Privacy Policy - Lan Invoice

Last updated: 2025 October 7

Scope

This policy describes how we collect, use, disclose, and protect personal data when you use the Lan Invoice mobile apps (iOS/Android) and related in-app experiences. Lan Invoice helps freelancers and small businesses track time, manage customers, and generate invoices. This is an invoicing and time‑tracking tool and does not provide tax, accounting, or legal advice. Your core business, customer, session, and invoice data are stored locally on your device; optional iCloud backup is user controlled.

What we collect

Account and identifiers: We collect an anonymous authentication UID by default via Firebase (no email or password required unless you voluntarily supply one for contact), device identifiers such as the Firebase App Instance ID and the RevenueCat subscriber ID, and a push notification token if you enable notifications.

Business and customer content: We store the data you enter including business profile details (name, address, optional registration or tax ID, preferred currency, default tax rate, invoice numbering settings, optional logo), customer records (name, email, address, optional tax ID, rates, currency), time tracking sessions (start and end timestamps, duration, notes, customer linkage), and invoice records (line items, calculations, totals, PDF generation metadata). This data remains on-device except when you enable iCloud backups.

Preferences: We process in-app settings, onboarding completion, notification settings, and backup preferences.

Usage and diagnostics: We collect app events/analytics, crash logs, performance metrics, approximate device and app metadata (model, OS version, app version, timezone) and IP-derived coarse location via Firebase for analytics. These are configured without advertising features.

Payments/subscription metadata: We process store receipts, transaction identifiers, product identifiers, and active subscription status through Apple App Store or Google Play Store and RevenueCat. We do not collect full payment card numbers.

Support communications: We process messages you send to us (e.g., via email) to handle support and feedback.

Why we process data (GDPR legal bases)

Provide and operate the service (Art. 6(1)(b)): We authenticate your device anonymously, persist your business, customer, time tracking, and invoice data, manage subscription entitlements and in-app purchases, deliver service notifications (timers, reminders, due date alerts), and enable optional iCloud backup you choose to activate.

Improve and secure the app (Art. 6(1)(f)): We use analytics and diagnostics to understand performance, detect and remedy crashes, prevent fraud or misuse, and maintain service quality. These legitimate interests are balanced against your rights.

Comply with law (Art. 6(1)(c)): We retain purchase and accounting records and may respond to lawful requests where applicable.

Consent (Art. 6(1)(a)): We send optional marketing or non-essential notifications only with consent where required. You can withdraw consent at any time in-app or by emailing us.

What we don't do

We do not provide tax, accounting, or legal advice; generated invoices and calculations are your responsibility to review. We do not enable advertising SDKs or cross‑context behavioral advertising and ad tracking features are disabled. We do not sell, rent, or trade personal data. We do not collect full payment card numbers. We do not automatically upload your invoice or customer database to our servers; iCloud backup is optional and under your control.

How we use data

We use your data to deliver core invoicing, time tracking, PDF generation, customer management, subscription entitlement validation, and optional iCloud backup. We use diagnostics to understand crashes and performance and to protect against abuse. We use analytics to measure feature adoption and, if applicable, non‑personalized campaign attribution. We aggregate usage metrics for internal planning and do not sell them.

Sharing and disclosures

We share data only with service providers (processors) who help us run Lan Invoice and who are bound to process it solely under our instructions:

Analytics configuration: We do not enable Google Signals or advertising features; ad-related consents (ad_storage, ad_personalization, ad_user_data) are set to denied; we do not use IDFA; we disable IDFV collection on iOS; and we do not request the Advertising ID on Android.

Corporate transactions: If we merge, acquire, or sell assets, personal data may transfer under this policy.

Legal: We may disclose data to comply with law or protect rights, security, or integrity.

Refund-Related Data Sharing with Apple App Store Customers

If you request an Apple App Store refund, Apple may ask us to confirm limited consumption data (purchase identifier, subscription tier, time‑stamped logs of premium feature access). We share only what is necessary to help Apple verify refund eligibility and prevent misuse.

International transfers

We are based in Sweden and may transfer data internationally. Where data leaves the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses together with technical and organizational measures.

Retention

Account, business, and invoicing data remain on your device while you actively use the app and for a reasonable period after last activity unless you delete it or request deletion. Diagnostics and analytics data are typically retained for 14–26 months unless a shorter period is configured or longer retention is needed for security or legal obligations. Purchase and subscription records are retained as required for accounting, tax, and fraud prevention. iCloud backups (if enabled) reside in your personal iCloud Drive and follow Apple's retention; we do not access them.

Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), a local‑first data model (SQLite on device), access controls and least privilege for service integrations, anonymous authentication by default, and iCloud encryption managed by Apple when you enable backup. No system is entirely secure and you are responsible for validating the accuracy of invoices and tax calculations before external use. We practice data minimization and retain only what is needed to operate and improve the service.

Children and age restrictions

Lan Invoice is not directed to individuals under 18 and we do not knowingly collect personal data from users under 18. If you believe a minor has provided data, contact us so we can remove it.

Your rights

EEA/UK (GDPR): You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests, and you may withdraw consent at any time. You can also lodge a complaint with a supervisory authority.

California (CPRA): You have rights to know/access, correct, delete, and to non‑discrimination. Sale/share disclosure: We do not sell or share personal information as defined by CPRA (including no cross‑context behavioral advertising). Global Privacy Control (GPC): We honor applicable opt‑out preference signals where required.

How to exercise: Use in‑app privacy or backup settings (e.g., export or delete data) or email. We may need to verify your request and will respond within 45 days (extendable once by 45 days where necessary).

Applicability note: California disclosures apply to the extent required by law; where not required we provide them voluntarily for transparency.

CalOPPA disclosures (California Online Privacy Protection Act)

Do Not Track (DNT) signals are not standardized and we do not currently respond to them. For California residents we honor applicable opt‑out preference signals such as GPC where required. Our analytics and diagnostics providers may collect information about app usage as described above.

State-specific notes (summary)

California (CPRA): We do not sell or share personal information, we provide access/correction/deletion rights, we honor opt‑out preference signals as applicable, and we do not use sensitive personal information for additional purposes beyond delivering and securing the service.

Other US states: Where state privacy laws grant similar rights you may exercise them using the methods described.

Push notifications

Service-related notifications (e.g., active timer reminders, invoice due date alerts, subscription status, milestone summaries) are part of the app experience. You can control notifications via in‑app settings or device system settings. Marketing or non‑essential notifications are sent only with consent where required and you can opt out at any time.

Market data and third-party content

If future versions display third‑party market, reference, or informational content, that content may be delayed, incomplete, or inaccurate and limited request/device data may be processed by the provider to serve it. Loheden AI Solutions AB is not responsible for third‑party content accuracy or reliability.

Changes to this policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact

Email: [email protected]

Address: Loheden AI Solutions AB, Vretavägen 26, 71993 Vintrosa, Sweden