Privacy policy

Welcome to InvoiceOnGo by Waveclues ("we," "our," or "us"). We are committed to protecting your privacy and ensuring your business data remains safe. This policy outlines how the mobile application collects, uses and safeguards information when you use our GST billing and invoicing service.

1. Information the app holds

• Business information: business name, GSTIN, address, logo, contact number and email address, used to generate your invoices.
• Transactional and client data: client names, phone numbers, addresses, product and service details, prices, and the invoice records you create in the app.
• Device information: device model and OS version, where needed for support and bug fixing.

2. How that information is used

Solely to deliver the billing service: generating GST invoices and reports, letting you back up your own data to a location you choose, and improving the app's stability.

3. Storage and security

Your business and customer data is stored on your device, in the app's own storage. Backups are written to the destination you pick - your Google Drive, OneDrive, Dropbox or local storage - and go directly there. We do not sell, rent or monetise your financial or client data, and we do not receive a copy of it.

4. Third-party services

Google Play handles purchases. If you choose to configure the optional AI tax assistant with your own API key, the item description text for that one suggestion is sent to the provider and address you saved that key for, and nowhere else. The app has no analytics, no advertising and no crash reporting.

5. Contact

Questions about this policy: support@waveclues.com.

This section applies to the InvoiceOnGo web app at invoiceongo.in and to the optional account and sync feature in the Android app. If you use the Android app without signing in, the policy above applies and none of this does: your data stays on your phone. Our Terms of Use also apply.

1. What we store

When you use the web app, or sign in to sync, we store on our server:

• Your account: your email address and name (from Google sign-in).
• Your business records: business profile, customers, items and their stock (opening stock, manual adjustments and the movements from invoices), invoices, quotations, credit notes and the payments recorded against them, and your settings. If you use sync, the Android app sends these to the server and the server sends back changes made on other devices or on the web.
• Which devices you use: a short name and a letter for each phone or browser that syncs (the letter appears inside invoice numbers, for example INV-2026-27-P001), and when each last synced.
• Sync bookkeeping: a change counter, a record that something was deleted (so the deletion reaches your other devices), and any open conflict between two versions of the same record until you choose one.
• Documents we generate for you: invoice PDFs.
• Pro status: a record that your Pro purchase was verified with Google Play (the purchase token and the result), so we can tell whether sync is allowed.
• Security records: sign-in attempts with the time and IP address (to stop password guessing), and the session token that keeps you signed in.

Not sent to us: your saved digital-signature certificate and its password, your AI key and your app lock, which stay on your phone.

2. Google sign-in

When you sign in with Google we receive your email address and name, and nothing else from your Google account. We never see your Google password. We use them only to create and recognise your account. On the web app, the sign-in page loads a script from Google to show the Google button, so Google learns that your browser opened that page; nothing is loaded from Google on any other page.

3. Where it is kept

On servers of our hosting provider, Hostinger. Data is sent over HTTPS. We and our hosting provider keep backups to recover from failures; deleted data can remain in backups for a limited time.

4. Who can see it

• You. Your records are visible only to your account.
• The administrator of the service cannot open your documents from the admin console. They can open one only if you share it with "Allow admin to review this" (seven days, you can take it back). In an emergency they can open one without that, which is a separate, recorded action.
• Technically, whoever runs the server and the hosting provider can reach the database. We do not look at your data except as above, and we do not sell, rent or share it.

5. What we do not do

The InvoiceOnGo web app and the Android app contain no analytics, no advertising and no crash reporting, and we do not sell your data. The browser keeps your sign-in session and an offline copy of your records in its own storage on your device; you can clear it by signing out or clearing site data.

5b. The waveclues.com website

Visiting our website needs no account. If you agree in the banner, we use Google Analytics to count visits and which pages are read: it sets cookies and sends usage data (pages viewed, approximate location, browser and device type, and your IP address) to Google. If you decline, do nothing, or your browser sends the "Do Not Track" or "Global Privacy Control" signal, nothing is loaded and nothing is collected. You can change your choice any time from "Analytics choices" in the footer, which also removes the cookies. We do not use it for advertising.

6. How long we keep it, and deleting it

Your records are kept while your account is active. Deleting a customer, item or draft on one device deletes it on your others; a small record of the deletion is kept so that it reaches them. If you and another device change or delete the same record while apart, the app shows you both versions and asks which to keep; the one you do not choose is discarded. Issued invoices are never deleted by sync.

If your Pro purchase is refunded or charged back, sync pauses and you can still view and download your data for a grace period, currently 30 days; after that we delete the server copy. Your phone keeps its own copy and your account stays. You can delete your data earlier, or your whole account, from Settings in the web app ("Delete my data" / "Delete my account") or from Settings → Sync in the Android app (data only), or by emailing support@waveclues.com.

7. Your choices and rights

You can ask us to correct or delete your data, and to give you a copy, and you can raise any question or complaint about your data, by writing to support@waveclues.com.

8. Changes

If we change this policy we will update the date above and, for material changes, tell signed-in users.