Privacy policy

Who runs Invilo

Name

HUAYRA LLC

Registered address

8206 Louisiana Blvd NE, Ste A #1761, Albuquerque, NM 87113, United States

Legal form

Single-member limited liability company organised under the laws of New Mexico, United States

Email

support@invilo.ai

Write to us at support@invilo.ai.

Whose data it is

For your own account (who you are, how you use Invilo and how you pay), Invilo is the controller of your data. For what your company puts in Invilo (its platforms, their sign-in details and its invoices), your company is the controller and Invilo processes that data on its behalf, only to provide the service.

What we collect

• Your account: name, email address, language, the avatar you choose, and your password, which our sign-in provider keeps only as a secure hash.
• Your company: its name and avatar, its team and their roles, and its billing details (legal name, tax ID, address and country).
• Sign-in details of the platforms you connect: usernames, passwords and other sign-in fields. They're encrypted as soon as you save them, never shown again, never written to logs and never shown to an AI model.
• Invoices: the files collected or uploaded and what they say (vendor, number, dates, amounts, taxes and currency). Invoices can contain personal data, such as a sole trader's name or address.
• Payments: Stripe handles your card. We keep only the plan, its status, the card's brand, last four digits and expiry date, and the invoices we issue to you.
• Technical data: IP address, browser, the country your connection comes from (to show the cookie notice and prices in your currency), and activity logs that keep the service secure.
• Messages: the emails we send you (sign-in links, notices when a platform needs you) and anything you write to us.

Why we use it, and on what legal basis

• To provide Invilo: create your account, connect your platforms, collect, read, file and deliver your invoices, and send the emails the service needs. Basis: our contract with you (GDPR art. 6(1)(b)).
• To keep Invilo secure and prevent abuse: logs, sign-in checks and the protection of credentials. Basis: our legitimate interest in a safe service (art. 6(1)(f)).
• To bill you and keep accounting and tax records. Basis: legal obligations (art. 6(1)(c)).
• To improve Invilo from how it's used as a whole, without advertising or tracking cookies. Basis: our legitimate interest (art. 6(1)(f)).
• Anything else only with your consent, which you can withdraw at any time (art. 6(1)(a)).

We don't sell your data, we don't use it for advertising, and we don't use your invoices or credentials to train AI models.

How the AI works with your data

Invilo uses AI to sign in to your platforms, find your invoices and read them. The AI never sees your passwords: they're typed into the sign-in page from a one-time link, one field at a time, and the computer it works on is wiped between jobs.

To read an invoice, its content is processed by our AI provider, only to provide the service to you.

Who we share it with

Only with the providers that run Invilo for us, under contracts that oblige them to protect it and to use it only on our behalf:

• Supabase: database, sign-in and file storage.
• Vercel: hosting of the website and the app.
• Stripe: payments and the invoices we issue.
• Resend: sending our emails.
• xAI: the AI that signs in to your platforms and reads your invoices.
• Google: only if you choose Google Drive as a destination, to save your invoices there; and, only if you accept analytics cookies, Google Analytics, to measure visits to our public website (never the app).

We may also share data when the law requires it, or with a buyer if Invilo is ever sold, under this same policy.

Transfers outside Europe

Some of these providers process data outside the European Economic Area, for example in the United States. When they do, the transfer is covered by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by the Standard Contractual Clauses it has approved.

How long we keep it

• Your account: while you have it. Deleting your account erases your personal data, and the companies where you were the only person go with it.
• Companies, platforms, credentials and invoices: until someone with permission deletes them, or the company is deleted.
• Billing records: as long as tax and commercial law requires.
• Security logs: only as long as they're needed to keep the service safe.

Security

Data travels encrypted. Platform credentials are encrypted as soon as they're saved and are never shown again. Each person sees only what their role allows, and every collection is recorded in the platform's activity.

Your rights

You can ask to access your data, correct it, erase it, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can do much of this yourself: edit your profile, download your invoices or delete your account in Settings.

If you think we've handled your data wrongly, you can complain to the data protection authority where you live or work. In Spain, that's the Agencia Española de Protección de Datos (aepd.es).

If you live in the United States

Under the CCPA/CPRA and similar state laws:

• In the last 12 months we collected the categories described above: identifiers (name, email, IP address), commercial information (plan and payments), professional information (company and role), internet activity (logs), and the log-in credentials of the platforms you connect, which are sensitive personal information.
• We collect them from you, from your company's team, from the platforms you connect and from our providers, for the purposes described above.
• We don't sell personal information or share it for cross-context behavioral advertising, and we never have. We use sensitive personal information only to provide the service you asked for.
• You can ask to know what we hold about you, to correct it and to delete it, also through an authorized agent. We'll verify your request and answer within 45 days. Using these rights never changes the service or the price you get.
• We honor Global Privacy Control signals. Since we don't sell or share personal information, there's nothing more to opt out of.

Children

Invilo is a service for businesses and isn't meant for anyone under 16.

Changes to this policy

If we change this policy, we'll update the date at the top. Before significant changes take effect, we'll tell you by email or in the app.

Contact

Write to us at support@invilo.ai.