Privacy policy

Who is responsible

Unlimited Scalability LLC 1309 Coffeen Avenue STE 1200 Sheridan, Wyoming 82801 United States info@jiffy-invoice.com

For your account and your own business details we are the data controller. For the details of your clients that you enter in Jiffy you are the controller and we are your processor: we only use them to make the app work for you.

What we process

• Account: your name, email address and a hashed form of your password. If you sign in with Google or Apple, they give us your name, email address and an account id.
• Your business: business name, address, phone number, Chamber of Commerce and VAT number, bank details, logo, and your signature if you add one.
• Your clients: name, contact person, email address, phone number, address, Chamber of Commerce and VAT number.
• Invoices and quotes: lines, amounts, dates, notes, payment status, whether and when a client viewed the document, and the signature a client uses to accept a quote.
• Payments: when your client pays online, Stripe handles the payment. We receive the amount and the status, not your client's card or bank details.
• Subscription: which plan you have (Free, Pro or Ultra) and until when. Your payment details are held by Stripe.
• Device: a push token if you switch on notifications, and your language choice.
• Technical data: IP address and time of requests in the server logs, and error reports from the app (the error text, the screen and the app version, without the contents of your documents), to keep the service secure and working.

Microphone and photos

When you use spoken commands, your phone's speech recognition (Apple or Google) turns your voice into text. We do not receive or store audio; only the text is used in the app to carry out your command. If the app does not understand that text by itself, it goes to the AI (see AI features).

The app only opens your photos or your camera when you choose a logo or a receipt yourself. Only the image or pdf you pick is uploaded.

AI features

Four features in Jiffy send data to an AI service. This only happens after the owner or an admin of your company has given consent once (that consent covers all four and the whole company), and only at the moment you use the feature yourself:

• Design and templates with AI: your company name, the tagline, the choices of your design (colors, fonts, parts) and the text of your instruction, to a language model from Anthropic, a company in the United States. The previews are drawn with example data.
• Receipt scanning: the photo or pdf of the receipt, to a language model from Anthropic (see Receipt scanning below).
• Logo with AI: your company name, the tagline, the chosen style and colors and your own description, to an image model from OpenAI, a company in the United States.
• Spoken or typed commands (Ultra): the text of your command and the names of your clients (so the command reaches the right client), to a language model from Anthropic. A command the app understands by itself is not sent to the AI.

Amounts, invoice lines, documents and client contact details are never sent. With commands, only the client names are sent, plus whatever you say or type in your command yourself.

Anthropic and OpenAI do not use this data to train their models and keep it only briefly, under their terms for business customers, among other things to detect misuse. Because both process data in the United States, this is based on the standard contractual clauses of the European Commission.

For design and logos we keep your instruction and the answer (without client data) in a log, so credits can be given back if something fails and to prevent misuse. We do not keep commands.

You can withdraw the consent at any time in the app under More, Data to AI services (as owner or admin). After that nothing is sent to an AI service until consent is given again; the rest of Jiffy keeps working as usual.

Receipt scanning (Pro)

If you scan a receipt, we send the photo or pdf of that receipt to a language model from Anthropic, a company in the United States, which reads the vendor, date, amount, VAT and category from it. Nothing else is sent: no client data, invoices or company details. This only happens after you have given your consent once (the same consent as for the other AI features) and only at the moment you scan a receipt yourself.

The result is a proposal that you check first. If you save the cost, we keep the details and the receipt file in your account. The file is private: only members of your company can fetch it, and it is never on a public address. If you delete the cost or your account, the receipt is deleted too. If you do not save it, the uploaded receipt is not kept longer than necessary. The AI log only holds the type and size of the file and what it cost, not the receipt itself.

Cloud storage (Ultra)

If you connect your Google Drive or OneDrive, we place a copy of your sent invoices and quotes (pdf), your saved receipts and your exports in your own storage, in the folder Jiffy Invoice or in the folder you choose yourself. The files are yours there: we do not hold on to them and you can remove them yourself at any time.

You give permission once at Google or Microsoft. With Google Drive, Jiffy only sees the files and folders that Jiffy created itself or that you point out yourself, not the rest of your storage. With OneDrive, Jiffy by default only gets access to its own app folder. We keep the access token encrypted (AES-256) on our server and never show or log it.

If you choose a folder in OneDrive yourself ("Choose a folder in your OneDrive yourself"), Microsoft asks you for a broader permission: Jiffy then gets read and write permission on your OneDrive files. Jiffy only writes in the folder you choose and reads nothing else of your OneDrive than the names of folders, so it can show you the list. You can go back to the own app folder by connecting again without that choice.

You can disconnect at any time in More, Cloud storage. We then revoke the access (at Google) and delete the connection; files already in your storage stay there. You can also revoke access in your Google or Microsoft account.

What we use it for

• To provide the app: creating invoices and quotes, sending them as pdf, tracking payments and sending reminders (performance of our contract with you).
• To secure your account and prevent abuse (legitimate interest).
• To meet legal obligations, such as our own bookkeeping.

We do not sell your data, show no advertising and do not track you across other apps or websites.

Usage measurement

In the app and on our website jiffy-invoice.com we measure how Jiffy is used from the first start or first visit. For this we use PostHog (PostHog Inc., United States) as a processor. The data is stored in the United States.

In the app, the web app and on the website measuring is therefore on as soon as you start, even before you dismiss the notice; you see that notice on your first start or first visit. If you turn it off, nothing is sent afterwards and we delete what the measuring tool had stored on your device; we keep that choice on your device. We never measure on the pay and quote links your clients open.

What we measure:

• which pages or screens you view and where you go next;
• clicks, scrolling and heatmaps of where visitors click;
• recordings of your session, on the web only (website and web app). All text and all input fields are hidden, so names, amounts and client details can never be seen. In the iOS and Android app we make no recordings and measure no screen content, only events such as which screen you open;
• steps in sign-up, cancelling (with the reason you choose) and choosing a plan;
• if you are signed in and said yes: a few events our server reports, such as a document being sent or a subscription starting or being cancelled, without names, amounts or email addresses;
• how fast pages load and technical data, such as your browser, device and country;
• a random id, and after signing in an id without name or email address, so we see a visit and the account that follows from it as one story.

Purpose: to understand how Jiffy is used and to improve it. In the app, the web app and on the website we turn measuring on based on our legitimate interest in improving the product. You can turn it off at any time: on the website through Analytics settings at the bottom of the page, in the app under More, Usage measurement. This has no effect on our service.

Retention: no longer than 12 months.

Because PostHog processes data in the United States, this is done under the European Commission's standard contractual clauses.

Who we share data with

Only with parties that help us provide the app, and only what they need:

• Stripe: online payments from your clients and the Pro and Ultra subscriptions.
• Resend: sending emails, such as invoices, reminders and sign-in emails.
• Anthropic: the language model behind AI design, receipt reading and commands, only after consent and when you use that feature yourself (see AI features).
• OpenAI: the image model behind the AI logo, only after consent and when you have a logo made with AI yourself (see AI features).
• Expo, Apple and Google: delivering push notifications.
• Sentry (Functional Software, Inc., United States): error and crash reports. These contain technical data, such as the error message, the stack trace, the device type, the app version and the screen where it went wrong, and never the content of your invoices, clients or company.
• Google and Apple: if you sign in with their account.
• Google Drive or Microsoft OneDrive: only if you connect a cloud storage yourself, to place the copy in your own storage.
• Our hosting provider: the servers that run the app and the database.

We are based in the United States and some of these parties process data outside the European Economic Area. That is done under the European Commission's standard contractual clauses, an adequacy decision or the EU-US Data Privacy Framework (under which Sentry is certified).

Your client sees the invoice or quote you send, including your business details on it.

How long we keep it

We keep your data for as long as your account exists. When you delete your account, we delete your business, clients, invoices and quotes from the app straight away. Backups are overwritten within 30 days after that.

Note: as a business in the Netherlands you must keep your own records for seven years. Make an export before you delete your account.

Deleting your account and data

In the app: go to More, choose Delete account and confirm. This works in the iOS app, the Android app and the web app.

If that does not work, email info@jiffy-invoice.com from the address of your account. We will then delete your account within 30 days.

Your rights

You may access your data, have it corrected or deleted, take it with you, and object to or restrict processing. You can change most data yourself in the app; for anything else, email us.

If you have a complaint, we would like to hear it first. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

Security

Connections to the app are encrypted. Passwords are stored only in hashed form. Only people who need it for maintenance can reach the servers.

Children

Jiffy Invoice is meant for businesses and not for children under 16.

Changes

When we change this policy, we publish the new version here with a new date. For major changes we let you know in the app or by email.

Contact

Questions about your privacy? Email info@jiffy-invoice.com.