Records the Service Keeps

Email send log. For every email the Service sends, such as invoices, coming-up reminders, sign-in links, password resets, staff invitations, and welcome messages, we record the kind of email, the recipient’s email address, the time, the Merchant, and the related invoice when there is one. Merchants can view their log in the app as the Email Log. We use it to show sending history and to apply email allowances and limits.

Activity log. For each Merchant, we keep a log of actions on invoices, recurring templates, and capacity, such as creating, charging, voiding, or emailing an invoice, recording a payment, refunding a payment, adding or removing incidentals, pausing or resuming a template, and raising capacity. Each entry records which Merchant User acted, when, and a short summary that may include a Client’s name, an invoice amount, or the email address an invoice was sent to.

How long logs are kept. Email send log entries are deleted automatically 7 years after they are recorded. Activity log entries are also deleted automatically after 7 years, except entries the Service still needs to operate: card charge attempts, which help prevent a card from being charged twice; reviews of unexpected card payments and how they were resolved; and changes to a recurring template’s status, such as pausing, resuming, ending, or restarting it, which also affect billing. Those entries are kept for as long as the Merchant’s account exists. Sign-in, password-reset, and staff invitation links are deleted 30 days after they expire. Deletion runs on a regular schedule, so an entry may remain for a short time after it reaches these limits. Anything still held is deleted with the account when the Merchant asks us to delete it, as described in Section 8. Entries made by a staff member who is later removed stay in the activity log without a link to that person’s login.

Server and network information. FlexInvoice does not record IP addresses or browser information in its database. Cloudflare and our hosting server process IP addresses and browser information to deliver and protect the Site, and Cloudflare handles that information under its own practices. Our server also keeps application error logs, which can include details of a failed action, until the server’s system log rotates them out.

5. How We Use Information

We use information only to provide FlexInvoice: to run accounts; to create, send, and collect invoices on each Merchant’s instructions; to run the Client Portal; to send transactional email; to bill the Capacity Subscription; to apply plan and email limits; to provide support; to keep the Service secure, investigate errors and abuse, and make backups; to comply with the law; and to enforce our Terms.

We do not use Personal Information for advertising, and we do not build marketing profiles. We may count records, such as the number of Merchants or invoices, to operate and plan the Service.

6. How We Share Information

We do not sell your information. We do not share it with other companies for their marketing, advertising, or other independent use.

Within the Service. Client Data is available to the Merchant that holds it, including its owner and staff. The Client Portal shows each Client its own invoices, payments, property history, and profile.

Operator access. As the operator, Corey J. Mahler can access accounts and data when needed for support, security, billing, backups, and legal compliance.

Service providers. We use the providers below to run FlexInvoice, and each receives only what it needs for its work.

Stripe processes card payments, Connected Accounts, Client card setup, the Capacity Subscription, and Manage Billing. Stripe receives Client names, email addresses, and addresses, and Merchant owner email addresses and business names. Stripe also uses information under its own privacy policy, for example to verify accounts and prevent fraud.

Mailgun delivers the Service’s transactional email from its United States region. It receives recipient email addresses and the content of each email, which for invoices can include the Merchant’s name, the Client’s name and addresses, line items, amounts, and links.

DigitalOcean hosts the single server, in the United States, that runs FlexInvoice and its database. We use no other DigitalOcean services.

Cloudflare proxies flexinvoice.us for content delivery, encrypted connections (TLS), and security. It processes IP addresses, browser information, and the pages and data sent between your browser and the Site. We also store backup copies of the database in Cloudflare’s R2 object storage service. We encrypt each copy before it leaves our server, and R2 also encrypts stored data at rest.

Our backups are kept on systems we control and with Cloudflare, as described in Section 8.

Legal and safety. We may disclose information if the law requires it, or to protect the Service, our users, or the public from fraud or serious harm.

Business transfer. If FlexInvoice is transferred to a successor or to a business entity formed to carry it on, information may be transferred with it, and this Privacy Policy will continue to apply until it is changed as described in Section 13.

7. Cookies

FlexInvoice uses only functional cookies that the Service needs to work. We do not use analytics, advertising, or tracking cookies, and our pages do not load third-party analytics or advertising scripts.

fi_session keeps you signed in to FlexInvoice. It holds a signed token that identifies your login, including your name, email address, and role. It lasts 30 days and is removed when you sign out. It is set only for flexinvoice.us, cannot be read by page scripts, and is sent only over secure connections.

fi_flash carries a one-time status message, such as a confirmation that your changes were saved, to the next page. It lasts 30 seconds and is removed once the message is shown.

Stripe’s pages for payments, card setup, Manage Billing, and Stripe onboarding are on Stripe’s own site, where Stripe sets its own cookies under its own policy. Cloudflare may set cookies it needs to protect the Site, under its own policy.

Because these cookies are needed for the Service to work, we do not ask for consent to them. If you block them, you will not be able to sign in. We do not track visitors across websites, so Do Not Track and Global Privacy Control signals do not change anything here.

8. Retention, Backups, and Deletion

How long we keep information. Except as described in Section 4, we keep account information and Client Data for as long as the Merchant’s account is open, and afterward as needed for billing, security, disputes, and legal obligations.

Archiving and deleting in the app. Clients and properties are archived, not deleted. Archiving hides them from active lists but keeps their records, and Client profile edits keep prior versions, as described in Section 3. Merchants can delete unbilled maintenance events, catalog types, recurring template lines, upcoming incidentals, and incidental lines on an invoice. An owner can remove a staff member, which deletes that person’s user record. There is no self-serve way to delete a Merchant account or Client records.

Backups. We regularly back up the full database. Deleted information may remain in our backups for a period after deletion. Daily backup copies in Cloudflare’s R2 are kept for 35 days. All other backup copies, wherever they are stored, are kept for up to 7 years for record-keeping and disaster recovery, and are then deleted. Backups are stored on systems we control and in Cloudflare’s R2 object storage service, and we encrypt each copy before it leaves our server. We do not use backups for any other purpose. If we ever restore from a backup, we will take reasonable steps to re-apply deletions made after the backup was taken.

How to request deletion. Because there is no in-app way to delete a Merchant account or Client records, Merchants can request deletion of their account, including its email send log and activity log, or of specific Client Data by writing to us at the address in the Contact Us section. We will confirm the request with the account owner, using the contact details on the account, before acting on it. After we delete the information, it ages out of our backups over time.

Clients. If you are a Client, please ask the Merchant first. The Merchant can correct or archive your details and can ask us to delete them. If you write to us directly, we will refer your request to the Merchant and act on the Merchant’s instructions, unless the law requires otherwise.

What may remain. After deletion, we may keep information the law requires us to keep or that we need to resolve disputes or enforce our Terms. Stripe and Mailgun keep their own records under their own policies, and copies may remain in our backups for a period, as described above.

9. Your Choices and Rights

Access and correction. Merchants can view and edit most of their information in the app, and can export invoice records and property history as CSV files. Clients can view their invoices, payments, and property history in the Client Portal and can update their name, phone, and billing address there. For other changes, Clients should contact the Merchant.

Requests. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your Personal Information. We will also consider requests from anyone, as a goodwill practice and not as a legal obligation. Send requests by mail to the address in the Contact Us section. We may need to verify your identity, and we will respond within the time the law requires. Requests about Client Data are referred to the Merchant as described in Section 8.

Email. Transactional email is part of the Service and continues while an account is active. Coming-up reminders are off unless the Merchant turns them on. Clients who want fewer emails should contact the Merchant.

10. Security

We use reasonable safeguards, such as encrypted connections, hashed passwords and sign-in links, cookies that page scripts cannot read, and access controls that keep each Merchant’s data separate. No method of storage or transmission is completely secure, so we cannot guarantee security. If a breach affects Personal Information, we will notify affected Merchants, and others as the law requires.

11. Children

FlexInvoice is for businesses and adults and is not directed at children under 13. You must be at least 18 years old, or the age of majority where you live if that is higher, to use FlexInvoice. We do not knowingly collect Personal Information from children under 13. If you believe a child has given us information, please write to us and we will delete it.

12. Where Information Is Processed

FlexInvoice is operated from the United States and is intended for businesses in the United States. Our server and database are in the United States, and Mailgun sends our email from its United States region. Stripe and Cloudflare may also process information in other countries where they operate.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated policy at flexinvoice.us/privacy and change the version number and the Effective Date. If a change is material, we will give reasonable advance notice, such as by email to Merchant owners or a notice in the Service, before it takes effect.

Contact Us

FlexInvoice is operated by Corey J. Mahler, PO Box 296, Townsend, TN 37882.

Questions about the Terms of Service or the Privacy Policy, legal notices, arbitration opt-out notices, and privacy requests can be sent by mail only, to Corey J. Mahler at PO Box 296, Townsend, TN 37882.