Privacy policy

Invoice Studios, trading as Document Studio AI, is the data controller for the personal information described in this notice. This means we decide why and how that information is used. Contact us through our Contact page with privacy questions or requests.

Information we collect. We may collect your name, email address, account credentials, company and contact details, documents and images you upload, saved Brand Kit information, order and subscription records, download activity, support messages, feedback, IP address, device information, and service usage or diagnostic data. We do not receive or store your full payment-card details.

How and why we use it. We use account, document, order, and contact data to provide the service, save and deliver documents, fulfill purchases, manage subscriptions, and provide support. We use security and usage data to prevent fraud, protect accounts, diagnose problems, and improve the service. We use an email address for product updates or marketing only where permitted, and you can unsubscribe at any time.

Legal bases. Where applicable, we rely on performance of our contract to provide accounts, purchases, subscriptions, Studio, and support; legitimate interests to secure and improve the service and prevent fraud; consent for optional marketing and non-essential cookies; and legal obligations for tax, accounting, regulatory, and dispute records.

Payments and sharing. Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders and processes sales, subscriptions, payments, tax, invoicing, customer service inquiries, and returns under its own privacy practices. We may also share only the data needed with hosting, storage, analytics, email, AI, and support providers; professional legal or accounting advisers; and authorities where required by law. We do not sell or rent personal information.

Retention. Account information and saved documents are kept while your account is active and are deleted or anonymized within 90 days after a valid deletion request, unless they must be kept longer. Support and diagnostic records are generally kept for up to 24 months. Order, subscription, tax, and accounting records may be kept for up to seven years where legally required. Backups are deleted on their normal secure rotation schedule.

Security. We use appropriate technical and organizational safeguards, including encrypted connections, access controls, private user file storage, account authentication, least-privilege permissions, and monitoring. No internet service can guarantee absolute security.

Cookies. Essential cookies and local storage keep you signed in, protect checkout, and remember necessary settings. If analytics or marketing cookies are used, they are managed through applicable consent choices. You can also control cookies in your browser, although blocking essential cookies may prevent parts of the service from working.

International transfers. Some service providers may process data outside your country. Where required, we use recognized safeguards such as adequacy decisions or standard contractual clauses.

Your rights. Depending on where you live, you may request access, correction, deletion, restriction, or portability of your information; object to certain processing; withdraw consent; or complain to your local data protection authority. Where UK or EEA law applies, we normally respond within one month. Submit a request through our Contact page. Some information may be retained where the law requires it or where needed to establish or defend legal claims.