Trust & legal

Privacy, terms, and security.

The current trust and legal notes for businesses evaluating or using invoices86. Last updated August 9, 2026.

Privacy

invoices86 processes business invoice data to extract invoice fields, normalize products, and provide useful invoice and price history. We do not sell raw customer or invoice records.

Information we collect

  • Account details such as name, email address, restaurant/workspace name, role, login records, and support messages.
  • Invoice files and extracted invoice data, including vendors, dates, invoice numbers, totals, line items, product names, quantities, units, and price history.
  • Usage and device information such as pages visited, browser type, approximate region, timestamps, app events, and error diagnostics.
  • Billing information handled through Stripe, including customer ID, subscription ID, payment status, plan, and invoice/payment event records. Full card numbers are processed by Stripe and are not stored by invoices86.
  • Google Sign-In profile information, such as email address and account identifier, when you choose Google authentication.
  • Business contact and outreach records such as a contact name or role, business name, business email address, official website and source URL, source-check date, permission evidence, message status, replies, and opt-out or suppression status.

How we use information

  • Provide authentication, workspace access, invoice upload, extraction, review, product normalization, price history, billing, and support.
  • Improve extraction quality, repair vendor and product aliases, detect duplicate invoices, investigate errors, secure the service, and measure product usage.
  • Analyze invoice patterns, supplier categories, business characteristics, product usage, support needs, activation, conversion, retention, and feature demand to improve invoices86, prioritize features, develop aggregate or de-identified segments, and make business communications more relevant.
  • Send transactional notices about account access, billing, support, security, or service changes.
  • Send relevant business communications where permitted, document the source and permission basis for outreach, route replies, honor unsubscribe requests, and prevent further contact with suppressed addresses.

Who receives information

We disclose the minimum information reasonably needed to operate and improve invoices86, perform an exact support or analysis task, comply with law, protect the service, or fulfill your requests. Service providers may include Supabase for database, authentication, and storage; Vercel for hosting and logs; Stripe for payments and subscriptions; approved AI providers for invoice extraction or bounded product analysis; PostHog for privacy-conscious product analytics; Resend for authorized business-email delivery, delivery events, and reply routing; and approved research, contact-verification, email, or support tools used for business operations.

We do not send raw invoice attachments or complete customer message threads to advertising, lead-data, or public-research services. We do not share payment-card, bank, tax, password, or authentication secrets outside the service path that requires them, give one customer's identifiable invoice history or private supplier terms to another business, or present a customer as an endorsement without permission.

How information is disclosed

Disclosures happen through encrypted server-to-server API calls, hosted checkout or billing portal redirects, webhook events, database/storage access controlled by service credentials, email delivery and reply-routing infrastructure, support emails you send us, or legally required responses. Service providers are used for invoices86 operations and are not authorized to sell restaurant invoice data.

Retention and choices

We keep account, invoice, extraction, billing, outreach, derived-learning, and audit records for as long as needed to provide and improve the service, resolve disputes, meet legal obligations, and preserve requested invoice history. We retain opt-out and suppression records as needed to honor those choices and prevent unwanted re-contact. Business-email recipients may unsubscribe through the message link or by replying with an opt-out request. Contact hello@invoices86.com to request access, export, correction, deletion, limitation, opt-out, or other applicable privacy help; applicable choices are propagated to active derived segments and processor tasks.

Terms

invoices86 is provided for restaurant invoice tracking, extraction, review, product normalization, and price-history workflows. Users are responsible for uploading invoices they are permitted to process and for reviewing extracted results before relying on them operationally.

Paid subscriptions are billed through Stripe. Customer agreements, order forms, or subscription checkout terms define production access, payment, cancellation, support, and any additional data handling commitments.

Acceptable use

Do not upload files you do not have the right to process, attempt to bypass authentication or workspace permissions, scrape or overload the service, or use invoices86 to process unlawful or highly sensitive personal data unrelated to restaurant invoice operations.

Service outputs

Extraction, normalization, price-history, and variance outputs are workflow aids. Restaurants should review invoice records, product mappings, units, totals, and price changes before using them for purchasing, accounting, or vendor conversations.

Billing and cancellation

Subscription billing, payment method updates, invoices, and cancellation are handled through Stripe Checkout and the Stripe customer portal when available. Access may be limited, suspended, or downgraded if payment fails, a subscription is canceled, or account terms are violated.

Security

Invoice files and extracted data are protected behind authenticated app access, private storage buckets, database row-level security, service-role-only backend operations, and HTTPS in transit. Sensitive environment variables are stored as encrypted deployment secrets.

Access to restaurant workspaces is role-based. Signed file URLs are time-limited, administrative routes require authenticated authorization, and production readiness checks verify private Supabase tables and storage buckets reject anonymous access.

Operational safeguards

We separate public marketing pages from authenticated app routes, keep payment processing on Stripe-hosted surfaces, log operational failures for investigation, and avoid exposing service-role credentials to browsers or public clients.

Vendor and AI processing

Invoice content may be sent to trusted infrastructure and AI providers only to provide extraction, review, storage, billing, analytics, support, and security functions for invoices86. We limit provider access to the purpose needed to operate the service.

Security contact

Report suspected security issues to hello@invoices86.com. Include the affected account, URL, timestamp, and a concise description so we can investigate quickly.

Support contact

Email hello@invoices86.com with the restaurant name, invoice vendor, and issue.

For privacy, billing, account, deletion, export, or security requests, include the email address tied to the workspace and enough detail to verify the request. Do not send card numbers or passwords by email.