Privacy policy
How Invecho handles personal information.
1. About this policy
This is a draft privacy policy for Invecho, an Australian software service for following up overdue Xero invoices by SMS. It requires professional legal review and confirmation of actual data practices before production launch. Operator: [insert legal business name and ABN if applicable]. Effective date: [insert date]. Privacy contact: [insert monitored email address].
2. Information we collect
Account information may include your name, business name, email address, account identifiers and authentication records. When you connect Xero, the service processes relevant customer and contact details, mobile phone numbers, invoice identifiers, due dates, amounts, outstanding balances and payment status. It also processes outbound and inbound SMS content, delivery information, reply interpretations, promises to pay, disputes, opt-outs and chase history.
3. Support and technical information
Support communications may include the information you choose to provide. The application and hosting services may process technical logs, device and browser information and usage events required for operation, security and troubleshooting. The production marketing website uses Google Analytics 4, provided by Google, to measure page visits, traffic sources and Start free clicks. Google Analytics uses cookies and online identifiers and processes technical information such as browser and device details. Custom click events include the page path and button placement, not contact-form values or customer invoice information. Google signals and advertising personalisation signals are disabled in the website tag. Analytics is not loaded on local or private review hosts. [Confirm Google Analytics retention, enhanced-measurement settings, international processing, consent requirements and the application’s separate analytics before launch.]
4. Why we process information
Information is used to operate accounts, connect to Xero, identify eligible overdue invoices, send and receive SMS, interpret customer replies, apply chasing rules, check payment status, provide support and administer subscriptions. Xero remains the source of truth for invoice balances and payments. We do not receive or hold the money customers pay toward invoices.
5. Customer and contact information
Businesses connecting Xero are responsible for having appropriate authority to provide customer information and instruct SMS follow-up. If you receive an SMS about an invoice, contact the business that issued the invoice for questions about the debt, balance or payment arrangements. Contact Invecho using the configured privacy contact for questions about how the service handles your information.
6. Service providers and disclosure
Service providers may process information on our behalf for hosting, databases, SMS delivery, email, subscription payments, support and any configured analytics. Xero provides the connected accounting service, and Stripe processes Invecho subscriptions. AI-based reply interpretation may involve a service provider processing message content. [Insert confirmed provider names, data categories, locations, contractual protections and whether provider model training is disabled.] We may also disclose information where required by applicable law.
7. International processing
Some service providers may process or store data outside Australia. [Identify relevant countries and safeguards after confirming the production provider configuration.] This draft does not claim Australian-only hosting or data residency.
8. Security
We aim to minimise retained information and use appropriate technical and organisational controls. The security page identifies intended controls requiring production verification. [Confirm encryption, access restrictions, backup protections and incident procedures.] No service can promise absolute security.
9. Retention and deletion
Information should be retained only as long as needed to provide the service, meet applicable obligations and resolve legitimate disputes. [Specify actual retention periods for account data, Xero data, messages, logs and backups, together with deletion timing after cancellation or Xero disconnection.] Disconnecting Xero does not necessarily delete information already held; the final policy must explain the actual process.
10. Access, correction and complaints
You can request access to or correction of personal information, ask about deletion or raise a privacy concern using [insert monitored privacy email]. Identity verification may be required before responding. [Confirm response timeframes, complaint handling, applicable privacy-law rights and any external complaint escalation process with legal counsel.]
11. Policy updates
The final policy should explain how material changes are communicated and display the current effective date. Review this draft whenever providers, processing purposes or retention practices change.
See our current pricing, security information and contact page.