Privacy Policy

Last updated: October 4, 2026

1. About this policy

Invoice Link is a business-to-business invoicing tool operated by Sentinel Holdings Group, Inc. ("Sentinel Holdings", "we", "us"). This policy explains two kinds of data we handle:

• Your account and business data — where we are the Business / Controller (your signup info, subscription billing, business profile).
• Data about your customers — where you, the contractor, are the Business / Controller and we are a Service Provider / Processor acting on your instructions (the clients you invoice, invoice line items, payment records).

This split follows CCPA § 1798.140 and is how tools like Invoice Simple, QuickBooks, and Stripe frame their roles. It affects where rights requests go (see §8).

2. Information we collect

From you when you sign up. Name, email, business name, and a password (stored only as a salted hash), plus your phone number and business address if you add them. If you sign in with Apple or Google, we receive the name and email that provider shares. Pro subscriptions are purchased through Apple or Google, so we never receive the card you use to pay for them.

From your device. IP address, device type, operating system, app version, and push-notification tokens, collected automatically.

When you use features. Invoices, estimates, and client contact info you enter; photos and receipts you capture or select; contacts you explicitly pick to prefill a customer; notes, descriptions, and files you choose to import; screenshots and notes you send us for support; the recipients, subject lines, and text of messages you send customers through the app (invoice, estimate, receipt, Quick Update, and review-request emails and texts); email addresses of people you invite with Refer a Friend; and requests you make to the AI features (see §5).

Precise location. We use your device's location only for the features below, and only after you grant location permission:

• Time Clock (including background location). When you (or a team member signed in to their own account) clock in, the app records the device's GPS location — coordinates, accuracy, speed, and heading — continuously until you clock out, including while the app is closed, in the background, or the phone is locked. These points are uploaded to Invoice Link's servers to record your hours and show your route and job-site stops for the shift. Collection stops when you clock out. While it is running, Android shows a persistent "Time Clock running" notification and iPhone shows the system location indicator.
• Door Knocker. While the Door Knocker screen is open, the app maps your route and the location of each door you log, and saves them to your account.
• Photo location. Photos you take with the in-app camera in Portfolio or Finish a Job may be tagged with the location where they were taken. Photos you import into Portfolio from your photo library keep the location saved in the photo, if it has one.
• Address autofill. When you choose to use your current location to fill in an address, the app reads your location once to look up the nearest street address.

Motion & fitness. The Door Knocker uses your device's motion sensors (pedometer) to count steps and tell whether you're walking, only while that screen is open.

Voice input. When you speak to the AI assistant or dictate a note, your phone's built-in speech recognition (Apple on iPhone, Google on Android) converts your speech to text. Apple or Google may process the audio on their servers rather than on your device. Invoice Link receives only the resulting text — we do not receive or store the audio.

Automatically. Server error logs, authentication events, crash and performance reports from the app, and feature-usage events (for example, "invoice sent") linked to your account, used to keep the Service running and improve it. Feature-usage events are kept for 90 days.

Email opens and clicks. Most emails sent through the Service — invoices, estimates, receipts, payment reminders, review requests, refund notices, photo emails, referral invitations, and our own welcome and trial-reminder emails — carry a small tracking image, and most also use tracked links, from our email provider (Postmark). They let us — and you, for emails sent to your customers — see whether an email was delivered, opened, or clicked. Password-reset, email-verification, and account-deletion emails are not tracked.

From payment processors. For payments your customers make to you: transaction IDs, cardholder name, card last-4, and card brand from Stripe and PayPal. For your Pro subscription: entitlement status from Apple, Google, and RevenueCat. We never receive or store full card numbers.

3. How we use it

• Run and secure the Service
• Provide the features you use — for example, recording Time Clock hours and routes, mapping Door Knocker sessions, and answering AI requests
• Process payments and issue receipts (through the payment processors listed in §4)
• Send transactional emails and push notifications you've opted into
• Understand how features are used and improve the Service, using the feature-usage events described in §2
• Comply with legal obligations, including tax reporting

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to train AI models.

4. Who we share with

We share data only with the service providers (processors) we need to run the Service, and only the data each one needs for its job. Our agreements with them require them to use the data only to provide their services to us and to protect it with safeguards at least as protective as those described in this policy. Each provider also has its own privacy policy. The full list, with the data categories each receives, is on our Sub-processors page.

• Payment processors (Stripe; PayPal only on accounts where PayPal checkout is enabled) — payments your customers make to you, refunds, and payouts to your account
• Hosting providers (Railway, Vercel) — run our application, database, and web infrastructure
• Email delivery (Postmark via ActiveCampaign) — transactional email
• App stores and subscription (Apple, Google, RevenueCat) — in-app subscription billing and entitlement verification
• Sign-in providers (Google Sign-In, Sign in with Apple) — only if you choose to sign in with Google or Apple
• Map services (Google Maps Platform, including Places) — address autocomplete, Street View imagery for customer addresses, and maps in the Android app
• AI service providers — OpenAI for the AI assistant, Improve with AI, expense and receipt descriptions, and file import; and Google Cloud Document AI for receipt scanning. Used only after you allow AI features; neither provider uses this data to train its models. Details in §5.
• Push notifications (Apple APNs and Google FCM, relayed via Expo) — invoice-paid alerts and other notifications
• Property data (Rentcast) — optional address lookups and, when you tap Find Houses in Door Knocker, the coordinates of where you are, so nearby houses can be listed. These requests come from our servers with no name, email, or account information.
• Neighborhood data (U.S. Census Bureau geocoder and American Community Survey) — while the Door Knocker screen is open, our servers send the coordinates of the area you're in to the Census Bureau's public geocoder to find the census block group and show neighborhood statistics (such as median household income and home value). No name, email, account, or customer information is sent, and the request comes from our servers, not your device. This is a public government service rather than a contracted processor.
• File storage (Cloudflare R2) — invoice/estimate attachments, photos, business logos
• Error tracking (Sentry) — crash and error reports used only to fix bugs. Reports include your account ID and email so we can follow up on a problem, plus device and app details and a short technical trail of what the app was doing before the error. We filter reports to strip invoice content and your customers' details before they are sent, but the technical trail can occasionally still include a fragment of what you were doing — for example an address, a map location, or a search you typed.
• Log aggregation (Better Stack) — operational server logs. Email addresses, names, and payment IDs are redacted by the log shipper before they leave our servers.

We also share invoices, estimates, and receipts with the recipients you choose to send them to, and we may disclose information when required by law (for example, a valid subpoena or court order).

5. AI features

Invoice Link's AI features are optional. Before any of your data is sent to a third-party AI provider for the first time, the app asks for your permission and names the providers below. If you choose "Not now", nothing is sent. When you use an AI feature, we send the provider only what that feature needs:

• AI assistant (OpenAI). What you type or say to the assistant, recent conversation context — which can include client names, email addresses, phone numbers, invoice numbers, and amounts — and the names and prices of your saved items, so it can draft invoices and estimates and answer questions. Requests are also checked by OpenAI's moderation service to block harmful content.
• Improve with AI (OpenAI). The notes or description text you ask it to rewrite.
• Expense (receipt) descriptions (OpenAI). For your business's own expenses, the draft note you type and the store (vendor) name on that expense. The amount, date, receipt photo, your business name, and any customer or job tag are not sent.
• Payment receipt descriptions (OpenAI). When you polish the description on a payment receipt you send a customer, the draft you type and your business's trade (for example, "plumbing"). Your customer's name, the amount, and your business name are not sent.
• File import (OpenAI). Sample rows from CSV or spreadsheet files you import, and images you upload — such as photos of invoices, contact lists, or business cards — so the data can be recognized and added to your account.
• Receipt scanning (Google Cloud Document AI). Photos of receipts you scan, so the merchant, date, line items, and totals can be read automatically.
• Voice input. When you speak to the assistant, your phone's built-in speech recognition turns your speech into text — on Android, the phone's built-in Google speech service; on iPhone, Apple's. The audio is handled by Google or Apple, not by us or OpenAI; we receive only the resulting text, which is then treated like anything you type (see §2).

How the providers handle it. OpenAI and Google process this data to return results to us. Under their API terms they do not use it to train their models. OpenAI may keep API inputs and outputs for up to 30 days to monitor for abuse before deleting them. AI output can be wrong — review it before you send anything to a customer. If you report an AI response in the app, we receive the reported response and your reason and use them only to review the feature.

AI chat history. By default, your assistant conversations stay on your device; requests pass through our servers to OpenAI but are not saved to your account. If you turn on AI chat history saving in Settings → AI Privacy, we store your conversations on our servers so the assistant can remember context across sessions. Saved messages are deleted automatically after about 90 days, except that a short note of pricing preferences you've told the assistant (such as your hourly rate) may be kept so it keeps using them. You can delete all saved AI history — including that note — at any time with Delete all AI history in Settings → AI Privacy.

Turning AI off. You can withdraw your permission at any time in Settings → AI Privacy. From then on, nothing more is sent to AI providers; AI features will ask again before they run. Withdrawing permission doesn't undo requests that were already processed.

6. How long we keep it

• Active account data. As long as your account is open. Cancelling your Pro subscription doesn't delete your data; deleting your account does (see below and §10).
• Payment and tax records. 7 years from the transaction date, as required by U.S. tax law (IRC § 6001 / 26 CFR § 1.6001-1). For retained rows we strip personally identifiable information so only pseudonymized financial metadata remains.
• Deleted-account data. Removed from production systems within 30 days; encrypted backups expire within 90 days after data is removed from production. When you delete your account we also delete your customer record at RevenueCat, our subscription-management provider. Apple and Google keep their own purchase records under their own policies.
• Time Clock location. Raw GPS points are deleted after 30 days. A simplified route summary for each shift (start and end points, route line, distance, and duration) stays with that time entry until you delete the entry or your account.
• Door Knocker. Session routes and logged door locations are kept until you delete them or your account.
• AI chat history. Stored only if you turn it on; deleted after about 90 days, or sooner when you delete it (see §5).
• Security logs. Up to 12 months.
• Legal holds. Retained for as long as legally required.

Pro subscribers can export invoices, estimates, payments, and clients as spreadsheets from Settings → Export Data in the app. On any plan, including Free, you can ask us for a copy of your data at no charge by emailing sentinelholdingsinc@gmail.com with "Data Export Request" in the subject; we send it within 30 days, or sooner where your local law requires (see §8).

7. How we protect your data

We use reasonable administrative, technical, and physical safeguards suited to the data we handle, including:

• Encryption in transit. The app, website, and API communicate over HTTPS (TLS).
• Encryption at rest. Our database, backups, and file storage are hosted with providers that encrypt stored data at rest.
• Access controls. Every request is authenticated and limited to your own account and business. Access to production systems is limited to the people who need it to operate the Service. Passwords are stored only as salted one-way hashes.
• Payment data. Card and bank details are handled by Stripe, PayPal, Apple, and Google; we never receive or store full card numbers.
• Minimized logs. Personal details such as email addresses, names, and payment IDs are redacted from operational logs before they are sent to our logging provider. Crash and error reports are filtered to strip invoice content and your customers' details before they are sent, and are linked to your account ID and email so we can follow up on a problem (see §4).
• Signed links. Invoice, estimate, and receipt links you send to customers are cryptographically signed so they can't be guessed.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. More detail is on our Security page.

8. Your rights

Your rights depend on whose data is involved and where you live.

8.1 For your account data (we are the Business) — United States

We honor rights under the California CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, and similar U.S. state privacy laws. You have the right to confirm, access, obtain a portable copy, correct, delete, limit the use of sensitive PI, and opt out of sale, sharing, targeted advertising, and significant profiling. We honor the Global Privacy Control (GPC) signal as an opt-out request.

In the past 12 months we collected these CCPA categories of personal information: identifiers, customer records, commercial information, internet or network activity, precise geolocation (only for the features described in §2), visual information (photos you attach), professional information, and inferences drawn from the above. We do not receive voice recordings — voice input reaches us only as text. Precise geolocation is sensitive personal information under the CPRA; we use it only to provide the features you request and not to infer characteristics about you. We have not sold or shared personal information.

To exercise your rights, email sentinelholdingsinc@gmail.com or visit /account-deletion. We respond within 45 days (extendable by 45 days with notice). If we deny your request, you may appeal within 60 days to the same address; we respond to appeals within 60 days.

8.2 For your customers' data (you are the Business)

When you enter a client's contact info or create an invoice, you are the Business under CCPA and we are your Service Provider (the controller and the processor under laws such as the UK GDPR). This applies in every country where Invoice Link is offered. You decide how that data is used, corrected, or deleted. If an invoice recipient or one of your clients contacts us directly with a rights request, we will forward the request to you and you will decide how to respond. We may still assist you in fulfilling requests under our Data Processing Addendum with you.

8.3 If you live in Canada, the United Kingdom, Australia, or New Zealand

Depending on where you live, you also have rights under your local privacy law — the UK GDPR and Data Protection Act 2018 (United Kingdom), PIPEDA and provincial privacy laws (Canada), the Privacy Act 1988 and the Australian Privacy Principles (Australia), and the Privacy Act 2020 (New Zealand). Whichever of these countries you live in, you can:

• Access — ask what personal information we hold about you and get a copy of it.
• Correction — have information that is wrong or out of date corrected. You can fix most of it yourself in the app.
• Deletion — have your information deleted, by deleting your account (§10) or asking us to delete specific data (§9). After deletion we keep only the records described in §6.
• Withdraw consent — at any time, for anything that relies on your consent, such as device permissions and AI features (§9).
• Object, restrict, or move your data — where your law provides for it, object to or limit how we use your information, and receive it in a portable format.
• Complain — to us, and to your privacy regulator (listed below) if you are not satisfied with our answer.

Why we are allowed to use your information. We use your account and business information to perform our contract with you (running your account and the features you use); with your consent (device permissions such as location, camera, photos, contacts, and microphone, and AI features); for our legitimate interests in keeping the Service secure, preventing fraud, and improving it; and to meet our legal obligations (for example, tax and accounting records).

To use any of these rights, email sentinelholdingsinc@gmail.com with "Privacy Request" in the subject, or delete your account in the app (§10). There is no charge. We may ask you to confirm your identity first. We answer within 30 days, or sooner where your law sets a shorter deadline. This address also reaches the person responsible for privacy at Sentinel Holdings Group, Inc.

If you are not satisfied with our answer, you can complain to your privacy regulator:

• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• Canada: Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca
• Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
• New Zealand: Office of the Privacy Commissioner — privacy.org.nz

Your information is stored and processed in the United States — see §13.

9. How to revoke consent

You can change your mind at any time:

• Device permissions (location, background location, camera, photos, contacts, microphone and speech recognition, motion & fitness): turn them off in your phone's settings — on iPhone, Settings → Invoice Link; on Android, Settings → Apps → Invoice Link → Permissions. To stop Time Clock background location, clock out, or change location access to "While Using the App" / "Allow only while using the app" or "Never" / "Don't allow".
• AI features: in the app, go to Settings → AI Privacy to withdraw permission for AI features, turn off AI chat history saving, or delete all saved AI history.
• Notifications: choose which alerts you get in the app's notification settings, or turn off notifications for Invoice Link in your phone's settings.
• Sign in with Apple or Google: you can remove Invoice Link's access from your Apple Account or Google Account settings.
• Delete specific data without deleting your account: delete any client, invoice, estimate, expense, photo, Time Clock entry or Door Knocker session in the app, or email sentinelholdingsinc@gmail.com with "Data Deletion Request" and we'll delete it within 30 days.
• Everything: delete your account (§10).

Features that depend on a permission stop working until you allow it again. Withdrawing consent doesn't affect processing that already happened.

10. Account deletion

You can delete your account at any time through any of these routes:

• In the mobile app: tap the gear icon at the top of the Home screen to open Settings, then tap Delete Account (just above Sign Out). Type DELETE to confirm, plus your password if your account has one (Sign in with Apple accounts also confirm with Apple), and deletion begins immediately.
• On the web: invoicelinkapp.com/account-deletion. We email a signed, single-use confirmation link (valid 24 hours); clicking it finalizes the request.
• By email: sentinelholdingsinc@gmail.com with "Account Deletion Request" in the subject.

All three paths feed the retention schedule in §6: production purge within 30 days, backups expire within 90 days after data is removed from production, tax records retained 7 years with PII stripped. Your RevenueCat customer record is deleted as part of account deletion.

11. Children

The Service is intended for business users aged 18 or older. We do not knowingly collect data from anyone under 13 (COPPA), under 16 (CCPA), or under the age at which the law where you live requires a parent's consent. If you believe a minor has created an account, contact us and we will remove it.

12. Cookies

On the web app we use strictly-necessary cookies for authentication and CSRF protection, plus cookieless Vercel Analytics. Marketing pages also load Google's translation widget, which receives your IP address from your browser and, if you choose a language, sets a cookie to remember it. We do not run advertising cookies. You can clear or block cookies via your browser settings.

13. Where Invoice Link is available, and international data transfers

Invoice Link is operated from the United States by Sentinel Holdings Group, Inc. The app is available on the Apple App Store and Google Play in the United States, Canada, the United Kingdom, Australia, and New Zealand. Online card and bank (ACH) payments through Stripe are available to businesses in the United States; in the other countries you can create and send invoices and estimates and record the payments you collect yourself.

Our servers and most of our service providers are in the United States. If you use Invoice Link from another country, your information — and the customer information you enter — is transferred to, stored in, and processed in the United States. Privacy laws there may differ from the laws where you live, and U.S. courts and government agencies may be able to access the information under U.S. law. A few service providers process limited data in other countries, as listed on our Sub-processors page. Wherever your information is processed, we protect it as described in this policy, and our agreements with service providers require them to protect it too (§4). If the law that applies to you requires a specific safeguard for an international transfer, such as standard contractual clauses, we will put one in place on request — see our Data Processing Addendum.

Your privacy rights in each country are described in §8.

14. Data breach notification

We will notify affected users of any material data breach without unreasonable delay and no later than the timeframes required by the law that applies to you — including U.S. federal and state law (e.g., N.C. Gen. Stat. § 75-65), the UK GDPR, Canada's PIPEDA, Australia's Notifiable Data Breaches scheme, and New Zealand's Privacy Act 2020 — and we will notify the relevant regulator where that law requires it.

15. Changes

We may update this policy from time to time. For material changes — anything that expands our collection, widens our uses, or extends our retention — we will give existing users at least 30 days' advance notice in-app and by email before the change takes effect.

16. Contact

Sentinel Holdings Group, Inc.
50 E Main St Suite 100 PMB1008, Thomasville, NC 27360
Email: sentinelholdingsinc@gmail.com
Privacy: sentinelholdingsinc@gmail.com

© 2026 Sentinel Holdings Group, Inc. All rights reserved.