Privacy Policy

Quantize EOOD, UIC 205752119 (VAT: BG205752119), ul. Tundzha 13, 3400 Montana, Bulgaria (“Invorato”, “we”, “us”) is the controller of personal data about account holders, team members and website visitors.

When you add information about your own clients and their contacts — such as names, email addresses, postal addresses and VAT numbers — you are the controller of that data and we act as your processor under Article 28 of the GDPR. Our Data Processing Agreement (DPA) governs that processing and forms part of our Terms of Service. You can request a signed copy by emailing support@quantizebg.com.

We collect only the data necessary to provide, secure and improve the service:

• Account data: name, email address, password hash (bcrypt), company name, role and preferred language. If you sign in with Google, we receive your name, email and profile photo from Google — we do not receive your Google password.
• Billing data: subscription plan, invoices from us to you, billing address and VAT number. Payment card details are processed directly by our payment provider (Stripe) and never touch our servers.
• Business content: billing profiles, clients, contacts, items, proposals, contracts, invoices, time entries, expenses and uploaded files. This is Your Content as defined in the Terms of Service.
• Signature data: when someone signs a proposal or contract, we record their name, email, IP address, timestamp, browser user-agent and signature image in a tamper-evident audit trail.
• Usage data: server-side log records including IP address, browser type, pages visited and actions taken. We use these to detect abuse, fix bugs and understand aggregate usage patterns — not to build individual profiles.
• Communications: emails and support messages you send us, which we retain to provide context for future support interactions.

We process personal data on the following legal bases under GDPR Article 6(1):

• Performance of contract (Art. 6(1)(b)): to provide the service, send your invoices and emails, generate PDFs, validate VAT numbers and process your subscription payments.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, detect and prevent fraud, fix bugs, analyse aggregate usage patterns and improve the product. We balance these interests against your rights and do not use this basis for direct marketing.
• Consent (Art. 6(1)(a)): to send product updates, feature announcements and occasional newsletters. You can withdraw consent with one click in any email, or from Settings.
• Legal obligation (Art. 6(1)(c)): to maintain accounting records, respond to lawful requests from authorities and comply with tax reporting requirements.

We do not use the content of your invoices, proposals or contracts to train AI or machine-learning models. We do not sell, rent or trade your personal data to any third party for advertising, analytics or any other purpose. We never have and we never will.

Invorato is hosted in data centres in the European Union (currently Germany and the Netherlands). Your data is processed and stored in the EU by default.

Some of our subprocessors may access data from outside the European Economic Area, for example for technical support or email delivery. Where a transfer outside the EEA occurs, we ensure it is protected by one of the following mechanisms:

• An adequacy decision by the European Commission (e.g. for the UK, Switzerland, Japan, South Korea);
• Standard Contractual Clauses (SCCs) approved by the European Commission, with supplementary technical and organisational measures where needed;
• The EU-US Data Privacy Framework, where a subprocessor is certified.

You can request a copy of the applicable transfer safeguards by emailing support@quantizebg.com.

We share personal data only with providers that help us operate Invorato, under written data processing agreements that require them to protect it to a standard consistent with this policy. Our current subprocessors:

If you connect an integration (such as an AI assistant or accounting tool), we send it the data necessary for that integration to function, under the provider’s own terms and privacy policy.

We will notify you by email at least 30 days before engaging a new subprocessor that processes Your Content or personal data. If you object to a new subprocessor, you may close your account and receive a prorated refund for any prepaid, unused subscription period.

We retain personal data only for as long as needed for the purposes described in this policy:

• Account and business content: for as long as your account is active. After you close your account, Your Content remains available for export for 30 days, then is permanently deleted from active systems.
• Backups: rolling backups are overwritten within 90 days of deletion from active systems.
• Signature audit trails: retained for the life of the associated contract in your account, so the legal record remains verifiable.
• Our own billing records (invoices from us to you): retained for as long as tax law requires, typically up to 10 years.
• Security and access logs: retained for up to 12 months, then deleted or anonymised.
• Support conversations: retained for up to 24 months after the last interaction, then deleted.

We may retain anonymised, aggregated data (from which no individual can be identified) indefinitely for statistical and product-improvement purposes.

Regardless of your location, we extend the following data protection rights to all Invorato users:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten").
• Restriction: ask us to temporarily stop processing certain data.
• Portability: receive your data in a structured, machine-readable format (CSV, JSON).
• Objection: object to processing based on our legitimate interests.
• Withdraw consent: withdraw consent for marketing at any time, without affecting the lawfulness of prior processing.
• Automated decisions: you have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you. Invorato does not currently make such decisions.

Most of these actions you can perform yourself in Settings → Account. For anything else, email support@quantizebg.com and we will respond within one month, as required by Article 12 of the GDPR. If your request is complex or we receive a large number of requests, we may extend this period by up to two additional months and will inform you.

If your request concerns personal data held by one of our customers (for example, your name and email on an invoice sent to you through Invorato), we will pass your request to the relevant customer, who is the controller of that data.

You also have the right to lodge a complaint with your local data protection supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP) at cpdp.bg.

We use only strictly necessary cookies — the minimum needed to keep you logged in, remember your preferences (such as language and theme) and protect against cross-site request forgery (CSRF). These cookies are essential for the service to function and do not require consent under the ePrivacy Directive.

We do not use advertising cookies, social media tracking pixels or third-party analytics cookies. Our website analytics are cookieless, privacy-respecting and do not track you across sites. Because we use no non-essential cookies, we do not show a cookie consent banner.

We implement technical and organisational measures appropriate to the risks involved:

• Encryption: all data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Access control: access to production systems is restricted to a small number of authorised personnel, protected by multi-factor authentication and logged.
• Authentication: two-factor authentication (TOTP) is available for every Invorato account. Passwords are hashed with bcrypt.
• Infrastructure: our servers run in isolated virtual networks with automated security patching and intrusion detection.
• Backups: encrypted, geographically redundant backups are performed daily and tested regularly.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay (Article 34).

Invorato is a business service and is not directed at anyone under 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at support@quantizebg.com.

If we change this policy in a way that materially affects your rights, we will email account holders at least 30 days before the change takes effect. The date at the top of this page shows when it was last updated. We encourage you to review this policy periodically.

Contact our privacy team at support@quantizebg.com, or write to us at ul. Tundzha 13, 3400 Montana, Bulgaria. We aim to respond to privacy enquiries within five working days.