Data Processing & Protection Policy

Roles & Responsibilities

For your account data (login, billing), Invozeo is the data controller. For your business data (customers, invoices, employees), you are the controller and Invozeo is the processor acting on your instructions.

What We Process

• Business records — invoices, customers, suppliers, inventory, HR data you enter
• User account data — names, emails, roles of your staff
• Integration data — credentials and payloads for services you connect
• Support data — tickets, chat, attachments you share with support

Processing Safeguards

• Tenant isolation — your data is logically separated from other customers
• Encryption in transit (TLS) and at rest
• Access controls — staff access on need-to-know basis, logged
• Regular security reviews and patching

Sub-Processors

We use carefully vetted sub-processors for infrastructure (cloud hosting), payments (Razorpay/Stripe), email delivery, and SMS/WhatsApp gateways. A current list is available on request.

Retention & Deletion

Business data is retained while your account is active. On account closure: 30-day grace for export, then scheduled deletion within 90 days. Backup archives purge within 30 additional days. Tax-mandated records may be retained longer as required by Indian law.

Data Breach Handling

In case of a personal-data breach affecting your account, we will notify you within 72 hours of becoming aware, along with details of the scope and remedial steps taken.

Your Obligations

As the data controller for your business data, you must have lawful basis for processing your customers' and employees' personal data and handle their rights requests appropriately.