Privacy Policy

1. Introduction & Who We Are

Welcome to InvoCraft: Invoice & POS ("InvoCraft," "the App," "we," "our," or "us"). InvoCraft is developed and published by Afnan Devs, a software development business based in Karachi, Pakistan. We are committed to protecting your privacy and handling your personal data transparently and responsibly.

This Privacy Policy applies to the InvoCraft mobile application available on Google Play (and Apple App Store when launched) and any associated services. It explains what data we collect, why we collect it, how it is used and shared, and what rights you have over your data.

By creating an account or using InvoCraft, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the App.

• Developer / Data Controller: Afnan Devs
• Contact Email: [email protected]
• Website: afnandevs.com
• Address: Gulshan Maymar, Karachi Central, Karachi, Pakistan

2. Data We Collect

2.1 Account Data

When you register for InvoCraft, we collect:

• Name — provided by you during sign-up or imported from your Google Account.
• Email address — used as your account identifier and for communications.
• Authentication credentials — a hashed password if you use email/password sign-up, or a Google Sign-In token if you use Google. We never store your Google password.

2.2 User-Generated Business & Financial Data

InvoCraft is built to store the data you enter to run your business. This includes:

• Business profiles (business name, address, logo, contact details)
• Client and customer records (names, addresses, contact information)
• Products and services / inventory items (names, prices, descriptions)
• Invoices, estimates, and receipts (line items, amounts, dates, statuses)

This data is created entirely by you. It is stored on our secure backend servers so you can access it across devices and sessions. We do not analyse or sell this data.

2.3 Advertising & Device Identifiers (AdMob)

Free-tier users only. If you are on the free plan, we display advertisements served by Google AdMob. To serve and measure ads, Google AdMob automatically collects:

• Advertising ID (Google Advertising ID / GAID on Android; IDFA on iOS) — a resettable device identifier used to serve relevant ads and measure ad performance.
• Device information — device model, operating system version, screen size, language, time zone.
• IP address and coarse location — used for geo-targeting ads and fraud prevention.
• Ad interaction data — whether an ad was viewed, clicked, or dismissed.

Google AdMob may use the Advertising ID to serve personalised ads based on your interests across apps and websites. See Section 4 for full details and how to manage or opt out.

Paid subscribers see no ads. Once you purchase a premium subscription, AdMob is not initialised and the Advertising ID is not accessed by our App.

2.4 Log & Usage Data

Our backend servers and the App may automatically collect:

• App version and device operating system version
• Crash reports and diagnostic information
• API request timestamps and error codes
• Feature usage events (e.g., "invoice created," "PDF exported") — in aggregate, non-identifying form

Log data is used solely for debugging, stability monitoring, and improving the App. It is not used for advertising or sold to third parties.

3. How We Use Your Data

We do not use your business or financial data (invoices, clients, items) to train machine learning models, sell to data brokers, or for any purpose beyond providing InvoCraft to you.

4. Advertising & Google AdMob

4.1 How Ads Work in InvoCraft

InvoCraft uses Google AdMob (a service of Google LLC) to display banner and interstitial advertisements to users on the free plan. Google AdMob uses the Advertising ID— a unique, resettable identifier provided by your device — to:

• Serve ads relevant to your interests (personalised advertising)
• Limit ad frequency (capping)
• Measure ad performance and conversion
• Prevent fraudulent ad clicks

Google AdMob's use of the Advertising ID is governed by Google's own privacy policies:

• Google Privacy Policy
• How Google uses information from sites or apps that use Google services
• Google AdMob and AdSense policies

4.2 Personalised vs. Non-Personalised Ads

By default, AdMob may serve personalised ads tailored to your interests. Where required by law (EEA, UK, and certain US states), we display a consent prompt powered by Google's User Messaging Platform (UMP) before serving personalised ads. You can:

• Accept personalised ads (consent granted).
• Decline personalised ads — you will still see ads, but they will be non-personalised (based on context, not your interest profile).
• Change your choice at any time via App Settings → Privacy & Ads → Manage Ad Consent.

4.3 How to Opt Out / Reset Your Advertising ID

• Android: Go to Settings → Google → Ads → Delete advertising ID (Android 12+) or Reset advertising ID / Opt out of Ads Personalisation (earlier versions).
• iOS (when available): Go to Settings → Privacy & Security → Tracking and toggle off "Allow Apps to Request to Track." You can also reset your IDFA under Settings → Privacy & Security → Apple Advertising → Reset Advertising Identifier.

4.4 Paid Subscribers — No Ads

Users with an active premium subscription are not shown any advertisements. Google AdMob is not initialised for premium accounts, and the Advertising ID is not accessed by InvoCraft on their behalf.

5. Legal Bases for Processing (GDPR) & CCPA / CPRA Rights

5.1 GDPR Legal Bases (EEA / UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

• Contract performance — processing necessary to provide the App and your account (Art. 6(1)(b) GDPR).
• Consent — personalised advertising via AdMob (Art. 6(1)(a) GDPR). You may withdraw consent at any time without affecting prior processing.
• Legitimate interests — security, fraud prevention, crash diagnostics, and aggregate usage analytics (Art. 6(1)(f) GDPR).
• Legal obligation — where processing is required by applicable law (Art. 6(1)(c) GDPR).

5.2 CCPA / CPRA (California Residents)

We do not sell your personal information as defined by the California Consumer Privacy Act (CCPA) and its amendment (CPRA). We do not share personal information for cross-context behavioural advertising purposes, except where you have given consent for personalised ads via the UMP consent prompt.

California residents may exercise the rights described in Section 8 by contacting us at [email protected].

6. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal data. We share data only with the following parties and only to the extent necessary to provide InvoCraft:

We may also disclose data where required by law, court order, or to protect the rights and safety of InvoCraft users or the public.

7. Data Retention

• Account and business data is retained for as long as your account is active. If you delete your account, your data is permanently removed from our servers within 30 days.
• Log and diagnostic data is retained for up to 90 days for debugging purposes.
• Advertising data (Advertising ID) is controlled by Google AdMob and retained per Google's data retention policies.
• We may retain certain information for longer where required by applicable law (e.g., for tax, accounting, or legal compliance).

8. Your Rights

Depending on your location, you may have the following rights with respect to your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate or incomplete data be corrected.
• Deletion — request that your data be deleted (see Section 9 for the account deletion process).
• Portability — request your data in a structured, machine-readable format.
• Withdraw consent — withdraw consent for personalised advertising at any time via App Settings or the consent dialogue.
• Object — object to processing based on legitimate interests.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Lodge a complaint — you have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data lawfully.

To exercise any right, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

9. Account & Data Deletion

You have the right to delete your InvoCraft account and all associated data at any time. Deletion permanently erases your account credentials, business profiles, clients, items, invoices, and estimates from our servers.

How to Request Deletion

Option 1 — In-App (recommended):

1. Open InvoCraft and sign in.
2. Go to Settings → Account → Delete Account.
3. Confirm deletion. Your data will be permanently removed within 30 days.

Option 2 — Email Request:

Send a deletion request from your registered email address to [email protected] with the subject line "InvoCraft Account Deletion Request." We will confirm and complete deletion within 30 days.

Option 3 — Web Form:

Submit a deletion request via our web form at afnandevs.com/invocraft/delete-account.

Note: Deletion of your account does not entitle you to a refund of any subscription fees already charged. Subscription cancellation is handled separately through the Google Play or Apple App Store.

10. Children's Privacy

InvoCraft is a business productivity application. It is not directed to children under the age of 13 (or 16 where applicable under GDPR), and we do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided personal information through InvoCraft without your consent, please contact us immediately at [email protected]. We will take prompt steps to delete that information.

In jurisdictions where the Google Play Families Policy or similar rules apply, InvoCraft is categorised as a non-family app intended for business users aged 18 and over.

11. International Data Transfers

Afnan Devs is based in Pakistan. Your data may be processed and stored on servers located outside your country of residence, including in countries that may not offer the same level of data protection as your home jurisdiction.

For users in the EEA or UK, we rely on appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) where applicable when engaging third-party processors such as Google. Google LLC participates in the EU–US Data Privacy Framework.

12. Security

We implement industry-standard technical and organisational measures to protect your data, including:

• Encrypted data transmission (HTTPS / TLS) between the App and our servers.
• Hashed and salted password storage — we never store passwords in plain text.
• Access controls limiting which personnel can access production data.
• Regular security reviews of our backend infrastructure.

No system is 100% secure. If you believe your account has been compromised, please contact us immediately at [email protected].

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Display an in-app notification or prompt for significant changes.

We encourage you to review this policy periodically. Continued use of InvoCraft after changes are posted constitutes your acceptance of the revised policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Developer: Afnan Devs
• Address: Gulshan Maymar, Karachi Central, Karachi, Pakistan
• Website: afnandevs.com

We aim to respond to all privacy-related inquiries within 30 days.