Privacy Policy

Mobile Invoices is a product of Stacked Systems LLC (“we”, “us”, “our”), an Indiana limited liability company. Mobile Invoices is the name of the product, not a separate company or business name: Stacked Systems LLC is the business responsible for how the Service handles personal information (the “data controller”, where that term applies) — except for the information you enter about your own customers, which we handle on your behalf as section 4 explains. This policy covers Mobile Invoices only; other Stacked Systems LLC products have their own privacy policies.

We collect what we need to run Mobile Invoices: your account and business details, the content you put into the product, usage counts for billing, and analytics about how the app is used. We don’t sell personal information, don’t show ads, don’t use your data to train AI models, and don’t share it beyond the providers listed in section 6 that we need to operate the Service.

We never see or handle your customers’ payment details — money moves directly between you and them, outside Mobile Invoices.

If you received an estimate or invoice from a business that uses Mobile Invoices, section 5 is written for you.

Account data — your email address and password (stored only as a salted hash, never in plain text), your business name, and the business profile you build: phone number, business address, logo, and the payment details you choose to show on your documents (for example a Venmo handle, Zelle contact, Cash App tag, or PayPal link). Your logo is stored at a public web address so it can display on your documents.

Content you enter — your clients (name, phone, email, address, notes), saved line items, and your documents: line items, amounts, tax rate, notes, status, and timestamps such as when a document was created, sent, first opened, and paid. This content may include information about other people, such as your own customers.

Usage and metering — a count of documents created (estimates and invoices) each month so we can apply plan limits, plus your subscription status.

Analytics — how the app is used: pages viewed, buttons and links clicked, the page that referred you and any campaign parameters in the link, browser and device type, and approximate location derived from your IP address. Section 7 has the details.

Server logs — IP address, browser, the request made, and timestamps, kept briefly by us and our hosting providers for security and debugging.

Billing data — if you subscribe, our payment processor, Stripe, collects your card and billing details directly on behalf of Stacked Systems LLC (that is the name you’ll see on Stripe’s pages, on receipts, and on your card statement). We store your Stripe customer and subscription IDs, your plan, and its status. We never see or store full card numbers.

Support — the emails you send us and our replies.

To provide the Service — create and host your documents, show them to the people you share them with, apply plan limits, and bill you; to authenticate you and send account emails such as sign-up confirmations and password resets; to respond to support requests; to understand how the product is used so we can improve it; to send you notices about the Service (and marketing email only if you can opt out of it); to keep the Service secure and prevent abuse; and to meet legal obligations and enforce our Terms.

Where the law asks us to name a legal basis: we rely on performing our contract with you, our legitimate interests in operating, securing, and improving the Service, compliance with legal obligations, and your consent where it’s required.

You decide what goes into the Service about your customers, and we process it on your behalf, only to run the Service for you — for example to show their name on a document or list their invoices in their portal. Between us, you control that information and we process it for you (you’re the “controller” and we’re your “processor”, where those terms apply). You’re responsible for having a lawful basis to give it to us, for keeping it accurate, and for telling those people how their information is used where that’s required. We don’t use your customers’ information for our own purposes, don’t contact them, and don’t combine it across accounts. If a customer asks us directly about their information, we’ll refer them to you and help as needed.

A business that uses Mobile Invoices (“your contractor”) entered your name — and possibly your phone number, email, address, and notes — to send you a document. We store that on your contractor’s behalf, and they control it (section 4). When you open a document link we record that the document was opened and when, so your contractor can see it was viewed; we don’t store your IP address or device details on the document. The page runs the same analytics and logging as the rest of the site (section 7) — anonymously, unless you’re signed in to a Mobile Invoices account of your own.

We don’t create an account or profile for you, we don’t send you messages (your contractor does), and we never touch the payment: you pay your contractor directly on the payment service you choose. Your contractor may also give you a portal link listing the invoices they’ve sent you; anyone with that link can see that list. To correct information about you, ask your contractor. To ask us anything about your information, email hello@mobileinvoices.app and we’ll help.

We share personal information only in these situations:

Service providers. These companies process data on our behalf, only as needed to provide their service to us and under contracts that restrict how they can use it:

• Supabase — Database, authentication, and file storage
• Vercel — Application hosting and delivery
• Stripe — Subscription billing and payment processing
• Resend — Transactional email (account confirmations and notices)
• PostHog — Product analytics (usage measurement)
• Google Workspace — Email hosting for our support inbox and correspondence

At your direction. When you share a document or portal link, whoever has the link can see what’s on it, including your business details and the payment information you chose to show.

Legal reasons. If required by law, subpoena, or court order, or to protect the rights, safety, or property of our users, the public, or us.

Business transfers. If Stacked Systems LLC or the Service is sold, merged, or transferred, personal information may pass to the successor, which will be bound by this policy for that information.

We don’t sell or rent personal information, don’t share it for cross-context behavioral advertising, and don’t use it to train AI models.

We use three kinds of cookies and browser storage: sign-in cookies that keep you signed in (strictly necessary); a small preference cookie that remembers you’ve completed setup, kept for a year; and an analytics cookie set by PostHog on our own domain, which gives your browser a random ID so we can count visits and see which parts of the product get used. We don’t use advertising cookies or third-party tracking cookies, and no other company collects information about your activity across other websites through the Service.

We use PostHog to understand how the product is used: pages viewed, buttons and links clicked (including their labels), the referring page and campaign links, browser and device type, and approximate location from your IP address. This runs on every page, including the public document pages. Analytics events are keyed to the random browser ID and, once you sign in, to your user ID and email address, so we can see one person’s journey through the app. We don’t use analytics for advertising. You can block it with a browser tracking blocker or by disabling cookies for our site; the Service works without it.

We don’t sell or share personal information, so there is nothing for a “Do Not Track” or Global Privacy Control signal to opt out of, and we don’t otherwise change how the Service behaves in response to those signals.

Your account and everything in it stay for as long as your account is active. Delete your account from Settings and it’s removed immediately and permanently: your documents, clients, saved items, logo, and account, and every link you shared stops working. Backup copies age out on a short rolling window (typically within 30 days).

Some things last longer: Stripe keeps billing and transaction records for as long as its legal obligations require; server logs are kept for a short period (typically days); analytics events are kept by PostHog under its retention settings — email us and we’ll delete the events tied to your account; and we may keep records we need for legal, tax, or accounting purposes or to resolve disputes, for as long as those needs last.

You can see and correct your information in the app, export your documents and clients as CSV from Settings (and any document as a PDF), and delete your account from Settings. For anything else — a copy of your data, deleting specific information, objecting to or restricting processing, or withdrawing consent — email hello@mobileinvoices.app. We’ll respond within 30 days and may need to verify it’s you. We won’t treat you differently for exercising your rights.

California residents have the right to know what personal information we collect, use, and disclose (this policy), to have it deleted or corrected, and not to be discriminated against for asking. We don’t sell or share personal information, so there’s no opt-out to offer. You may use an authorized agent; we’ll confirm the request with you.

EU, UK, and other regions. Where local law applies, you also have the right to data portability and to complain to your data-protection authority; our legal bases are in section 3, and section 12 explains that the Service is operated from the United States.

Access to your data is enforced in the database itself, so one account’s records aren’t reachable by another; the only anonymous access is through the unguessable share links you create. Data is encrypted in transit, our providers encrypt it at rest, and passwords are stored only as salted hashes. If a breach affects you, we’ll notify you and any regulator as the law requires. No system is perfectly secure, so use a strong, unique password.

The Service is for businesses and their customers, not children: you must be 18 or older to have an account, and we don’t knowingly collect personal information from anyone under 13. If you believe a child has given us information, contact us and we’ll delete it.

We’re based in the United States and our providers store and process data there. If you use the Service from elsewhere, your information is transferred to and processed in the United States, where privacy laws may differ from those in your country. Where required, we and our providers rely on standard contractual clauses or other approved safeguards for those transfers.

We may update this policy as the product changes. If a change is material, we’ll give notice by email or in the app before it takes effect. The current version is always on this page, with its effective date at the top.

Stacked Systems LLC (the company behind Mobile Invoices)
hello@mobileinvoices.app