Privacy Policy
Last updated: 2026-10-06
This policy explains what personal data the Invsy app collects, why, where it is stored, who else handles it, and your rights. It covers the Invsy app for iOS and Android and this website.
Who is responsible
Darmateq (organisation number 820523-4118), Mary Hemmings gata 32, Bunkeflostrand, Sweden, is the controller of your personal data.
Contact: support@darmateq.com
What we collect, and why
Your account
- Your email address and password, so you can sign in. Your password is stored by Firebase Authentication in a form we cannot read.
- A random account ID that the app creates for you. It identifies your data and your subscription; it contains nothing about you.
What you add to the app
- The invoices and subscriptions you enter: vendor or name, amount and currency, dates, invoice number, billing cycle and notes.
- The PDFs and photos you attach to invoices, including scans of paper invoices.
We use this only to provide the app to you: to show your invoices and subscriptions, calculate totals and insights, and keep them in step across your devices. The legal basis is the contract between you and us (GDPR Article 6(1)(b)).
Premium purchases
- If you buy Premium, Apple (App Store) or Google (Google Play) handles the payment. We never see your card or payment details.
- Our subscription service, RevenueCat, receives your account ID and the store's record of your purchase (which plan, when it started, renews or ends), so the app knows whether Premium is active on all your devices. RevenueCat does not receive your email address. Like any online service it also processes technical information such as the app version, operating system and IP address.
Legal basis: the contract (Article 6(1)(b)), and our legal obligations where purchase records must be kept (Article 6(1)(c)).
Keeping the service secure
- Firebase App Check asks Apple (DeviceCheck) or Google (Play Integrity) to confirm that requests come from a genuine copy of the app on a real device, to stop abuse of our servers. This uses technical device signals, not your content.
- Our providers keep short-lived technical logs (for example IP addresses and times of requests) to run and protect their services.
Legal basis: our legitimate interest in protecting the service and your data (Article 6(1)(f)).
What stays on your phone
- Scans and PDFs are read on your phone. The text in them is not sent anywhere.
- Reminders are scheduled by your phone's own notification system. They are not sent from our servers.
- Your theme choice (light, dark or the phone's setting) is stored only on your phone.
What we don't do
- No ads, no advertising IDs and no tracking across other apps or websites.
- No analytics and no crash-reporting tools.
- We don't sell your data or use it for marketing.
Where your data is stored, and who handles it
We use these service providers (processors). They may only use your data to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Google Firebase (Google Ireland Ltd / Google LLC) | Sign-in, database, file storage, App Check | Your invoices, subscriptions and files are stored in data centres in the EU. |
| RevenueCat, Inc. | Keeping track of Premium subscriptions | USA |
| Apple / Google | Payments for Premium, as the seller in their stores; device checks for App Check | Under their own privacy policies |
When data is handled outside the EU/EEA (RevenueCat, and parts of Google's and Apple's services), the transfer is protected by the EU Commission's standard contractual clauses and, where the recipient is certified, the EU–US Data Privacy Framework.
How long we keep it
- Your account and everything in it are kept for as long as you have an account.
- When you delete your account in the app (Account → Delete account), your invoices, subscriptions, attachments and sign-in account are deleted straight away. Copies in our providers' backups are removed according to their deletion schedules.
- Purchase records may be kept by Apple, Google and RevenueCat for as long as the law requires, for example for accounting.
Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you (access) and get a copy of it;
- have it corrected;
- have it deleted (you can delete your account and all its data yourself in the app);
- have its processing restricted, and object to processing based on our legitimate interest;
- get the data you gave us in a machine-readable format (data portability).
To use these rights, email support@darmateq.com. We answer within one month.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy.se.
Children
Invsy is meant for people aged 16 and over, and is not directed at children.
Changes to this policy
If we change this policy, we update the date at the top and, for important changes, tell you in the app before the change applies.