CySo Invoicing - Privacy Policy

Last updated: 13 October 2026

Summary

This summary restates the key points of this policy; the full sections below apply.

1. Who We Are

CySo Solutions Ltd ("we", "us", "our") is the data controller for CySo Invoicing, accessible at invoice.cysosolutions.com. We are a company registered in the Republic of Cyprus (EU). Contact: [email protected]

2. The Most Important Thing You Should Know

We do not store your invoices, quotations, receipts, or any of your business documents on our servers.

There are only three exceptions, and all stay off unless you switch them on: giving your accountant access through CySo Flow (§3.8), connecting an AI app such as Claude or ChatGPT (§3.9), and syncing with your own CySo Flow account (§3.11). An AI gets your data only after you enable it by creating a connector key - never before, and never more than that key allows.

All documents you create are saved directly to your own device (browser local storage / IndexedDB) and, if you choose, to your own cloud storage account - Google Drive, OneDrive, Dropbox, a WebDAV/NAS server you control, or on-device only. We never store those files, and we never receive or transmit them - with one exception: when you use WebDAV/NAS storage from the web app, your files and credentials are relayed through our server in transit to reach your NAS (a browser cannot connect to it directly); we do not store them, and the Android app connects directly with no relay. See §3.4 and §8.

If you connect a cloud provider, the app also writes a single backup file containing your clients, invoices, quotations and receipts to your own cloud account, so you can restore them on another device. This backup goes only to the storage you control - never to CySo. By default it is stored in standard form; if you set an optional backup passphrase in Settings, the backup is encrypted on your device with AES‑256 (AES‑GCM) before it leaves it, so that no one - not even your cloud provider or CySo - can read it without that passphrase. We cannot recover a lost passphrase. Either way, keep your cloud account secure.

The only personal data we hold is what is strictly necessary to run your account: your authentication details, your app settings, and (temporarily) data needed for the quotation approval feature.

3. What Personal Data We Collect and Why

3.1 Account and Authentication Data

When you create an account: email address, name (if Google OAuth), authentication token (Firebase Auth).
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR). Retention: Active account lifetime; deleted on account deletion.

3.2 App Settings and Preferences

Stored in Firestore so your setup follows you across devices: your business identity and contact details (business name, address, business email, website and any social links you add), your bank details for display on invoices (IBAN, BIC, account holder, bank name), your accountant's email address if you set one, your invoice/quotation/receipt templates and any custom terms & email templates you write, numbering preferences and counters, and which cloud-storage type you chose (and, for Google Drive, that account's email address). We do not store the content of your invoices, quotations, receipts, or your customers' records here.
Legal basis: Performance of a contract (Art. 6(1)(b)). Retention: Deleted on account deletion.

3.3 Temporary Quotation Approval Data

When you share a quotation for client approval, we temporarily store the line item descriptions, amounts, VAT, any notes, and a unique random approval token. We do not add your customer's name or contact details to this approval record - only the line items you wrote, the amounts, VAT and any notes are included (anything you type into a line-item description is stored as written). If your client signs to approve, their drawn signature is stored on the approval record until it is deleted.
Your client needs no account to approve. We do not collect or use their data for any other purpose.
Legal basis: Performance of a contract (Art. 6(1)(b)). Retention: Maximum 60 days, then deleted.

3.4 Cloud Storage Connection

If you connect cloud storage, the app reads and writes your files and backup there. How that connection is kept depends on the provider. Dropbox and OneDrive, and Google Drive connected on the website, are each kept as a renewable access credential (refresh token) stored encrypted on our server (Cloudflare KV); the app itself holds only a short-lived access token in memory. In the Android app, the Google Drive connection is kept on your phone; if Google Drive was connected in a browser the older way, its short-lived token stays in that browser session. These credentials are used only to keep you connected to the storage you chose and - only if you allow it for an AI connector key (§3.9) - to read your app backup and saved PDFs there. Disconnecting the storage in the app, or deleting your account, deletes the stored credential from our server. If you connect Google Drive we also store the email address of that account in your settings, so you can sign in to the same account on another device. For WebDAV, your server URL and username are stored on your device and your password is encrypted on your device (AES‑GCM, using a key that is generated on and never leaves your device); they stay there until you disconnect or clear browser data. When you use WebDAV from the web app, a browser cannot reach your NAS directly, so those requests - including these credentials and the backup data - are relayed through a CySo server function to your server; they pass through our server in transit and are not stored. The Android app connects to your NAS directly, with no relay. You are responsible for the security of your device.
Legal basis: Performance of a contract (Art. 6(1)(b)).

3.5 Email Sending (Optional)

If you enable email sending and provide your own SMTP server details, your password is encrypted and stored on our server (Cloudflare KV) so it never remains on your device. It can be decrypted only inside the serverless function that sends your email; it is never returned to the app and CySo never holds it in readable form. Your host, port, username and sender address are stored alongside it. When you send an invoice by email, that function uses these details solely to relay that one email to your SMTP server on your behalf; the message itself is processed transiently and is not stored. We recommend using an app-specific password. You can remove these details at any time by disabling email sending.
Legal basis: Performance of a contract (Art. 6(1)(b)).

3.6 Push Notifications (Optional)

If you turn on notifications (in Settings) - for example, to be alerted when a client accepts a quotation - we register a device push token via Firebase Cloud Messaging (FCM) and store it, together with your platform (web/Android) and a truncated browser/device identifier (User-Agent), in Firestore so we can deliver the notification to your device. We do not use this for tracking or advertising. You can disable notifications at any time in your device or browser settings. If you also turn on the reminder for when a recurring invoice is due and choose "Push to all my devices", we additionally store a minimal reminder schedule - the invoice number, its due date, its amount and your chosen language - in Firestore so the daily reminder can be sent; we never store the invoice content, line items or your customer's details, and it is deleted when you switch the reminder off, change it to on-device, or the invoice stops recurring. If you keep the default on-device reminder, nothing about your recurring invoices is stored on our servers.
Legal basis: Consent (Art. 6(1)(a) GDPR). Retention: until you disable notifications, the token refreshes, or you delete your account.

3.7 Administrator Sign-in Approval (Security)

For accounts with administrative access, a sign-in from a new device must be approved by email before it is allowed. To help you recognise the sign-in and protect the account, we collect your IP address and a truncated browser/device identifier (User-Agent) at the moment of sign-in and include them in the approval email sent to the account's own email address. If you approve the device, a one-way hash of a device identifier is stored so you are not asked again from that device. This applies only to administrator sign-ins, not to ordinary user accounts.
Legal basis: Legitimate interest in account security and preventing unauthorised access (Art. 6(1)(f) GDPR). Retention: the pending approval record (including the IP address) is automatically deleted after 15 minutes; an approved-device hash is kept for 30 days, then expires.

3.8 Pairing with CySo Flow (Optional - Accountant Access)

If, and only if, you use Settings > Connectors & API keys > CySo Flow, we store a copy of the document types you tick on our servers so that the accountant you connect can read them in CySo Flow. This is one of only two cases in which invoice and expense data reaches us (the other is §3.9); it is entirely your choice and it is off unless you turn it on.
What we store: only the categories you tick - invoices (number, dates, amounts, VAT, paid status, line descriptions, credit applied), receipts, credit notes (number, date, amounts, VAT, the invoice they credit, and the reason you gave), expenses (supplier, category, amount, VAT), quotations, and, if you tick it separately, your clients' names and VAT numbers only. What we never store: receipt or job photos, signatures, PDFs, jobs, service reports, and your clients' email addresses, phone numbers and notes.
Legal basis: performance of a contract at your request (Art. 6(1)(b) GDPR); you remain the data controller for your clients' data and CySo acts as your processor. Retention: the copy exists only while at least one accountant connection is active. Nothing is uploaded before an accountant connects, un-ticking a category deletes it at the next sync, and revoking the last connection deletes the entire copy from our servers. You can see who has access, and revoke it, at any time on that screen.

3.9 AI Connectors (Optional - Paid Plans)

An AI gets your data only after you enable it. Nothing is shared with any AI unless you yourself create a connector key in Settings > Connectors & API keys and connect an AI app (for example Claude or ChatGPT) with it. Each key decides exactly what that AI may do - read, create, send or record payments - and you can change or revoke it at any time; a change or revocation applies to the AI's very next request.
What we store: while you have at least one key, the app uploads to our servers a copy of your invoices, quotations, receipts and expenses, and of your clients' names and VAT numbers only, so that the AI you connected can read them. We also keep a record of each request that AI makes (what it asked for, whether it was approved, and the result) so you can review it. What we never store or share: your clients' email addresses, phone numbers and postal addresses, photos, signatures, PDFs and your email password; the AI can never choose who an email is sent to. Text you typed yourself (subjects, notes, line and expense descriptions, suppliers) is copied and shared as written.
Client names: you can set a key to hide your clients' names from that AI (it then sees pseudonymous codes such as "Client 7F3A" and no VAT numbers, and document PDFs and share links are not available with that key). This is pseudonymisation, not anonymisation: the names are still in the copy on our servers, and text you typed yourself (subjects, notes, descriptions) is not hidden. Switching on "Get document PDFs" for a key asks you to confirm, because PDFs show client contact details.
Your own cloud storage: if you have connected Google Drive, Dropbox or OneDrive in the app and switched this on for a key, the connector may also read, only to answer that AI, (a) the app's automatic backup there - when it is newer than the copy above it refreshes that copy, through the same filter (client names and VAT numbers only); a backup protected with your backup passphrase is never read - and (b) the PDF of an invoice, quotation or receipt the app saved there, which is passed to the AI at its request and is not kept on our servers. Such a PDF shows what is printed on the document, including your client's email and postal address - this is the one exception to the "never share" rule above, and it applies only to keys you allow to get PDFs. We never write to, change or delete anything in your storage, and we never create PDFs.
Links to a PDF: if you allow it for a key (together with getting PDFs), the AI can create a link to one document's PDF for your client. Anyone who has that link can open the PDF - read from your storage at that moment and never stored by us - for 7 days, or until you cancel it in Settings > Connectors & API keys; if you allow sending, the AI can have the app e-mail it to the client's saved address. The AI can also get a 15-minute download link for its own use. We keep a fingerprint of each link (not the link itself, except in encrypted form so the AI or the app can hand it over), which document it points to, which key made it, its dates and number of opens; revoking that key, or deleting the AI data, makes it stop working and deletes it.
Who receives it: the AI provider you connect receives only what that AI reads with your key, at your instruction, under that provider's own terms; it is a service of your own choosing.
Legal basis: performance of a contract at your request (Art. 6(1)(b) GDPR); you remain the data controller for your clients' data and CySo acts as your processor. Retention: the copy exists only while you have at least one key and a paid plan - revoking your last key or the end of your paid plan deletes it from our servers; request records are kept for up to 30 days and are deleted when you revoke your last key or your plan ends; deleting your account deletes all of it.

3.10 Client Sign-up Links and Recurring-Invoice Reminders (Optional)

If you share a client sign-up link, what your prospective client types into it (name, company, email, phone, address and the time they consented) is stored in your account until you accept or delete it in the app, or your account is deleted. If you turn on reminders for recurring invoices, we store the schedule (invoice number, due date and amount) so our server can remind you on the day. Legal basis: Performance of a contract (Art. 6(1)(b)); for your clients' data you are the controller and we are your processor (Terms, Annex). Retention: until you delete the item or your account; both are included in your data export.

3.11 Two-way Sync with Your Own CySo Flow Account (Optional)

If, and only if, you paste a sync key from your own CySo Flow account into Settings > Connectors & API keys > Sync with my CySo Flow account, your customers (name, e-mail, phone, address, VAT number, notes), products (name, SKU, description, category, unit, prices), quotations, invoices, receipts, credit notes and expenses are copied into that Flow account, and changes made there are copied back here. CySo Flow is another CySo Solutions Ltd service; the copy in Flow is held under the CySo Flow Privacy Policy, in the account you control. Photos, signatures, jobs, service reports and stock counts are never sent, and nothing from Flow's other areas (workshop, staff, accounting) comes into this app.
The key is kept only on your device, never in backups, exports or error reports. Legal basis: performance of a contract at your request (Art. 6(1)(b) GDPR); for your clients' data you remain the controller and CySo acts as your processor in both apps. Stopping: "Disconnect" stops this device; deleting the key in CySo Flow stops every device at once. Data already copied stays in each app until you delete it there.

4. What We Do NOT Collect

We never collect, receive, or store: PDF files (except a PDF from your own storage passed to an AI you connected, see §3.9, which is not kept), payment card numbers, tracking/analytics data, or advertising identifiers. We also never collect invoice contents, customer personal data from invoices, or financial data - with the only exceptions of §3.8, §3.9 and §3.10, where you have explicitly switched on accountant access or an AI connector, for as long as you keep it on.

5. Cookies and Local Storage

We use strictly necessary session cookies (Firebase Auth) and browser IndexedDB/local storage on your own device. To protect the service from abuse we also load Google reCAPTCHA, which is a Google service that sets its own cookies and analyses interaction signals on its servers (Google's Privacy Policy applies). We use no advertising cookies.

6. Our Data Processors

We use the following third-party processors, each bound by data-processing terms (with EU Standard Contractual Clauses where data leaves the EEA):

Services you connect yourself - these are not our processors; you choose them and their own terms apply:

6B. Error Monitoring

To keep the app reliable, technical error reports (a description of the error, the page address, app version, and your account identifier) may be sent to our self-hosted error-monitoring service at sentry.cysosolutions.com. These reports are configured not to include invoice content, customer data, or session recordings, and a sample of performance timings is collected. Legal basis: Legitimate interest in maintaining a secure, working service (Art. 6(1)(f)). Authorized CySo staff may view aggregated, anonymized operational metrics (such as user counts by plan and AI-usage totals) and these error reports through an internal admin console to administer the service; that console does not expose your invoices, customers or documents; emails in the activity log and error reports are masked, though staff can view the email addresses of users granted complimentary ("free-forever") access in order to manage those grants. These operational records are automatically deleted after 90 days.

7. International Data Transfers

Firebase/Google, Cloudflare and Stripe may process data on servers outside the EEA (e.g. the United States). Such transfers are made lawful under GDPR via Standard Contractual Clauses incorporated in each provider's data-processing terms. Our encrypted backups stored on Google Drive may also be held outside the EU; these are protected by the EU-US Data Privacy Framework and Standard Contractual Clauses. See firebase.google.com/support/privacy.

8. Data Security

All data uses TLS encryption in transit. Storage connections kept on our server (Dropbox, OneDrive, and Google Drive connected on the website) are stored encrypted (see §3.4); your WebDAV password is stored encrypted on your device (AES‑GCM, non‑extractable device key). WebDAV used from the web app is relayed through our server in transit (see §3.4); otherwise these credentials are never sent to CySo. The full-data backup written to your own cloud is stored in standard form unless you set a backup passphrase, in which case it is encrypted on your device with AES‑256 before upload; the security of your cloud account remains your responsibility. Firestore Security Rules prevent cross-user data access. We do not log invoice content.

9. Your Rights Under GDPR

Access: Request a copy of your account data. Rectification: Correct settings in-app or contact us. Erasure: Delete your account to permanently remove all data we hold - your settings, subscription record, approval links, your stored email (SMTP) and cloud-storage credentials (Google Drive, Dropbox, OneDrive), and all AI connector data and PDF links; accountant access through CySo Flow is disconnected and Flow is asked to delete its copy (if Flow cannot be reached at that moment, revoke accountant access in Settings > Connectors & API keys before deleting your account). Operational security logs are deleted automatically within 90 days, and encrypted backup copies expire within 6 months. Your documents in your own cloud are not deleted by default, but the deletion screen lets you choose to erase your cloud backup at the same time. Portability: export your invoices and receipts from the Invoices → Export tool, or request a full machine-readable copy of your account data by contacting [email protected]. Object / Restrict: Contact [email protected]. Complaint: As we are established in Cyprus, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy), or with the supervisory authority in your own EU country (see edpb.europa.eu).

Response time: 30 days. Contact: [email protected]

10. Children's Privacy

CySo Invoicing is not intended for anyone under 18. Contact us to report a minor's account.

11. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it last changed.

12. Contact Us

CySo Solutions Ltd  ·  [email protected]  ·  cysosolutions.com

CySo Solutions Ltd · [email protected] · Other languages: Ελληνικά / Русский