Privacy Notice
Invoice Parse turns invoice documents into structured, queryable data — for your team and for the AI agents you connect to it. Because that means we handle the invoices you upload and the account behind them, this notice explains, in plain terms, what we collect, why, who processes it on our behalf, how long we keep it, and the rights you have over it.
1. Who we are
Invoice Parse is operated by Autonomous World, Lda., the data controller responsible for the personal data described in this notice.
- Controller: Autonomous World, Lda.
- Address: Travessa do Conde da Ponte, 27, 1300-141 Lisboa, Portugal
- Privacy contact: contact@invoice-parse.com
- Phone: +351 962 120 648
- Registration: VAT / NIPC PT518000290
If you have any question about this notice or about how your data is handled, contact us at the address above.
2. Information we collect
We collect only what we need to run the service. The categories below reflect how Invoice Parse actually works.
Account information. Email address, first and last name, and — where relevant — the organization you belong to and your subscription details. If you complete your billing/company profile, we also store the details you provide there: company name, VAT number, billing address (street, postal code, city, country), website and phone number.
Authentication information. Login credentials and session and API tokens (including mobile app tokens and MCP access tokens). Your password is submitted so we can authenticate you; it is stored only as a salted one-way hash and is never kept in a readable form. When you sign in from a mobile device or mark a device as trusted, we also store a device name/label — either one you provide, or, for a trusted device, a label derived from your browser's user-agent — so you can recognise and manage your active sessions.
Invoice documents. The photographs, images, PDFs and other files you upload, capture or share to Invoice Parse for processing.
Extracted and derived invoice data. Information read from your documents — vendor and customer details, addresses, tax identifiers, dates, invoice numbers, totals, currencies, line items — together with the tags you apply and the quality notifications we generate. We also create derived data, such as vector embeddings of invoice content, so that you and your connected agents can search and query your invoices.
Usage information. Subscription limits, the number of pages/parses you have processed, upload and processing status, and how you use features of the service.
Technical and security information. IP address, request timestamps, application version, operating system, and server and security logs.
Support communications. Your email address and the contents and attachments of messages you voluntarily send us.
Payment information. Subscriptions are handled by our payment processor, Stripe. Stripe processes your payment-card details directly; Invoice Parse receives limited billing metadata (such as plan, status and the last four digits of a card) and does not receive or store full payment-card numbers.
3. How we obtain your information
- Directly from you, when you register, log in and manage your account.
- From the files you photograph, select or share into the service.
- Automatically, as invoice data is extracted from those files.
- From your use of the website, mobile apps, APIs and MCP connector.
- From our subscription and payment provider.
- From your single sign-on provider (Google, Microsoft or LinkedIn) when you choose to log in with it — it returns your basic profile and email.
- From the support messages you send us.
4. Why we process your information
- To create and manage your account.
- To authenticate you and protect your account.
- To upload, process and store your invoices.
- To extract structured invoice data using OCR and AI-assisted extraction.
- To show you invoice history, detail views, dashboards and usage.
- To provide the exports, sharing and agent-query features you request.
- To administer subscriptions and usage limits.
- To provide customer support.
- To prevent abuse, fraud and security incidents.
- To diagnose failures and improve the reliability of the service.
- To meet our legal, tax and accounting obligations.
5. Legal bases for processing
For users in the EU/EEA, we rely on the following legal bases under the GDPR:
| Basis | Where it applies |
|---|---|
| Contract — Art. 6(1)(b) | Creating and running your account; uploading, processing, storing and extracting invoices; exports, sharing and agent queries; managing your subscription. |
| Legitimate interests — Art. 6(1)(f) | Keeping the service and accounts secure, preventing abuse and fraud, diagnosing failures, and improving reliability — balanced against your rights. |
| Consent — Art. 6(1)(a) | Optional marketing communications and any processing that is genuinely optional. You can withdraw consent at any time. (See §15 for how advertising/analytics cookies are handled.) |
| Legal obligation — Art. 6(1)(c) | Retaining billing and accounting records and responding to lawful requests, as required by Portuguese and EU law. |
Accepting this notice is not, by itself, the legal basis for our processing — each purpose relies on the specific basis above.
6. AI and automated processing
Invoice Parse reads your documents using optical character recognition (OCR) and AI-assisted extraction. The fields we extract are listed in §2 (vendor and customer details, addresses, tax identifiers, dates, invoice numbers, totals, currencies and line items).
The processors that carry out this work on our behalf are:
- Microsoft Azure AI Document Intelligence — OCR and structured invoice extraction.
- OpenAI — text embeddings (to power search), lightweight document classification, the built-in AI agent that answers questions about your invoices, AI-generated invoice summaries, and the optional AI image generation feature. These send the relevant invoice details (such as vendor, total, date and line items) to OpenAI for processing.
When you connect an AI assistant — such as Anthropic's Claude — through our MCP connector, you choose and authorize that connection, and the assistant receives only the invoice data it queries on your behalf. Because you control it, such an assistant is covered by the agent-access note below rather than being engaged by us as a processor.
Accuracy. Automated extraction can be incomplete or incorrect. Extracted values should be reviewed before you rely on them, and you can correct any field yourself.
Model training. We do not use your invoice documents or extracted data to train our own models, and we use the providers above under terms that do not permit your content to be used to train their models.
Automated decisions. Invoice Parse does not make decisions producing legal or similarly significant effects about you solely by automated means; extraction supports your review, it does not replace it.
7. Service providers and data sharing
We share personal data only with providers that help us deliver the service, and only so they can perform that service for us under contract. Our principal providers are:
- Microsoft Azure — hosting, database, file storage and document processing infrastructure.
- OpenAI — the AI processing described in §6.
- Stripe — subscription and payment processing.
- Google AdSense (Google Ireland Ltd.) — advertising and ad measurement on our public website; processes website-visitor data such as cookies and IP address, not your account or invoice data.
- Google, Microsoft and LinkedIn — single sign-on: if you choose to log in with one of these, it authenticates you and returns basic profile data (name, email); we store the resulting sign-in connection and tokens.
- Google reCAPTCHA — bot and abuse protection on our sign-up and contact forms; your interaction with the form (including IP address) is processed by Google.
- ipinfo.io — coarse geolocation (country and network) of request IP addresses, for security and analytics.
Team and organization sharing. If you belong to an organization or team on Invoice Parse, your invoices and their extracted data may be visible to other members of that group, as configured by your administrator.
Legal disclosure. We may disclose information where required by law or to respond to lawful requests from public authorities.
We do not sell your personal data, and we do not share your account or invoice data for third-party advertising.
8. International transfers
Your information is primarily hosted and processed within the European Union, in Microsoft Azure's West Europe region.
Some of our providers may process data outside the EEA. Where that happens, the transfer is protected by an appropriate safeguard: Microsoft Azure hosts your invoice data within the European Union, while Stripe and OpenAI process the limited data they receive under the European Commission's Standard Contractual Clauses. Anthropic's Claude is engaged only when you connect it yourself through the MCP connector (see §6).
9. How long we keep your information
We keep personal data only as long as needed for the purposes above or as required by law.
| Data | Retention |
|---|---|
| Active account information | For the life of your account. |
| Uploaded invoice files & extracted data | Until you delete the invoice, or until your account is deleted. |
| Deleted invoices | Removed from active systems immediately when you delete the invoice or your account; any residual copy in a rolling backup is purged as that backup ages out, within 7 days. |
| Temporary processing files | Deleted automatically once processing completes. |
| Backups | Rolling window of 7 days. |
| Security / server logs | Retained only as long as needed for security, abuse-prevention and diagnostics. |
| Support emails | Kept only as long as needed to handle and resolve your request. |
| Billing & legally required records | Retained for the period required by Portuguese accounting and tax law — up to 10 years. |
10. Deleting invoices and your account
Deleting an invoice. Deleting an invoice removes the original document from storage together with its extracted data, edit history, notifications, embeddings and tags — subject to the backup and legal-retention limits in §9. Some related derived files — such as AI-generated images and originals from uploads that failed processing — may remain in storage after deletion. Separately, our technical and security logs may have transiently recorded values you submitted (for example when editing an invoice); these logs are kept under the security-log terms in §9, apart from your invoice record.
Deleting your account. You can request account deletion directly from the Android and iOS apps (and via support). When you do, we run a three-stage process:
- Any active subscription is cancelled so you are not billed again.
- Every invoice you uploaded is permanently deleted, including the original files, extracted data, edit history, notifications, embeddings and tags. Some related derived files — such as AI-generated images and originals from uploads that failed processing — may remain in storage after deletion.
- Your remaining personal data — auth tokens, custom tags, and AI data such as chat history and field corrections — is deleted, and your user record is anonymized (email, name and username are scrubbed and the password is made unusable).
For legal, security and financial compliance, some records are retained rather than deleted: billing and payment records; security and audit logs (such as login history, invoice-access and request logs, which can include your email address, IP address and access details); and any organization or people-group you own (kept so shared records remain available to their members). Your user account row itself is anonymized (email, name and username are scrubbed and the password is made unusable) so it no longer contains personal information, but these separate records are kept. Deletion is irreversible, typically completes within a couple of minutes, and any residual backup copies age out within 7 days as backups roll over.
11. Your rights
If you are in the EU/EEA, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data (subject to legal retention).
- Restrict processing in certain circumstances.
- Object to processing based on legitimate interests.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these, contact us at contact@invoice-parse.com. We will respond within one month, as required by the GDPR. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt.
12. Security
We use a range of measures to protect your information, including:
- Encryption in transit using HTTPS/TLS.
- Access controls and isolation so each user sees only their own data.
- Protected storage of mobile session tokens.
- Logging, monitoring and incident-response processes.
- Limited employee and provider access on a need-to-know basis.
No online service can be guaranteed completely secure, and we do not claim to be. We work to protect your data using the measures above and keep them under review.
13. Mobile app permissions
The mobile apps ask for access only where a feature needs it:
| Permission | Why |
|---|---|
| Camera | To capture an invoice with your camera. |
| Photo / media picker | To select invoice images you choose. |
| File picker | To select PDFs and documents you choose. |
| Share intents | To receive files you explicitly share into Invoice Parse. |
| Internet access | For authentication, upload and API communication. |
Selecting a file or photo gives Invoice Parse access only to the items you choose — not to your entire photo library or file system.
14. Children
Invoice Parse is a business tool and is not intended for children. You must be at least 16 to use it. We do not knowingly collect personal data from children; if we learn that we have, we will delete it.
15. Cookies
Our website uses essential cookies needed to sign you in and keep your session secure. These are always active because the service cannot function without them.
We also use Google AdSense to show advertising on our public website. AdSense sets non-essential advertising and analytics cookies and processes data such as your IP address and your interactions with ads in order to serve and measure them. You can opt out of personalised advertising through Google's Ads Settings and limit or block cookies through your browser — these controls, rather than our cookie banner, govern the advertising cookies AdSense sets. Advertising cookies are used only in connection with browsing the public website — never with your account or invoice data.
16. Support and privacy contact
For general support and bug reports, and for privacy and data-rights requests, contact us at contact@invoice-parse.com.
17. Changes to this notice
We may update this notice from time to time. The current version is always available on this page, with the effective and "last updated" dates shown at the top. If we make a material change, we will notify you by a reasonable method — for example, by email or an in-app notice — before it takes effect.
Autonomous World, Lda. · Travessa do Conde da Ponte, 27, 1300-141 Lisboa, Portugal · contact@invoice-parse.com · © 2026 Invoice Parse. All rights reserved.