Privacy policy.

The short version: we collect what we need to make your invoices and quotes and to run your account. We don't sell your information or use it for advertising. Your photo is sent to our AI provider to read the job, and we don't keep it. You can delete your account and everything in it yourself, any time.

Who we are

Invoice & Quote (invoiceandquote.com) is run by TradieNotes Limited, a company registered in New Zealand. In this policy, "we" and "us" mean TradieNotes Limited. Contact: [email protected].

What we collect

• Your account: your email address, a scrambled (hashed) version of your password (we can't see your actual password), and the business details you add: business name, address, phone, tax ID, payment details, usual hourly rate, and your logo if you upload one.
• Your documents: the invoices and quotes you make, and the drafts you're working on. These include details about your customers (name, address, email) and the work you did for them. You're responsible for having the right to give us your customers' details for this purpose.
• What you give us to read: the photo of your notes, or the words you type or speak. See "How your photos and words are read" below.
• Payments: when you pay by card, the card details go directly to our payment processor, Stripe. We never see or store your card number. We keep a record of each payment: the amount, date, and what it was for.
• Basic technical information: like any website, our servers and our network provider see your IP address and browser details when you visit. We use your approximate country only to suggest a better-suited site for some countries (it's never used to track you). To stop abuse, we keep a scrambled (one-way hashed) version of your IP address: to limit how often one connection can use the AI or the login forms, and to give free sign-up credits to only 2 new accounts per connection every 30 days. The scrambled value can't be turned back into your address.

How your photos and words are read

When you snap a photo, or type or say the job, we send it to Google's Gemini AI service to read the details and send them back to us. We don't keep the photo. Google processes it under its terms for paid use of the Gemini API: Google doesn't use it to improve its products, but does keep a log of requests for a limited time, solely to detect abuse and for any legally required disclosures.

The "say it" option uses your own browser's speech-to-text. Depending on your browser, the speech recognition may be done by your browser's maker (for example Google in Chrome, or Apple in Safari) under their own privacy terms, before the words reach us.

How we use it

• To make your invoices and quotes, show them to you, and email them to you and to your customer when you ask us to, including payment reminders you choose to send. We keep a note of when a reminder was sent and to which address.
• To run your account: logging in, saving your history, credits and settings, and password resets.
• To take payment and keep financial records.
• To keep the service secure and working, and to fix problems.
• To understand how the site is used (which pages people visit, how they found us, and which features they use), so we can improve it. See "Analytics" below.

We don't sell your personal information, and we don't share it for advertising. We don't use advertising trackers.

Who helps us run the service

We use a small number of service providers, who process information only to provide their service to us:

• Stripe: card payments.
• Google (Gemini API): reading your photos and words.
• Google (Analytics): measuring how the site is used. See "Analytics" below.
• Resend: sending emails (your documents, password resets). Resend keeps delivery records, and may keep a copy of a sent email (including the attached PDF) for a limited time.
• Railway: hosting the app and its database.
• Cloudflare: network, security and delivery of the website.

These providers are based in, and may process information in, the United States and other countries. We may also disclose information if the law requires it.

Analytics

We use Google Analytics to see how the site is used: which pages are visited, roughly which country and city visitors are in, what device and browser they use, how they found us (for example a search engine or a link), and which features are used, like downloading a template or starting an invoice. Google Analytics sets cookies that give your browser a random ID, so it can tell new visits from repeat ones. It doesn't receive your name, email address, or the contents of your invoices and quotes.

• We've turned off Google's advertising features and "Google signals", so this information isn't used for advertising or linked to your Google account.
• Before a page's address is sent, we remove anything private from it, such as password-reset links and what you type into the search box in your account.
• There's no analytics on the invoice and quote pages your customers open.
• You can stop it with your browser's privacy settings or an ad or tracker blocker, or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout. The site works the same either way.

Google processes this information under its own terms and privacy policy (policies.google.com/privacy).

Cookies

We use only cookies that the site needs to work:

• a session cookie, which keeps you logged in and remembers the document you're working on;
• a "remember me" cookie, which keeps you logged in on that device;
• a small cookie that remembers if you chose "Stay here" on the country suggestion;
• a small cookie with your device's time zone, so new documents get today's date where you are.

We also use Google Analytics cookies (named _ga and _ga_ followed by an ID), which hold a random ID so we can count visits. They last up to two years. See "Analytics" above.

Your browser may also remember, on your own device, whether you dismissed the "add to home screen" tip. No advertising cookies.

Tracking and "Do Not Track"

We don't track you across other websites, and there are no advertising or social-media trackers on our site. The one other company that collects information about your activity on our site is Google, through Google Analytics (described above). It sees how you use our site over time, but with Google's advertising features and Google signals turned off, we don't use it, or let Google use it, to follow you across websites over time. Our site doesn't change what it does when a browser sends a "Do Not Track" signal, because there's no agreed standard for what that signal should mean. To stop Google Analytics, use the options under "Analytics" above.

How long we keep things

• Your account and saved documents: until you delete them or your account.
• Logos you upload: until you delete your account. We keep each logo you upload, even after you change it, so your past invoices and quotes keep showing the logo they were made with.
• Unpaid drafts: deleted automatically after 30 days without changes.
• The working copy of a paid document: deleted 30 days after its free-correction period ends. With an account, the saved document stays in your history. Without an account, you won't be able to download it again after that, so save your PDF.
• Password-reset links: deleted once used or expired.
• Scrambled IP addresses: usage counters are deleted within a day; the one kept with a new account's free credits is deleted after 30 days.
• Payment records: kept as long as the law requires us to keep financial records.
• Photos of your notes: not kept.

Your choices

• See and correct: your details and documents are all in your account. Change them in Settings.
• Delete: Settings → Delete your account removes your account and every document in it straight away. Payment records (amounts and dates) are kept as financial records, with the link to you removed.
• Ask us: for anything else, including a copy of your information, email [email protected]. Depending on where you live, you may have further rights under your local privacy laws, and we'll honor them.
• Complaints: if you're not happy with how we've handled your information, tell us first. You can also complain to New Zealand's Privacy Commissioner at privacy.org.nz.

Security

The site uses encrypted connections (HTTPS). Passwords are stored only as hashes, and password-reset links are single-use and expire after an hour. Card payments are handled by Stripe. No system is perfectly secure, but we work to protect your information and to limit what we keep.

Children

Invoice & Quote is a business tool and isn't meant for children. You must be at least 18 to create an account.

Changes

If we change this policy, we'll update the date at the top, and for significant changes we'll let account holders know by email.