Privacy Policy

Effective date: 23 October 2026 · Contact: privacy@lexos.in

Who we are

InvoiceMaker (operated by Lexos) is an invoice creation service for businesses. This policy explains what data we collect, why we keep it, and your choices.

Data we collect

• Account: name, email address, password (stored as a one-way hash).
• Company profile: legal and trade names, addresses, tax registration numbers, contact details, logo, bank/payment text, invoice preferences (template, paper size, accent colour).
• Business records: customers, catalogue items, draft and finalized invoices, line items, tax calculations, payments, and audit logs.
• Public link telemetry: when someone opens a share link, we store a hashed IP address and user-agent string (not the raw IP) for abuse prevention.
• Technical: authentication tokens and basic server logs required to operate the service securely.

Purposes

• Provide invoice drafting, finalization, PDF generation, and share/verify links.
• Authenticate you and protect accounts against abuse.
• Meet accounting and legal integrity requirements (immutable finalized invoices and audit trails).
• Improve reliability and investigate security incidents.

Public links you create

When you share an invoice, anyone with the link can view it (and download a PDF) until you revoke the link. Draft share links show a DRAFT watermark. Do not put confidential data in a shared invoice unless you intend recipients to see it. Verification pages recompute the invoice content hash and show Verified or Tampered status.

Storage and security

Data is stored on our hosting provider’s servers (database and file storage outside the public web root for logos and PDF cache). Access to the API requires a bearer token. Passwords are hashed. We use prepared SQL statements and tenant scoping so one account cannot read another’s records. No payment card processing is performed by InvoiceMaker itself.

Retention

While your account is active, we retain your data so you can use the product. If you delete your account:

• Personal profile data (name, email, password, company contact fields, logos, customer PII) is deleted or anonymized.
• Share links are disabled and authentication tokens are revoked.
• Finalized invoices and audit records are retained in anonymized/archived form for legal and accounting integrity (the financial content and cryptographic hash remain so historical invoices stay verifiable). Live company and customer display names are replaced with anonymized placeholders.

You can start deletion from Delete account or via DELETE /api/v1/me while authenticated.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete personal data, and to object to certain processing. Contact us at the email above. Account deletion is the primary self-serve path for erasure of profile data, subject to the legal retention of finalized invoice archives described above.

Children

InvoiceMaker is intended for business users and is not directed at children under 16. We do not knowingly collect personal information from children.

Contact

Questions about privacy: privacy@lexos.in