Invio ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal information in accordance with the New Zealand Privacy Act 2020.
1. Information we collect
Information you provide:
- Account information (name, email, password)
- Business details (business name, address, GST number, bank account)
- Invoice and quote data, and payment records
- Voice recordings and audio you dictate when using the optional voice-to-invoice feature
- The text of your conversations with Offsider (our in-app AI assistant) and of your voice invoices, and the AI's answers (see AI features and voice data)
- Files you choose to send us for import help, such as a client export from your old tool (see Data retention for how long we keep them)
- Your answer, if you choose to give one, to the optional question we ask when you cancel a subscription (the reason you pick and any note you add). We store it on your account, use it to improve Invio, and include it in your data export
- Your answer to a one-question survey email, if you choose to reply, and any note you add. We only quote a note publicly, with your first name and business name, if you tick the box that says we may
- Communications with our support team
- Xero sync data, only if you choose to connect Xero (see Xero sync under Data sharing): the name and settings of the Xero organisation you connect, and a record of what Invio sent to it
Information collected automatically:
- IP address and browser type
- Device information
- Usage data (pages visited, features used)
- Cookies and similar technologies
2. How we use your information
We use your information to:
- Provide and maintain the Service
- Process your invoices, quotes, and payments
- Draft invoices from your voice using AI, when you choose to use the voice-to-invoice feature
- Send transactional emails (invoice reminders, quotes, receipts) and notices about your account or plan, such as a change to your plan
- Improve our Service
- Respond to support requests
- Comply with legal obligations
- Detect and prevent fraud
3. Legal basis for processing
- Contract performance: Providing the Service you signed up for
- Legitimate interests: Improving our Service, security
- Legal compliance: Tax records, fraud prevention
- Your consent: Marketing emails, optional features
4. Data sharing
We may share your information with service providers (hosting, email, payment processing), professional advisors, and law enforcement when legally required.
We do NOT sell your personal data or share data with advertisers.
Third-party services we use: see our Subprocessors page for the current, specific list of who they are, what each one does, and where they process data. We keep that list on its own page so it can be updated when a provider changes without needing a rewrite of this policy.
AI features and voice data
Our optional voice-to-invoice feature uses artificial intelligence to turn what you say into a draft invoice. When you use it, the audio you record and the related invoice context (such as the client name and the line items needed to build the draft) are sent to our AI provider, Google Cloud (Vertex AI), for processing.
When you use Offsider (our in-app AI assistant) or voice invoicing, we keep the text of the conversation - what you asked, what the AI looked up or drafted for you, and its answers (for voice, the words the AI heard, never the recording) - for 30 days to check and improve the answers, then delete it automatically.
Receipt scanning. If you choose Scan receipt on the Add expense screen, the photo or PDF you give it is sent to Google Cloud (Vertex AI), our AI provider, which reads it and returns the details for you to check. Under Google Cloud's enterprise terms it is not used to train Google's AI models. Invio does not keep the image from the scan or the AI's reply: if you save the expense, the photo you attached is stored as that expense's receipt, in the same private storage as any other receipt, and the lines are saved with the expense. The scan is a draft; you check and save it.
- Invio does not store your voice recordings. They are processed to create your draft and are not kept on our systems.
- Under Google Cloud's enterprise terms, your data is not used to train Google's AI models. Google may retain it only briefly for safety, abuse detection, and legal compliance.
- AI output is a draft you review and confirm before anything is sent. We do not guarantee the accuracy of AI-generated drafts, and you are responsible for checking them before use.
Xero sync (optional)
If you choose to connect Invio to your Xero organisation, Invio copies your documents into it so that you do not have to key them twice. The Xero sync is optional and off until you connect it. Nothing is sent until you sign in to Xero on Xero’s own page, choose the organisation, and finish the setup in Invio.
What Invio sends to the Xero organisation you chose:
- Each invoice you send, and any change you make to it afterwards: its number, dates, lines, amounts and tax, your PO number, and a link to the invoice page that anyone with access to that Xero organisation can open.
- Payments recorded against those invoices (amount, date and reference), if you leave Record payments in Xero on, and the removal of a payment you remove in Invio.
- A credit note, when you void an invoice that has payments recorded.
- Your client as a Xero contact: the name and, where you have them in Invio, the email address, phone number and address. Invio looks for an existing contact first and links to it rather than making a second one.
- Invoices you sent before you connected, only if you choose to send them: you see the list, and one button sends exactly that list.
What Invio reads from Xero: the organisation’s name, currency and lock dates, and its accounts, tax rates and branding themes (so you can choose how Invio’s invoices map to them). Invio also looks up an invoice number or a contact in Xero to avoid creating a duplicate, and reads the state of an invoice before it adds a payment to it. Invio does not copy Xero’s contact lists, invoices or reports into its own database; the account, tax rate and theme lists are kept for up to a day so the settings screen can show them.
What Invio keeps: the access Xero gives it, stored encrypted and never shown in the app; the organisation’s name; and a queue and log of what was sent - Invio’s and Xero’s ids, whether each item went through, and any message Xero gave when it refused an item (that message can quote a name or number from the document). The log holds no amounts.
Who can see it: you, and people you have given access to your business in Invio, according to their role. We do not sell it or share it with advertisers. Neither the data from Xero nor the sync’s records are sent to our AI features (Offsider, voice invoices and receipt scanning), to our connectors for AI assistants (the Invio and Xero connectors) or to the REST API, and none of them can read them. An assistant that sends an invoice for you does so through the same step as you do; the invoice is then queued for the sync like any other.
How long we keep it, and how to stop it:
- While Xero is connected we keep the access and the sync’s records.
- When you press Disconnect in Invio, Invio asks Xero to remove its connection and deletes the stored access at once. We keep the sync’s ids (no amounts, no personal details beyond those ids) so that connecting the same organisation again does not create duplicates. Nothing that is already in Xero is changed or deleted by disconnecting.
- If you ask us to delete your Invio account, the stored access and the sync’s records are deleted when the account is permanently deleted, 30 days after your request. Invio does not ask Xero to remove the connection at that moment, so press Disconnect in Invio first, or remove Invio under Connected apps in your Xero settings.
- Xero holds your documents in your own Xero organisation, under your agreement with Xero. Where Xero stores them is decided by Xero; see our Subprocessors page.
Overseas data processing
Some of our providers process data on servers outside New Zealand. Our database (MongoDB Atlas) is hosted in Sydney, Australia. Our web hosting (Vercel), our AI provider (Google Cloud Vertex AI), and our product analytics provider (PostHog) primarily process data in the United States. Our error-monitoring provider (Sentry) processes data in Germany. Our email delivery provider (Brevo) processes data primarily in France and the European Union. Our payment processor (Stripe) processes data in Ireland and the United States, and may use local processing entities in other countries where it operates. Our file-storage provider (Cloudflare R2) does not pin storage to a single country. We only use providers that are subject to privacy protections comparable to the New Zealand Privacy Act 2020, for example through data processing agreements and standard contractual clauses. By using these features you acknowledge that your information may be processed overseas.
5. Data retention
- Active accounts: Data retained while account is active
- Scheduled account deletion: Data deleted after 30 days unless you cancel before then
- Care and worker records: If you keep care records or worker records in Invio (progress notes, incidents, worker screenings and credentials, shifts and hours), you as the provider are responsible for keeping the records the law requires; Invio deletes them 30 days after you delete your account, and offers you a full export first.
- Backups: We keep encrypted backups on a rolling 30-day cycle. Data you delete stays in any backup that was taken before the deletion, until that backup reaches 30 days old and is removed automatically
- Invoices and Quotes: Export and retain your own records as needed, including where tax law applicable to your region requires it (currently 5-7 years depending on jurisdiction)
- Voice recordings: Not stored by Invio - processed transiently to create your draft, then discarded
- AI conversations: The text of your Offsider chats and voice invoices is deleted automatically 30 days after it was written
- Files you send us for import help: Stored privately, readable only by our team, and deleted within 7 days of us returning your ready-to-import file (or within 14 days of receiving it if we do not return one)
- Xero sync records: kept while Xero is connected and, so that connecting the same organisation again does not create duplicates, after you disconnect; deleted when your account is permanently deleted (see Xero sync under Data sharing)
6. Data security
We protect your data with encryption in transit (HTTPS/TLS), encryption at rest, secure password hashing, and periodic security reviews (most recently in July 2026).
7. Data breach notification
If we experience a privacy breach that has caused, or is likely to cause, serious harm, the Privacy Act 2020 requires us to notify the Privacy Commissioner and affected individuals as soon as practicable - the Commissioner expects this within 72 hours of us becoming aware of a notifiable breach. Failing to notify without reasonable excuse is an offence under the Act. If you believe your information may have been affected by a breach, contact us at support@invio.co.nz.
8. Your rights (NZ Privacy Act 2020)
You have the right to access, correct, or delete your personal information. To exercise these rights, contact us at support@invio.co.nz.
9. Cookies
We use cookies for authentication, preferences, and analytics. You can control cookies through your browser settings.
10. Contact us
Privacy Officer: Bakhtiyar Duganov trading as Invio
Email: support@invio.co.nz
Address: Auckland, New Zealand
11. Complaints
If you have concerns about our handling of your data, you can contact the Office of the Privacy Commissioner:
Website: privacy.org.nz
Phone: 0800 803 909