Privacy Policy
Last updated: 30 October 2026
InvoiceFlow is operated by Dhruv Bhagatkar as a sole proprietor, based in Mumbai, Maharashtra, India (“InvoiceFlow”, “we”, “us”). This policy explains what personal data we handle, why, and what choices you have. It is written to follow India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Who is responsible for what
For your own account data (your email, profile and billing details), InvoiceFlow is the Data Fiduciary. For the data about your clients that you enter into InvoiceFlow (their names, emails, addresses and GSTINs), you are the Data Fiduciary and InvoiceFlow processes that data on your behalf and on your instructions. You are responsible for having a lawful basis to share your clients' data with us.
What we collect
- Account details: your email address and sign-in credentials (managed by our authentication provider).
- Profile details you enter: business name, address, GSTIN, logo, and the UPI ID or bank details you choose to show on invoices.
- Your clients' details: names, emails, addresses and GSTINs.
- Your documents: invoices, quotes, and the timesheet CSVs and PDFs you upload.
- Team member emails, if you invite teammates or an accountant.
- Billing records: your plan, and Razorpay subscription and payment IDs. We never see or store your card or UPI credentials; Razorpay handles those.
Why we use it
- To provide the service: creating, sending and tracking invoices and quotes, public invoice links, the client portal, recurring invoices and reports.
- To run your account, team access and subscription billing.
- To send service emails, such as invoices you send and account notices.
- To keep the service secure and fix errors.
- To meet legal and tax obligations.
We do not sell your data and we do not use it for advertising.
Who we share it with
We use the following service providers (processors) to run InvoiceFlow. They process data only to provide their service to us.
- Supabase: database and authentication.
- Render: API hosting (Singapore).
- Vercel: web hosting.
- Krutrim / Ola object storage: file storage (Bengaluru, India).
- Resend: sending email.
- Razorpay: payments and subscriptions.
- Sentry: error monitoring (USA). We do not send invoice contents or email addresses to Sentry.
Some of these providers operate outside India. Where you share an invoice link or portal link with a client, anyone with that link can view that invoice, so share it only with the intended person. We may also disclose data when required by law.
Cookies
We use only essential authentication cookies to keep you signed in. We do not use advertising or tracking cookies.
How long we keep data
We keep your data while your account is active. If you delete your account, we remove your data, except billing and tax records, which we keep as required under Indian tax law (typically up to 8 years).
Your rights
Under the DPDP Act you can:
- access the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to erase your data;
- withdraw your consent at any time;
- nominate another person to exercise these rights if you die or cannot act; and
- raise a grievance.
To use any of these rights, write to support@sidecar.co.in. If you are a client of one of our users, please contact that user first, as they control your data; we will help them respond.
Security
We use access controls, encrypted connections and reputable infrastructure providers to protect your data. No system is perfectly secure, so we cannot guarantee absolute security.
Children
InvoiceFlow is a business tool and is not meant for anyone under 18.
Grievance Officer
Name: Dhruv Bhagatkar
Email: support@sidecar.co.in
We acknowledge grievances within 48 hours and aim to resolve them within 30 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023.
Changes to this policy
We will tell you about material changes by email or in the app before they take effect.