Privacy Policy

This policy explains what Zen ("Zen", "we", "us") collects when you use the Zen apps for iOS and Android, the web app, and zeninvoice.io (together, the "Service"), why, who we share it with, and the choices you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA).

1. Who is responsible

For your account and how you use Zen, we are the controller (GDPR) and the business (CCPA). For the information about your clients that you put into Zen (their names, contact details, invoices and quotes), you are the controller and we process it on your behalf, under our Data Processing terms.

2. What we collect

Your account

• Sign-in details: your email address, or the account identifier from Sign in with Apple or Google. If you use Zen without signing in, a random device identifier.
• Business information you enter: business name, logo, contact details, address, signature, price book, clients, invoices, quotes and notes.
• Team and referrals: the email addresses you invite, your role on a team, your referral code and who joined with it.
• Subscription status: whether you have Zen Pro and when it renews, from Apple through RevenueCat. We never see your card details.
• Device data: a push notification token if you allow notifications, your device model and system version (used to keep you signed in and to send notifications), and the app's language and settings.
• Messages to us: what you send to support.
• Receipts and expenses: receipt photos and the expense details you save. Receipts are read on your device; the photo is stored so it syncs to your other devices.

Zen AI (optional)

If you use Zen AI in the app, we send your message and the business data needed to answer it (for example your invoices, quotes, clients and amounts) to OpenRouter, our AI provider, which passes it to the AI model (OpenAI) to generate the reply. Zen asks for your permission before the first message. It's used only to answer you, isn't used to train AI models, and the conversation is deleted from our servers after a day of inactivity. If you connect Zen to ChatGPT, Claude or another AI app yourself, that app receives the data you ask it to read, under its own privacy policy.

Online payments (optional)

If you connect Stripe in Settings → Online payments, your Stripe account is linked to Zen so your clients can pay invoices by card, Apple Pay or Google Pay. Stripe collects the details it needs to open and verify your account and to process your clients' payments, under Stripe's privacy policy. We store your Stripe account ID and each payment's status to mark invoices paid. We never see or store card numbers.

Your clients, when they open what you share

When you share an invoice or quote as a link and your client opens it or downloads the PDF, we record the time, an approximate location (city, region and country, worked out from their internet connection using the DB-IP database on our own servers; IP Geolocation by DB-IP), and the type of device and browser. We use a salted one-way hash of their connection to count repeat visits once. We never store their IP address. Email security scanners and link previews are not counted. See How invoice activity works.

Our website

zeninvoice.io doesn't use advertising or tracking cookies. Cloudflare, which hosts the site, processes connection data such as IP addresses to deliver the site and protect it from attacks.

3. Why we use it, and our legal bases (GDPR)

• To provide the Service (contract): your account, syncing your data across devices, creating and sending invoices, teams, subscriptions.
• To show you when clients open what you shared (our and your legitimate interest in knowing an invoice was received). You can turn this off in Settings → Privacy, and we honour the Global Privacy Control signal from visitors' browsers.
• To send notifications (your consent, which you give and can withdraw in your device settings).
• To keep Zen secure and prevent abuse (legitimate interest), for example limiting emails per day and checking that referral rewards are genuine.
• To meet legal obligations, such as tax and accounting rules for subscriptions handled by Apple.

We don't use your data for advertising, sell it, or use it to train AI models.

4. Who we share it with

We use a small number of service providers (processors) to run Zen, listed with what they do and where on our Data Processing page: OVHcloud (servers and database, Canada), Cloudflare (file storage and website), ZeptoMail by Zoho (email), RevenueCat (subscriptions), Apple (Sign in with Apple, App Store, notifications), Google (Google Sign-In), OpenRouter and OpenAI (Zen AI, only if you use it) and Stripe (online payments, only if you connect it). They may only use your data to provide their service to us.

When you email an invoice or invite someone to your team, we send that email on your behalf to the address you entered. We may disclose information if the law requires it or to protect the safety of our users.

5. How long we keep it

• Your account and business data: until you delete it or your account.
• Invoice activity: 12 months, then deleted automatically. It's also deleted when you delete the invoice or quote.
• Sign-in codes: a few minutes. Team invitations: 14 days.
• Zen AI conversations: deleted after a day of inactivity.

When you delete your account (Settings → Personal Account → Delete Account), we delete it from our database and file storage straight away, along with your businesses, clients, invoices, quotes, shared links and their activity. Deleting your account doesn't cancel an App Store subscription; cancel that in your Apple account settings.

6. International transfers

Our servers are in Canada, which the European Commission recognises as providing adequate protection. Some of our providers are in the United States; transfers to them rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

7. Your rights

Everyone

You can see and correct your data in the app, export your invoices as PDFs, and delete your account at any time. For anything else, email privacy@zeninvoice.io. We reply within 30 days.

EU, EEA and UK (GDPR)

You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent. You can also complain to your local data protection authority. If you're a client of a Zen user, you can contact them directly, or us, and we'll help them respond.

California (CCPA)

You have the right to know what personal information we collect and how we use it, to delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share personal information (as defined by the CCPA) and don't use sensitive personal information. We honour Global Privacy Control signals. You can use an authorised agent to make a request.

Categories we collect: identifiers (email, account and device identifiers); customer records (business and client details you enter); commercial information (subscription status); internet activity (when a shared document is opened, device and browser type); approximate geolocation (city level, never precise location). Sources and purposes are described above.

8. Security

Data is encrypted in transit (TLS). Access to our systems is restricted and protected by keys. Shared invoice links use long random tokens, and shared pages can't run scripts or be embedded in other sites.

9. Children

Zen is for businesses and isn't directed to children under 16. We don't knowingly collect their data.

10. Changes

If we change this policy, we'll update the date above, and tell you in the app or by email if the change is significant.

11. Contact

Privacy questions and requests: privacy@zeninvoice.io. Anything else: support@zeninvoice.io.