Privacy Policy

1. Who we are

The controller of your personal data is Individual Entrepreneur Baran Yildiz, registered in Georgia (we, us), Bakhtrioni Street N22, Apartment N75, Saburtalo District, Tbilisi, Georgia.

For any question or request about privacy, write to support@invenva.com from the email address of your Invenva account, or include it, so that we can find your data.

2. What we collect

We collect personal data that you give us, data the Service collects while you use it and data we receive from others, such as:

Account data: your name, email address and profile photo from Apple or Google when you sign in, a contact email and photo you add, your language, time zone and plan, and the answers you give when you start using the Service.

Content: what you and your team enter, such as workspaces, items, prices, photos, notes, stock movements, lists, counts, balances and loans, business details, and the names and details of customers, suppliers, staff and other people.

Usage and device data: the screens you open and the actions you take, errors and crash reports, your app version, device, operating system, browser and IP address, and identifiers of your device, browser and app installation.

Purchase data: your plan, its status and its history, from Apple, Paddle and RevenueCat. Payment details are handled by Apple and Paddle.

Messages: what you send us, such as support requests and feedback, and our replies.

Device features: access to your camera, photos and location when you allow it, to scan barcodes, attach photos and place map pins.

Data from other users, who may enter your name or details, for example as a customer, a supplier or a member of their team.

3. How we use it

We use personal data to provide, sync and secure the Service and your account, workspaces and subscriptions, and to support you.

We use it to keep the free plan and free trials to one per person, to keep suspended accounts out and to prevent fraud and misuse.

We use it to understand how the Service is used, to fix problems, to improve the Service and to build new features for it, including features that use artificial intelligence.

We use it to send you messages about the Service and your account, such as the notifications you turn on, and to send you news, tips and offers about Invenva, which you can unsubscribe from at any time.

We use it to measure how well our marketing and advertising work, to handle refunds, payment disputes and legal claims, and to meet our legal obligations.

4. Legal bases

Where the GDPR or a similar law applies, we rely on: performance of our contract with you, to provide the Service and your subscription; our legitimate interests in running, securing, improving, developing and marketing the Service, in preventing misuse and in handling refunds, payment disputes and legal claims; your consent, where the law requires it, for example for device permissions, some marketing messages and our answers to Apple about refunds (section 7), which you can withdraw at any time; and our legal obligations.

You need to give us your sign-in details to use the Service. Everything else is optional, but some features do not work without it.

5. Your right to object

Where we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation, by writing to support@invenva.com. You can object to marketing at any time, for example with the unsubscribe link in our emails.

6. Who we share it with

Members of your workspaces see your name, photo, contact email, role and what you do in those workspaces, and the history of a workspace keeps your name on the entries you made. The workspace owner decides who is a member and what each member may do.

Service providers run parts of the Service for us, such as hosting, databases, analytics, crash reporting, notifications, email, payments, subscription management, customer support and AI tools. Our main providers are Google (Firebase, including Google Analytics for Firebase and Crashlytics, and Google Maps in the Android app), Cloudflare (hosting, Turnstile bot protection, web analytics and photo storage), Apple, RevenueCat and Hostinger (email). Google Analytics for Firebase collects usage events, such as screens, actions, in-app purchases and an approximate location, linked to identifiers of the app installation and the device.

Apple, Google and Paddle act as independent controllers, under their own privacy policies, for app store purchases, sign-in, maps and payments on invenva.com.

We may also share personal data when the law requires it, to protect the rights and safety of users, others or the Service, with your consent, or with a buyer or successor if the Service or our business is transferred.

Where the law or app store rules require your permission before we share personal data, for example with an AI provider, we ask for it. Every third party with whom we share personal data provides the same or equal protection of that data as this policy states, under its contract with us or under its own privacy commitments.

We never sell personal data.

7. Refund requests

If you ask Apple for a refund, Apple may ask us about the purchase. With your consent (section 6 of our Terms of Service), we, or RevenueCat for us, may answer with information about the purchase and your use of the Service and with our view on your request. Apple decides on the refund. You can withdraw this consent at any time by writing to us, and we then stop answering for your purchases.

If you ask Paddle for a refund, or dispute a payment with your bank or card issuer, we may give Paddle information about the purchase and your use of the Service so that the request or the dispute can be handled.

8. Personal data you enter about others

When you enter personal data about other people, such as your customers, suppliers or staff, you are the controller of that data and we process it for you as your processor, as section 8 of our Terms of Service describes. You are responsible for having a lawful basis for it and for informing those people.

9. International transfers

We are established in Georgia, and our providers process data in the United States, the European Union and other countries. Where the law requires safeguards for such transfers, we rely on recognised mechanisms, such as the EU-US Data Privacy Framework and the European Commission’s Standard Contractual Clauses, or their UK and Swiss equivalents.

10. How long we keep data

We keep personal data for as long as your account exists and for as long as we need it for the purposes in this policy. When we no longer need it, we delete it or make it anonymous.

Some data is kept after content or an account is deleted, where we need it to sync deletions across devices, to keep the free plan and free trials to one per person, to prevent misuse, to handle disputes and legal claims or to meet legal obligations, for example records of free plan use, suspensions and messages. Backups are kept for a limited time. Apple, Paddle and RevenueCat keep purchase records under their own policies.

11. Your rights

Depending on where you live, including under the GDPR and UK GDPR, the Swiss Federal Act on Data Protection, the Law of Georgia on Personal Data Protection, the Turkish Personal Data Protection Law (KVKK), the Brazilian LGPD and the privacy laws of US states, you may have the right to access, correct or delete your personal data, to restrict or object to its use, to receive it in a portable form, to withdraw a consent you gave and to complain to a data protection authority, such as the one where you live or the Personal Data Protection Service of Georgia.

You can delete your account in Settings in the iOS app, the Android app or the web app, or as described at invenva.com/delete-account. For other requests, write to support@invenva.com. We may ask you to confirm your identity. If you are a member of someone else’s workspace, requests about that workspace’s content may need to go to its owner.

12. Cookies and browser storage

The web app keeps data in your browser, such as your sign-in session, an offline copy of your data, drafts, preferences and an identifier of your browser, using local storage and IndexedDB, so that it starts quickly and works offline. Visits to the website and the web app are counted with Cloudflare Web Analytics, which does not use cookies. Cloudflare, the Apple and Google sign-in windows and Paddle’s checkout may use cookies needed for security, sign-in and payments.

13. Security

We use technical and organisational measures to protect personal data, such as encryption in transit and access controls. Photos are stored at long, random addresses, and anyone who has such an address can open the photo. No system is perfectly secure, so please keep your Apple or Google account protected and tell us if you believe your account has been misused. If a personal data breach affects you, we inform you and the authorities where the law requires it.

14. Children

The Service is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data of children under 16; if you believe a child has created an account, contact us and we will delete it.

15. Changes to this policy

We may change this policy at any time. The version published here applies from its date, unless it says otherwise.

16. Contact

Individual Entrepreneur Baran Yildiz, registered in Georgia, Bakhtrioni Street N22, Apartment N75, Saburtalo District, Tbilisi, Georgia. Email: support@invenva.com.