Data Processing
Last updated: October 9, 2026
When you use Zen for your business, you put information about other people into it: your clients' names, email addresses, addresses and the invoices and quotes you send them. For that information, you (the business using Zen) are the controller and Zen is your processor. These terms, which form part of our Terms of Service, set out how we handle it, as required by Article 28 of the GDPR and by the CCPA for service providers.
1. What we process, and why
- Data: client names, email addresses, phone numbers and addresses; invoice and quote contents; and, if invoice activity is on, when shared documents are opened (time, approximate city, device and browser type; never the IP address).
- People concerned: your clients and their contacts.
- Purpose: only to provide the Service to you: storing and syncing your data, creating PDFs, sending emails and links you ask us to send, and showing you document activity.
- Duration: while you use the Service, until you delete the data or your account.
2. Our commitments
- We process your clients' data only on your instructions, given through how you use the Service. We don't sell or share it, use it for advertising, or use it for any purpose of our own.
- Everyone at Zen with access to it is bound by confidentiality.
- We protect it with appropriate technical and organisational measures: encryption in transit, restricted and key-protected access to systems, random tokens for shared links, and pages that can't run scripts or be embedded.
- We use the subprocessors listed below, under written terms that give your data the same protection. We'll update this page at least 30 days before adding or replacing one, so you can object.
- We'll help you answer requests from your clients to access, correct or delete their data, and with security and impact assessments where needed.
- We'll tell you without undue delay, and within 72 hours, if we become aware of a personal data breach affecting your data.
- When you delete data or your account, we delete it from our systems straight away. Invoice activity is deleted automatically after 12 months.
- We'll give you the information needed to show we meet these terms, and answer reasonable audit questions by email.
3. Subprocessors
| Provider | What they do | Data | Location |
|---|---|---|---|
| OVHcloud (OVH Hosting Inc.) | Application servers and database | All Service data | Canada |
| Cloudflare, Inc. | File storage (logos, signatures, shared PDFs), DNS, website hosting, security | Files you upload or share; connection data | Global network; United States |
| Zoho Corporation (ZeptoMail) | Sending emails (sign-in codes, invoices, team invitations) | Recipient email address and email content | United States |
| RevenueCat, Inc. | Subscription status and purchases | Account identifier, purchase history | United States |
| OpenRouter, Inc. (with OpenAI) | Zen AI answers, only if you use Zen AI | Your message and the invoices, quotes, clients and amounts needed to answer it | United States |
| Stripe, Inc. | Online invoice payments, only if you connect Stripe | Invoice number, amount and currency; your Stripe account ID | United States |
| Apple Inc. | Sign in with Apple, App Store purchases, push notifications | Account identifier, notification token and content | United States |
| Google LLC | Google Sign-In | Account identifier, email address | United States |
Approximate locations for invoice activity come from the DB-IP Lite database, which we download and run on our own servers. No data is sent to DB-IP. IP geolocation by DB-IP.
4. Transfers outside the EU and UK
Our servers are in Canada, which has an EU adequacy decision. Transfers to subprocessors in the United States rely on the EU Standard Contractual Clauses (with the UK Addendum) or the EU-U.S. Data Privacy Framework.
5. Your part
As the controller, you decide what client data to put into Zen and must have a lawful basis for it. If you share invoices as links with invoice activity on, the page your client opens tells them what is recorded and links to How invoice activity works. You can turn invoice activity off in Settings → Privacy.
6. Contact
Questions about these terms, or to request a signed copy: privacy@zeninvoice.io. See also our Privacy Policy.