Privacy Policy

Who operates this service

EzInvoice is operated by Vyro Solutions, based in Malaysia. Vyro Solutions is the data controller for the information described below.

Where this service operates

Vyro Solutions operates from Malaysia, but EzInvoiceis available to and used by people outside Malaysia as well — this service is not limited to Malaysian users. We do not claim that our practices satisfy every country's privacy law; if you are relying on a specific legal framework (GDPR, CCPA, or another), confirm your own requirements independently rather than assuming this policy covers them.

Information we collect

We keep these categories separate because they're handled differently:

• Account data — your email address, provided when you sign up, plus your name, business name, and phone number (optional), which you can add or edit afterward in Settings.
• Customer & invoice data— clients, invoices, products, and payment records you create while using the app. This is your business's data; we process it on your behalf to provide the service.
• Support messages & screenshots— the text and any optional screenshot you submit through the in-app Help Centre. Screenshots can contain whatever was on your screen when you took them — avoid including anything sensitive you don't need to show us.
• Analytics data— page views and a small number of interaction events (e.g. clicking “Sign up”), collected only if you accept the analytics cookie prompt. See “Analytics and cookies” below.
• Billing metadata — if you subscribe to a paid plan, our payment processor (Stripe) handles your card details directly; we only receive and store subscription status, plan, and billing amounts, never your full card number.
• Logs — standard web server logs (IP address, browser, timestamps), and your country, inferred automatically from your network connection at signup.
• Uploaded assets — product photos and your business logo, if you upload them.

How we use it

• To operate your account and generate the invoices, receipts, and reports you create.
• To respond to support requests you send us.
• To detect and prevent fraud, abuse, and security incidents.
• To send you account-related email (password resets, receipts you choose to send).
• To understand aggregate site usage, only for visitors who accept analytics cookies.

We do not sell your data to third parties.

Analytics and cookies

We use a single Google Analytics (GA4) property to understand how the site is used. It does not load, and no analytics cookie is set, until you actively accept the cookie prompt shown on your first visit — declining or ignoring it keeps analytics off. You can change your choice at any time by clearing your browser's local storage for this site. Analytics never loads on pages that contain a private link token (invoice share links, invite links, password-reset links), regardless of your cookie choice.

Data sharing

We use the following processors to run the service. Each only receives what it needs to do its job:

• Cloudflare — hosting, network security, and storage for the app and its database.
• Stripe — payment processing, only if you subscribe to a paid plan.
• Resend — delivery of transactional email (password resets, invoice/receipt emails you send).
• Google Analytics — aggregate usage analytics, only for visitors who accept the analytics cookie prompt (see above).
• Google Gemini— only if you click “AI summary” on a report page; that report's data (e.g. client names, invoice amounts and counts) is sent to Google's Gemini API to generate the summary shown to you.

Public invoice links

When you share an invoice with your customer, we generate a link containing a long random token. Anyone who has that link — not just your customer — can view the invoice it points to, without needing to log in, until you revoke or regenerate the link. Treat these links the same way you'd treat a PDF attachment: forwarding one forwards access to it.

Data retention

We keep your account and business data for as long as your account is active. If you delete your account, we delete the associated data, other than what we're required to keep for legal or accounting reasons. We have not yet finalized specific retention periods for individual data categories (e.g. resolved support tickets, server logs) — this section will be updated once those are set, rather than stating a number now that hasn't been decided.

Your rights

You can ask us about what data we hold on you, request access to it, ask us to correct it, request an export of it, or request that we delete your account and associated data. Email hello@vyro.dev with your request and the email address your account uses — we'll confirm your identity before acting on it, and respond within a reasonable time.

Contact

Questions about this policy, or a privacy/data-rights request? Email hello@vyro.dev.