Legal
Sub-
processors
Effective 25 May 2026. Invofolio uses the following third-party providers to operate the Service. Each provider has its own privacy policy and security practices, which apply to data they process on our behalf.
Related: Privacy Policy · Terms and Conditions
This list is informational and may change as the Service evolves. Material additions of new sub-processors that handle workspace data will be reflected here. Each sub-processor’s services are governed by its own terms and privacy policy, and we are not liable for the acts, omissions, security incidents, or service availability of any sub-processor. This does not affect any responsibility we have to you under applicable data protection law for our own choice and use of sub-processors.
Vercel Inc.
- Purpose
- Application hosting, edge network, serverless function execution, deployment platform.
- Data
- Request metadata, IP address, user-agent, server logs, all data transmitted to and from the Service.
- Region
- United States (primary), with global edge distribution.
Neon Inc.
- Purpose
- Managed PostgreSQL database hosting for all workspace, billing, and authentication data.
- Data
- All workspace data including account, business profile, clients, invoices, quotations, payment records, billing metadata, audit logs.
- Region
- United States (primary).
- Privacy
- neon.tech/privacy-policy
Stripe, Inc.
- Purpose
- Payment processing for paid subscriptions, billing portal, checkout, invoice and webhook delivery.
- Data
- Stripe customer and subscription identifiers, billing email, plan, billing status, payment events. Full payment card data is collected and stored by Stripe and is never received or stored by Invofolio.
- Region
- United States, with regional processing as determined by Stripe.
- Privacy
- stripe.com/privacy
Google LLC (Google Sign-In / OAuth)
- Purpose
- Optional authentication via Google Sign-In.
- Data
- OAuth identity token, email address, basic profile (name, profile picture), Google account sub identifier.
- Region
- United States, with global infrastructure.
- Privacy
- policies.google.com/privacy
Resend, Inc.
- Purpose
- Transactional email delivery for authentication, password reset, verification, billing, support, and product notifications.
- Data
- Recipient email address, sender email, subject, message content, delivery metadata, bounce and complaint events.
- Region
- United States.
Cloudflare, Inc.
- Purpose
- PDF rendering via Cloudflare Browser Rendering (used to generate invoice and quotation PDFs on demand).
- Data
- Generated PDF HTML payloads (which contain invoice and quotation content) and request metadata transmitted during each render request. Payloads are not retained beyond the render.
- Region
- United States, with Cloudflare-controlled regional processing.
Self-hosted PDF service (optional)
A self-hosted Puppeteer-based PDF rendering service may be used as an alternative or fallback to Cloudflare Browser Rendering. When deployed, it runs on infrastructure controlled by the Service operator and is not a third-party sub-processor. Generated PDF HTML payloads are transmitted to the service over an authenticated channel and are not retained beyond the render request.