Privacy Policy

Effective date: October 16, 2026

This policy describes how Free Invoice Maker ("freeinvoicemaker.app"), operated by adpena ("we", "us", "our"), collects, uses, and protects your personal data. We are committed to privacy by design. If you have questions, contact us at contact@adpena.com.

1. Data Controller

The data controller is adpena, reachable at contact@adpena.com. For GDPR purposes, we process personal data as a controller when you use the service, and as a processor when we store your invoice and client data on your behalf.

2. Data We Collect

What we collect depends on how you use the service:

Anonymous users (no account): Manual editing and PDF generation run locally, and drafts are stored in this browser via IndexedDB. Loading pages and using APIs still makes web requests; hosting and security systems process request metadata such as IP addresses and browser information. Importing files or choosing Read details sends the selected content for processing.

Registered users: When you create an account, we collect your email address for authentication (magic-link login). If you opt in to cloud sync, we store your invoice data, client data, and organization settings on our infrastructure.

Paying users: Stripe collects and processes your payment information. We receive your Stripe customer ID, subscription status, and payment history. We do not store credit card numbers or bank details.

Text reading: When you choose Read details, the text you entered is sent for parsing. Pasted tables use the application parser; prose descriptions use Cloudflare Workers AI and require sign-in. Review the result before applying it to your draft. Cloudflare describes its content handling, operational metadata, and limited retention exceptions in its Workers AI data usage policy.

x402 API access: If you use agent API calls via x402 micropayments, we record your wallet address and transaction hashes for billing reconciliation.

3. Lawful Basis for Processing (GDPR)

We process personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): To provide the service, process payments, and deliver transactional emails.
• Consent (Art. 6(1)(a) GDPR): For optional analytics and features where consent is requested. You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): For service security and abuse prevention.
• Legal obligation (Art. 6(1)(c) GDPR): Where required by tax, financial, or regulatory law.

4. Cookies and Analytics

Optional first-party analytics run only after you accept. They record broad page groups and actions such as saving a draft on your device or generating a PDF, without invoice content, document IDs or URL query strings. Signed-in events are associated with your account; anonymous events store a hash of the request IP for approximate counts. An IP hash is pseudonymous: it can link requests from the same connection and is not a reliable count of individual people. The site’s security policy blocks the external Cloudflare Web Analytics beacon. Declining analytics does not affect editing or free PDF downloads.

5. How We Use Your Data

• To provide and maintain the service, including cloud sync and invoice delivery.
• To authenticate you via magic-link email.
• To process subscription payments through Stripe.
• To send transactional emails via Resend: invoices, magic links, and payment reminders. We do not send marketing email.
• To parse files and text when you choose Import or Read details.
• To detect and prevent abuse, fraud, and security incidents.

6. Data Storage and Security

Cloud-synced data is stored on Cloudflare D1 (encrypted at rest) and Cloudflare R2 for file storage. Data is transmitted over TLS. We follow the principle of least privilege for infrastructure access. Cloudflare's data centers are located globally; for EU users, data may be processed in the EU or transferred to other regions under Cloudflare's DPA and Standard Contractual Clauses. You may request a copy of Cloudflare's Data Processing Agreement through us.

7. Data Retention

We retain your data only as long as necessary:

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Invoice and client data: Retained while your account is active. Available for export at any time. Deleted within 30 days of account deletion.
• Payment records: Retained for 7 years as required by tax and financial regulations.
• Text-reading results: Applied results become part of your draft and follow its local or account storage. Processing by Cloudflare Workers AI follows the provider policy linked above, including its operational metadata and limited exceptions.
• Optional analytics: Daily cleanup targets events older than 90 days, in bounded batches. Unsent browser events expire after one hour; withdrawing consent clears unsent events.
• Security logs: Retained for up to 90 days for incident investigation.

8. Third-Party Processors

We share data with the following processors, strictly to operate the service:

• Cloudflare — Hosting, data storage (D1, R2), AI processing, and analytics.
• Stripe — Payment processing.
• Resend — Transactional email delivery (invoices, magic links, payment reminders).

We do not sell, rent, or share your personal data with advertisers or data brokers. Each processor is bound by a Data Processing Agreement.

9. Your Rights (GDPR and Applicable Law)

If you are located in the EU/EEA, UK, or another jurisdiction with applicable data protection law, you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing under certain conditions.
• Port your data in a structured, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email contact@adpena.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

10. International Transfers

The service runs on Cloudflare's global edge network. Your data may be processed in data centers outside your country of residence. For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, as incorporated in our processors' DPAs. You may request copies of applicable SCCs by contacting us.

11. Children's Privacy

The service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email (for registered users) or by posting a notice on the service at least 14 days before they take effect. The effective date at the top of this page will be updated accordingly.

13. Contact

For privacy-related questions, data subject requests, or to request DPA documentation, contact us at contact@adpena.com.