Privacy Policy
Last updated: 2026-10-23
This Privacy Policy explains how Latent Software LLC, a Wyoming limited liability company, 30 N Gould St, Ste N, Sheridan, WY 82801, United States ("we," "us" or "our"), handles personal data in InvoiceCow, including the website at invoicecow.com, the dashboard, the buyer portal pages (the "Portal") and the related services (together, the "Service").
This Privacy Policy is information that we owe you. It is not a contract, and we do not treat your acknowledgment of it as consent to anything.
1. WHO THIS POLICY IS ABOUT, AND OUR ROLE
The Service touches the data of three groups of people. Our role is different for each.
| Who | Examples | Our role |
|---|---|---|
| Merchants and their users | The person who opens an account, the members they invite | Controller. We decide why and how this data is processed. |
| Buyers and other people in a merchant's sales and invoices | A customer of the merchant, a contact person of a buying company | Processor for the merchant. The merchant is the controller (Section 6). |
| Visitors | A person who reads our website | Controller. |
For the data of buyers, we are also a controller for three narrow purposes:
- the security of the Portal (rate limits and the prevention of fraud and misuse);
- the records of a buyer's acceptance of the Buyer Terms and of each statement that a buyer confirms under them; and
- the records that we need to establish, exercise or defend our own legal claims, for as long as that need lasts.
Which role we have depends on who decides why and how the data is processed, not on this table alone.
In this policy, a "merchant" is a business that uses the Service to issue invoices, and a "buyer" is a person or an organization that bought from a merchant, and any person who acts for it in the Portal.
2. DATA WE COLLECT ABOUT MERCHANTS AND THEIR USERS
| Data | Examples |
|---|---|
| Account details | Name, email address, password (stored only as a hash), language, profile picture if you add one |
| Sign-up record | The time, the IP address and the approximate location derived from it, the sign-up method, the first page that the browser visited, the referring website and the campaign tags of the link |
| Sessions and devices | For each session: the time, the IP address, the browser and device type, the approximate location derived from the IP address, and whether the session is active |
| Sign-in history | Successful and failed sign-ins, with the time, the IP address, the browser, the sign-in method and the approximate location |
| Sign-in with Google | If we offer sign-in with Google and you use it, the identifier, name, email address and profile picture that Google gives us |
| Membership | The accounts that you belong to and your role in each |
| Issuer details | The legal name, address, tax and VAT identifiers, registration details, logo, numbering settings and Portal address of each issuer. For a sole trader, these can be personal data |
| Connection data | The identifiers of your connected processor and platform accounts; API keys and webhook secrets, stored encrypted |
| Billing | The status of your Footer Subscription, and the card brand, the last four digits and the expiry date that Stripe gives us. Stripe collects your full payment details; we never receive them |
| Acceptance records | Each time that you accept or acknowledge a legal document: the document and its exact version, the wording shown, the time, the IP address, the browser and an approximate location (country, region and city) |
| Messages | The emails that the Service sends you, and the messages that you send us |
3. DATA WE PROCESS ABOUT BUYERS
3.1 From the merchant and its connections
When a merchant connects a payment processor or a platform, or imports sales, we receive for each sale:
- contact and identity details: name, company name, email address, billing address, country, phone number where the source gives one, and tax or VAT identifiers;
- purchase details: amounts, currency, dates, products, line items, the tax charged, refunds and disputes;
- identifiers of the processor or the platform, such as a customer id or a payment id; and
- the event data as the processor or the platform sends it. This data can include limited card details that processors put in it, such as the card brand, the last four digits, the expiry month and year and the issuing country.
We do not request or intentionally collect full card numbers or card security codes, and the payment processors that we connect to do not include them in the data that they send us. Merchants must not put them in imports, webhooks, free-text fields or messages. If we find one, we restrict access to it and remove it.
3.2 From the Portal
When a buyer uses the Portal, we collect:
- the email address entered to find a purchase, and the single-use link that we send to it (stored only as a hash);
- the details that the buyer adds or changes (such as a company name, an address, a country, a tax or VAT identifier, a purchase order number, a cost centre and the language of the invoice);
- the result and the date of each check of a VAT number against the European Commission's VIES service;
- each confirmation, change, preview and download, with the time, the IP address and the browser, and, for the acceptance of the Buyer Terms and each confirmation, an approximate location (country, region and city) derived from the IP address; and
- failed searches and other security events, with the time, the IP address and the browser.
3.3 The invoices
The Service generates invoices and credit notes that contain the data above, and keeps each revision, the stored bytes of each released invoice, the source data of each sale and the audit records (together, the "Archive").
4. DATA WE COLLECT ABOUT VISITORS
- Server and security logs: the IP address, the browser, the page requested, the referring page and the time. Cloudflare, our network provider, processes this data for us when it carries traffic to the Service.
- Analytics: we use Umami, analytics software that we host ourselves. It records page views, referring sites, the browser and device type and the country, without cookies. It does not store your IP address, and no analytics company receives the data. The events that it records contain no buyer personal data.
- Language preference: a cookie remembers the language that you chose (Section 12).
We do not use advertising trackers, and we do not sell or share personal data for advertising.
5. HOW WE USE DATA, AND OUR LEGAL BASES
This table covers the data for which we are the controller. Where the GDPR or a similar law applies, these are our legal bases.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in, keep sessions secure | Account, sessions, sign-in history | Contract (Art. 6(1)(b) GDPR) where you are our customer as an individual; otherwise our legitimate interest (Art. 6(1)(f)) in providing the Service to the organization that you act for; legitimate interest in security |
| Provide the Service, run your connections, support you | Account, issuer details, connection data, messages | As in the row above |
| Send service emails (sign-in links, security notices, alerts, digests) | Account details | Contract; legitimate interest in running the Service |
| Bill the Footer Subscription and keep billing records | Billing, account details | Contract; legal obligation (Art. 6(1)(c)) |
| Protect the Service, the Portal and their users: rate limits, fraud and abuse prevention, investigations | Logs, sessions, Portal security events | Legitimate interest in security and in the prevention of fraud |
| Record a buyer's acceptance of the Buyer Terms and each statement that a buyer confirms; prevent invoice fraud | Buyer acceptance and statement records, Portal security events | Legitimate interest (Art. 6(1)(f)) in proving what was accepted and confirmed, and in the prevention of fraud |
| Prove what was offered and accepted; establish, exercise and defend legal claims | Acceptance records, logs, and the specific Archive records that a claim concerns | Legitimate interest in establishing, exercising and defending legal claims |
| Understand how the website is used, and improve it | Analytics, sign-up record | Legitimate interest in improving the Service |
| Comply with the law and answer lawful requests | Any data that the request concerns | Where the GDPR applies, legal obligation (Art. 6(1)(c)) only for obligations under EU or Member State law. For an obligation or a request under another law (for example US tax law, which applies to us), our legitimate interest in complying with it, after we check that it is lawful, necessary and proportionate, and that any transfer meets Chapter V GDPR; a foreign demand alone is not enough |
Where we rely on our legitimate interest, we have weighed it against your rights. You may object (Section 10).
You must give us your account details to use the Service; without them, we cannot provide it. A buyer's business details are optional, but a merchant may need them to issue a business invoice.
What we do not do. We do not sell personal data. We do not share it for cross-context behavioral advertising. We do not use buyer data to send marketing to buyers. We do not train machine-learning models on the data of merchants or buyers.
6. BUYER DATA: THE MERCHANT DECIDES
For buyer data, the merchant is the controller, and we process the data on the merchant's documented instructions, which are the Terms of Service, the Data Processing Addendum and the merchant's settings. The merchant decides why the data is processed and is responsible for the legal basis, for its notices to buyers and for answering their requests. A merchant usually issues invoices to meet a legal obligation and to perform its contract with the buyer.
If you are a buyer and you want to use a privacy right about your purchase or your invoice, write to the merchant. If you write to us, we will pass your request to the merchant and help it to answer, as the Data Processing Addendum says. For the records for which we are the controller (Section 1), write to us at [email protected].
7. HOW WE SHARE DATA
7.1 Our service providers
We use service providers to host and run the Service. Our Data Processing Addendum (Section 6.5) requires us to bind each provider, before it processes the data that we process for merchants, by a written agreement with data protection obligations, and to use a transfer mechanism where the law requires one. The Subprocessors page lists them, with their legal entities, purposes and locations. They are, today: Hetzner (servers), Amazon Web Services (email, file storage and backups), Cloudflare (network, DNS and protection) and Stripe (billing of the Footer Subscription).
7.2 Merchants and buyers
We show a buyer's data to the merchant that the buyer bought from. We show a buyer its own purchases from that merchant, and nothing about other buyers. When a merchant sends an invoice through the Service, we send it to the recipient that the merchant chooses.
7.3 AccountingYear
If a merchant turns on the AccountingYear sync, we send that merchant's invoices to its AccountingYear books, on its instruction. AccountingYear is a product of Latent Software LLC, and its own privacy policy applies there.
7.4 VIES
To check an EU VAT number, we send it to the European Commission's VIES service, which queries the tax administration of the EU country concerned.
7.5 The law, safety and business transfers
We may disclose data, where it is necessary and proportionate and on a legal basis in Section 5, to comply with a law or a legal process, to answer a lawful request of an authority, to prevent or investigate fraud, or to protect the rights, the safety or the property of us, our users or others. Where the law allows, and where it is practical, we will tell a merchant before we disclose its data or its buyers' data. We may transfer data as part of a merger, an acquisition or a sale of assets, and we will tell you if that happens.
7.6 Aggregated data
We may use and share statistics that identify no person and no merchant, such as the number of invoices issued in a country.
8. HOW LONG WE KEEP DATA
| Data | How long |
|---|---|
| The Archive (invoices, credit notes, their revisions and stored bytes, the source data of each sale, VIES results and audit records) | Ten years from the date that each invoice or credit note was issued, on the merchant's instruction, including after the merchant's account ends, unless the merchant instructs us to delete it earlier, also if the Service is discontinued as a whole (Section 23.2 of the Terms of Service). Retention beyond that period is governed by Section 9.3 of the Data Processing Addendum. Specific records that we keep for our own legal claims are processed separately, as controller, only where necessary and for as long as that need lasts. |
| Sales without an invoice (waiting, in quarantine or voided) | While the merchant's account is active, and then until the account data is deleted, unless they become part of the Archive. |
| Account details | While the account is active. When the account is deleted, we delete them, except what the Archive and the acceptance records must keep (such as the name and the email address on a record). |
| Sessions | Until the session expires or is revoked; device records stay until the account is deleted. |
| Sign-in history | 12 months, on a rolling basis. |
| Connection credentials | Until the connection is removed or the account is deleted. |
| Acceptance records and buyer statement records (of merchants and of buyers, with the IP address, the browser and the approximate location recorded with them) | As long as a claim about the agreement or the statement could arise. We have set no fixed deletion date. |
| Portal security events | As long as we need them for security, for the prevention of fraud and for legal claims. |
| Billing records | As long as tax and accounting laws require (normally seven years). |
| Messages and support emails | As long as we need them to support you and to show what we sent, unless they are part of the Archive. |
| Server logs | In size-capped logs. Older lines are overwritten as the logs fill. |
| Database backups | Scheduled for deletion after 30 days, with a storage rule that expires them after 60 days. The storage provider may take some more time to remove them. An expired backup is not used. |
| Analytics | As long as useful. Analytics contain no IP address and no cookie identifier. |
Deletion on request. When you ask us to delete data for which we are the controller, we delete it without undue delay and within the time that the law sets. Where the GDPR applies, we refuse or defer an erasure only where the GDPR permits it, with a valid legal basis and an applicable ground for keeping the particular records, such as a retention obligation under EU or Member State law, or a need to establish, exercise or defend a legal claim. An obligation under another law alone is not an exception to erasure; we assess it under Section 5. We explain the grounds when we answer your request. A released invoice is never edited. We keep it for its Archive Period because the merchant instructs us to keep it as a record, and the merchant decides, as the controller, whether to delete it earlier, subject to its own legal duties to keep records. A request to correct or erase data in an invoice goes to the merchant (Section 6). A correction of a released invoice takes the form of the correction method of the Service (by default, a credit note and a replacement invoice), and the earlier documents stay on record.
9. SECURITY
We use technical and organisational measures appropriate to the risk (Article 32 GDPR). They include: encryption in transit (TLS); encryption at rest of the file store, the backups and the API keys and secrets of connections; passwords stored only as hashes; Portal links that work once, are bound to an email address and expire; rate limits on the Portal; access to each merchant's data limited to that merchant's account; unchangeable revisions of invoices with stored content hashes; and restricted administrative access. The Data Processing Addendum describes these measures in more detail.
No system is perfectly secure. Keep your password, your devices and your API keys secure. If a personal data breach affects your data, we will notify you and the authorities as the law requires.
10. YOUR RIGHTS
Depending on where you live, you may have the right to:
- access the personal data that we hold about you;
- correct data that is wrong (subject to Section 8);
- delete your data (subject to Section 8);
- receive your data in a portable format;
- restrict some processing;
- object to processing that we base on our legitimate interest;
- withdraw consent, where we process data on the basis of consent; and
- complain to a data protection authority, in particular in the country where you live or work, or where an infringement took place.
To use a right, write to [email protected]. We may need to confirm your identity first. We will answer within the time that the law sets. We do not discriminate against anyone for using a privacy right.
If your request concerns buyer data that we process for a merchant, see Section 6.
11. UNITED STATES PRIVACY LAWS
This section applies to residents of California and of other US states with comprehensive privacy laws.
- For buyer data that we process for a merchant, we are a service provider (or processor) of the merchant. Send requests about it to the merchant. For the records for which we are a controller (Section 1), write to us.
- Categories that we collect (in the last 12 months), as controller: identifiers (name, email address, IP address, account identifiers); commercial information (subscription and billing status); internet and network activity (logs, sessions, sign-in history); approximate geolocation (derived from the IP address); and professional information (issuer details).
- Sources: you, your browser or device, your connected accounts, the members of your account, and Google when you sign in with it.
- Purposes: as in Section 5.
- Disclosures for business purposes: to the service providers in Section 7.1.
- Sensitive personal information: we use account login credentials only to authenticate you. We do not use sensitive personal information to infer characteristics about anyone.
- Sale and sharing: we do not sell personal information, and we do not share it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
- Retention: as in Section 8.
- Your rights: to know, to access, to delete, to correct, and not to be discriminated against for using these rights. You may use an authorized agent; we may ask the agent for proof of authority and ask you to verify your identity. If we refuse a request, you may appeal by replying to our answer. To use a right, see Section 10.
12. COOKIES
We use only cookies that the Service needs, and a cookie that remembers your language.
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in (or keeps a buyer's Portal session) and protects each request against forgery | Until you sign out, the session ends, or it expires |
| Remember-me cookie | Keeps you signed in on this browser, only if you choose it | Up to one year, renewed while you use the Service |
Device cookie (sessions_device_id) |
A signed random value, set after sign-in, that recognizes this browser so that repeated sign-ins do not look like new devices. It contains no account identifier and no credential, and it is not a fingerprint | Up to five years, unless you delete it |
| Language cookie | Remembers the language that you chose | One year |
Cloudflare may set strictly necessary security cookies that protect the Service against attacks and bots. We do not use advertising cookies or analytics cookies. We do not respond to "Do Not Track" signals, because we do not track you across other sites. Your browser lets you block or delete cookies; if you block the session cookie, you cannot sign in or use the Portal.
13. AUTOMATED PROCESSING
Some steps of the Service are automatic:
- For merchants, as their processor: the Service chooses the kind of an invoice from the data present, issues invoices, credit notes and replacements, checks VAT numbers against VIES, and holds possible duplicate sales in quarantine. These steps carry out the merchant's settings and instructions; the merchant is the controller of them, and the invoice is the merchant's document.
- For us, as controller: the Portal limits the rate of requests and refuses links that are used, expired or bound to another email address. These are temporary security measures. A buyer can always ask the merchant for an invoice directly.
In our assessment, the security measures that we decide do not produce legal effects concerning a person, or similarly significantly affect a person, within the meaning of Article 22 GDPR. You may ask a person to review an automated security measure of ours at [email protected]. For an automated step that a merchant controls, write to the merchant (Section 6).
14. INTERNATIONAL TRANSFERS
We are based in the United States. Our servers and our file store are in the United States, and Cloudflare carries traffic through its global network. If you use the Service from outside the United States, your data is processed in the United States and in the other countries where our service providers operate. Those countries may have data protection laws different from yours.
Where the law requires a transfer mechanism for data from the European Economic Area, the United Kingdom or Switzerland, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and their UK and Swiss addenda, which our Data Processing Addendum incorporates for the data that we process for merchants, and on the transfer mechanisms that our Data Processing Addendum (Section 6.5) requires us to put in place with our service providers. Some of our service providers are also certified under the EU-U.S. Data Privacy Framework; Latent Software LLC is not certified under it. You can ask for a copy of the relevant safeguards at [email protected].
15. CHILDREN
The Service is for businesses. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If we learn that we hold such data, we will delete it, except what the law requires us to keep.
16. LINKS TO OTHER SITES
The Service links to other sites, such as payment processors, platforms and authorities. We are not responsible for their privacy practices. Read their policies.
17. CHANGES TO THIS POLICY
We may update this Privacy Policy. For a material change, we will tell merchants by email or in the Service before the change takes effect, and we may ask you to acknowledge the new version. The date at the top shows when we last changed it.
18. CONTACT
Latent Software LLC 30 N Gould St, Ste N Sheridan, WY 82801 United States
Privacy questions and requests: [email protected] General support: [email protected] Legal notices: [email protected]