Privacy Policy

InvoiceStamp ("InvoiceStamp", "we", "us", "our") is a mobile-first invoicing and quoting platform available at www.invoicestamp.com and through our iOS and Android applications (together, the "Service").

The Service is operated by BIGBANG.MA, the primary legal data controller for Account Holder data under this policy. Our full company details are set out in Section 16 (Contact Us), and the governing law of this policy is set out in Section 14.

InvoiceStamp was built by a team with over 15 years of experience implementing and supporting enterprise ERP systems (including Sage, SAP, Cegid, and Odoo). We have seen first-hand what it costs a business to lose a single invoice — and we designed this platform, and this policy, around making sure that never happens to you.

We built InvoiceStamp on a principle of trust. Your business data — your clients, your invoices, your revenue — is among the most sensitive information you own. This policy explains, in plain language, what we collect, why we collect it, where it lives, and the rights you have over it.

The short version:

• We never sell your personal data. Ever. To anyone.
• Your data is stored in a secure, GDPR-compliant private cloud — not trapped on a single device.
• We collect only what is needed to run the Service, and we tell you exactly what that is below.
• You stay in control: you can access, export, correct, or delete your data at any time.

Because InvoiceStamp is a business tool, two different relationships exist, and your rights depend on which one applies to you:

• Account Holders ("you", "Customers"). Freelancers, agencies, and businesses who register for an InvoiceStamp account. For your personal data (your name, email, business details, billing information), we act as the data controller — we decide how and why it is processed, and you exercise your data rights directly with us.
• Invoice Recipients ("your clients", "End Clients"). The people and businesses your invoices, quotations, and sale orders are addressed to. When you enter a client's name, address, or email into InvoiceStamp, you are the data controller for that information, and we act as your data processor — we handle it strictly on your instructions to generate and deliver your documents. If you are an Invoice Recipient and wish to access, correct, or delete data held about you, please contact the business that invoiced you; we will assist them in fulfilling your request.

We practise data minimisation: we collect only what the Service genuinely needs.

3.1 Account & identity data. When you sign up, we use Firebase Authentication (a Google service) to manage your identity securely. Depending on your chosen sign-in method (email, Apple Sign-In, or Google Sign-In), this includes:

• Your name and email address
• A unique authentication identifier
• Your hashed credentials (we never see or store your password in plain text — authentication is handled entirely by Firebase's secure infrastructure)

3.2 Business profile data. Information you add to personalise your documents:

• Business name, address, VAT/tax registration numbers
• Your business logo and signature (stored as image files — see Section 5)
• Bank details or payment instructions you choose to display on invoices

3.3 Document & client data. Data you create while using the Service:

• Client records (names, addresses, emails, phone numbers)
• Products and services, prices, and tax rates
• Invoices, quotations, and sale orders, including line items, totals, and payment status
• Historical snapshots of documents, preserved for legal and accounting integrity (see Section 8)

3.4 Payment tracking data. Records of payments you log against invoices (partial or full amounts, dates, and methods). Note: InvoiceStamp records payment status; we do not process card payments ourselves and do not collect your clients' card numbers.

3.5 Subscription & billing data. If you subscribe to a paid plan, your purchase is processed by Apple (App Store) or Google (Play Store). We receive confirmation of your subscription status and tier — we never receive or store your full payment card details.

3.6 Technical & usage data. Collected automatically to keep the Service fast, secure, and reliable:

• Device type, operating system, and app version
• IP address and approximate (country-level) location, used for security and regional defaults (e.g. £ currency and DD/MM/YYYY formatting for UK users)
• Crash reports and performance diagnostics
• Push notification tokens (via Firebase Cloud Messaging), if you enable notifications

3.7 Support & communications data. If you contact us at contact@invoicestamp.com, we keep a record of your correspondence so we can help you effectively.

We do not collect special category data (health, biometrics, political opinions, etc.), and we ask that you do not enter such data into free-text fields of your documents.

Under the UK GDPR and EU GDPR, we must have a lawful basis for every use of your personal data:

Where we rely on legitimate interests, we have balanced those interests against your rights and concluded they are not overridden. You may object at any time (see Section 10).

Unlike apps that store your data only on your device — where a lost or broken phone means a lost business history — InvoiceStamp synchronises your data instantly to secure cloud infrastructure. Here is exactly how that works:

5.1 Storage & encryption

• Your structured data (clients, products, documents, settings) is stored in Cloudflare D1, a serverless database replicated across Cloudflare's global edge network. All connections use TLS encryption in transit, and records are protected with AES-256 encryption at rest on Cloudflare's infrastructure.
• Your file assets — business logos, signatures, and generated PDF invoices — are stored in Cloudflare R2 object storage, in access-controlled private buckets protected by AES-256 encryption at rest and TLS encryption in transit. Your files are never publicly listable; they are served only to your authenticated account.
• Your authentication state is managed by Firebase Authentication, with credentials and session tokens protected by TLS in transit and AES-256 at rest on Google's infrastructure. We never see or store your raw password.
• All server-side processing runs on Cloudflare's serverless edge platform, meaning requests are handled close to you for speed, with security controls (including cryptographic verification of system-to-system communications) applied throughout.

5.2 PDF rendering ("Papyrus" engine)

Your PDF documents are generated by our dedicated, enterprise-grade rendering engine, Papyrus. During generation, the document data required for rendering is processed strictly in volatile (in-memory) processing and is immediately purged once your PDF has been generated. Papyrus does not build a separate, persistent copy of your data: the only stored output is the finished PDF, which is written directly to your encrypted, private R2 storage described above.

5.3 Automated security scanning of uploaded media

To protect the integrity of the Service and the safety of all users, BIGBANG.MA reserves the right to scan uploaded media files — including business logos and signatures — using automated security tools. Where a scan identifies that an uploaded file contains malicious code, exploits, malware, or illegal content, we may immediately and permanently purge that file without prior notice. These scans are fully automated, are performed solely for security and legal-compliance purposes, and do not involve human review of your legitimate business content.

This architecture is a deliberate privacy choice: fewer servers to breach, no long-lived machines holding your data, and encryption applied by default.

We have a zero-tolerance policy on selling personal data. We do not sell, rent, trade, or broker your personal data or your clients' data to any third party, for advertising or any other purpose. Your invoicing data is your business asset, not ours.

We share data only in these limited circumstances:

6.1 Sub-processors (our infrastructure providers). We use a small, carefully chosen set of service providers who process data solely on our instructions, under data processing agreements:

Each provider is contractually bound to protect your data, use it only to provide services to us, and meet GDPR standards.

6.2 Legal requirements. We may disclose data where required by law, court order, or a binding request from a competent authority, or where necessary to establish, exercise, or defend legal claims, or to protect the vital interests of any person.

6.3 Business transfers. If BIGBANG.MA is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. Any successor will remain bound by this policy (or one offering equivalent protection), and we will notify you before your data becomes subject to a different privacy policy.

We do not share your data with advertisers, data brokers, or marketing networks. Full stop.

Your data is held on the global cloud infrastructure of Cloudflare and Google Firebase, which may store or process it in the United Kingdom, the European Economic Area, the United States, and other locations where those providers operate. Limited processing may also take place in Morocco, where our operating company (see Section 16) is based.

Wherever your data travels, we apply appropriate safeguards:

• Standard Contractual Clauses (SCCs) and, for UK data, the UK International Data Transfer Addendum, incorporated into our agreements with sub-processors;
• Transfer only of the minimum data necessary;
• Encryption of data in transit and at rest.

Our processing is governed primarily by Morocco's data protection framework, Law No. 09-08 (see Section 14), and we maintain full compliance mechanisms under the UK GDPR and EU GDPR for users in those territories — meaning your data benefits from more than one layer of statutory protection.

A note for Account Holders: you may have your own legal obligation (for example, under UK HMRC rules) to retain invoicing records for several years. Before deleting your account, use the export options in the app to download your documents.

We take a security-first approach appropriate to a financial data platform:

• Encryption in transit (TLS) for every connection between your device and our systems;
• Encryption at rest on Cloudflare and Firebase infrastructure;
• Private, access-controlled storage — your files and records are never publicly accessible;
• Industry-standard authentication via Firebase, supporting Apple and Google Sign-In so you can avoid password reuse entirely;
• Cryptographically verified system communications between our internal services;
• Data minimisation and least-privilege access within our team — access to production data is restricted and logged.

No system on the internet can be guaranteed 100% secure, and transmission of data is ultimately at your own risk. If you believe your account has been compromised, contact us immediately at contact@invoicestamp.com. In the event of a personal data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected users, in line with GDPR requirements.

If you are in the UK, EEA, or another jurisdiction granting similar rights (including under Moroccan Law 09-08), you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — correct inaccurate or incomplete data (most profile data can be edited directly in the app);
• Erasure — ask us to delete your personal data ("right to be forgotten");
• Restriction — ask us to pause processing while a dispute or verification is resolved;
• Portability — receive your data in a structured, commonly used, machine-readable format;
• Objection — object to processing based on legitimate interests, and to direct marketing at any time;
• Withdraw consent — where processing is based on consent (e.g. notifications, marketing emails), without affecting prior lawful processing;
• Complain — lodge a complaint with your supervisory authority. In the UK, this is the Information Commissioner's Office (ICO, ico.org.uk); in the EU, your national data protection authority; in Morocco, the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).

To exercise any right, email legal@invoicestamp.com from the address linked to your account. We may ask for reasonable verification of your identity, and we will respond within one month (extendable by two further months for complex requests, in which case we will tell you).

If you are an Invoice Recipient (a client of one of our users), please direct your request to the business that invoiced you — as their processor, we will help them honour it.

• The mobile apps do not use advertising cookies or third-party ad trackers.
• Our website (www.invoicestamp.com) uses strictly necessary cookies for core functionality and security, and may use privacy-respecting, aggregated analytics to understand overall site usage. Where any non-essential cookies are used, we will request your consent via a cookie banner and you can withdraw it at any time.
• We do not use tracking pixels for advertising retargeting, and we do not permit third parties to build advertising profiles from your use of InvoiceStamp.

InvoiceStamp is a business tool intended for adults. The Service is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at legal@invoicestamp.com and we will delete it promptly.

Invoices you send may contain links you add yourself (for example, your own payment links). Our website may link to third-party sites. We are not responsible for the privacy practices of third parties; please review their policies before providing them with your data.

Primary controller and governing law. The Service is operated by BIGBANG.MA, an entity incorporated under the laws of the Kingdom of Morocco with its registered office in Marrakech (full details in Section 16). BIGBANG.MA is the primary legal controller of Account Holder personal data. This Privacy Policy is primarily governed by, and shall be construed in accordance with, Moroccan Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data, under the supervision of the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel), with which processing is handled in accordance with applicable notification and authorisation requirements.

Your local rights are preserved. Nothing in this section limits, waives, or excludes the mandatory statutory rights of data subjects located in the United Kingdom or the European Economic Area. If you are in the UK or EEA, the UK GDPR and EU GDPR respectively continue to apply to our processing of your personal data in full, including your rights set out in Section 10, our use of Standard Contractual Clauses and the UK International Data Transfer Addendum for international transfers (Section 7), and your right to lodge a complaint with the ICO or your national data protection authority. These rights exist by operation of law and cannot be overridden by a choice of governing law.

Jurisdiction for legal proceedings. Subject to the mandatory rights above, any legal claims or proceedings arising out of or relating to this Privacy Policy shall be submitted to the competent courts of Marrakech, Kingdom of Morocco, and/or brought before the CNDP as the competent supervisory authority for BIGBANG.MA.

We may update this policy from time to time as the Service evolves (for example, when we launch our Web application). When we make material changes, we will notify you through the app or by email before the changes take effect, and update the "Last updated" date above. The current version will always be available at www.invoicestamp.com/privacy.

Questions, requests, or concerns about this policy or your data:

• BIGBANG.MA — InvoiceStamp Privacy Team
• Imm. 26 Bur. 9, Lot Houmane El Fetouaki 1, 40000 Marrakech, Morocco
• General: contact@invoicestamp.com
• Legal & data rights: legal@invoicestamp.com
• Phone: +212 707 777 2 777

We aim to respond to all privacy enquiries within 5 business days.