Privacy policy

Last updated: 25 October 2026

This policy explains what personal data SASU Invoice ("we", "us") collects when you use sasuinvoice.netlify.app (the "Service"), why, and the choices you have. We follow Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and, for people in the UK and EU, the UK and EU GDPR.

1. Using the free editor without an account

Invoices you create in the editor without signing in are stored only in your own browser. We do not receive them. Clearing your browser data deletes them.

2. Data we collect with an account

• Account data: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Workspace data: your business details, logo, clients and their contact details, invoices, payments you record, reminder settings and team members.
• Email data: when you send an invoice or reminder, the recipient, subject, content and delivery status (delivered, bounced and so on).
• Billing data: your plan and subscription status. Card and payment details are collected by Paddle, not by us.
• Technical data: basic logs (such as IP address, browser and time of request) kept for security and to fix problems. We do not use advertising or tracking cookies.

3. Why we use it

• To provide the Service you asked for: storing your workspace, sending your emails and reminders, and running your subscription (performance of our contract with you).
• To keep the Service secure, prevent abuse and fix errors (our legitimate interests).
• To send you service messages, such as sign-in links, receipts and important changes. We do not send marketing emails without your consent.
• To meet legal obligations, such as tax records.

Your clients' data is processed on your behalf: for that data you are the controller and we act as your processor.

4. Who we share it with

We do not sell personal data. We use these service providers to run the Service:

• Supabase: database, sign-in and file storage (servers in London, UK).
• Netlify: hosting of the website.
• Resend: sending invoice and reminder emails.
• Paddle: payments, as our Merchant of Record, under Paddle's privacy policy.
• Google: only if you choose to sign in with Google.

Some providers process data outside Sri Lanka, including in the UK, the EU and the US. We rely on their contractual safeguards for those transfers.

5. How long we keep it

We keep workspace data while your account is open. You can ask us to delete your account from Settings → Account or by email. We confirm the request by email and delete the data within 30 days, except records that must be kept by law (such as invoices and billing records), which we keep only as long as required and then delete. Backups are overwritten within a further 30 days.

6. Your rights

You can access, correct, export or delete your data, object to or restrict some processing, and withdraw consent. Most of this you can do yourself in Settings; for anything else email suhaanas2025@gmail.com and we will reply within 30 days. You can also complain to the Data Protection Authority of Sri Lanka or, in the UK or EU, your local data protection authority.

7. Security

Data is encrypted in transit and at rest, each workspace is isolated from others, and access is limited to what is needed to run the Service.

8. Children

The Service is for businesses and is not meant for anyone under 18.

9. Changes and contact

We will post changes here and email account owners about important ones. Contact us about privacy at suhaanas2025@gmail.com.