Privacy Policy

Incusia is a Norwegian company. This policy describes the personal data the product actually stores and what happens when you delete an account. It is written for the EU General Data Protection Regulation (GDPR). The contact for data protection questions is me@abassinvoice.com.

Who is the controller, and who is the processor

Incusia is the controller of account data. That is your name, email address, business details, billing relationship with us, and how you use the product.

Incusia is the processor of customer-uploaded data. That is the names, email addresses, postal addresses, and payment details of your own clients, plus the invoices, estimates, time entries, and expenses you create about them. You are the controller of that data. You decide why it is collected. The Data Processing Agreement applies automatically to every customer. The companies that process data for us are listed on the sub-processor page.

Account data we collect

When you create an account, we store:

• ●Your email address and a hashed password. We never see the password itself. Supabase Auth stores the hash.
• ●Business name, business email, address, and phone, if you add them.
• ●A logo file, if you upload one on a plan that allows it.
• ●Plan, subscription status, and the Stripe customer id. We do not store your card number. Stripe does.
• ●Usage of the signed-in product, such as which invoices exist and whether reminders were sent.

Legal basis

We process account data to provide the service you signed up for. The legal basis is contract, GDPR Article 6(1)(b).

We process a limited amount of usage data to keep the service secure and to fix the product. The legal basis is legitimate interest, Article 6(1)(f). The interest is running a reliable invoicing service. We do not use this to build advertising profiles.

We do not send a marketing newsletter. Product email, such as a payment receipt or a weekly summary you can turn off in Settings, is part of the service. If we ever send marketing email, we will ask for consent first, Article 6(1)(a), and you will be able to withdraw it.

Issued invoice records that we have to keep after you close an account are kept because Norwegian bookkeeping law requires it. The legal basis is legal obligation, Article 6(1)(c).

Client data you upload

The fields you type about a client can include their name, email, company, postal address, and phone. Invoices and estimates can include amounts, line items, notes, and payment status. Expenses can include a receipt image. Time entries can include a description and a rate.

We process that data on your instructions, which are the actions you take in the product and the terms of the Data Processing Agreement. We do not sell it, we do not use it for advertising, and we do not use it to train public AI models.

Payment card details for your clients go to Stripe when you turn on a payment button. Those card numbers are not stored on Incusia servers.

How long we keep it

Account data is kept while the account is open. When you delete the account from Settings, the login, profile, client list, estimates, time entries, expenses, activity history, logo, and receipt files are deleted then, not after a waiting period.

Issued invoices are the exception. Drafts are deleted with the account. Invoices that have been sent, viewed, paid, overdue, cancelled, or refunded are copied into a private bookkeeping store and then removed from the live account. Each copy is kept until 31 December of the year five years after the invoice date. That matches the five-year period in the Norwegian Bookkeeping Act (bokføringsloven). Incusia does not store your financial year, so we use the calendar year. A monthly job deletes a copy after that date. The copy keeps the invoice content, the client name, company, and address, and your business name and address. It does not keep the client email or phone number.

That bookkeeping store is not readable from a customer login. Provider backups may still hold a deleted account for the backup cycle Supabase uses. We do not keep a separate archive of deleted accounts beyond the issued invoices described above.

Stripe keeps payment records under Stripe's own rules after a subscription is canceled. Deleting Incusia does not close a Stripe account you connected so that your clients can pay you.

Your rights

Under GDPR Articles 15 to 22 you can ask to access, correct, erase, restrict, or receive a copy of personal data, and you can object to processing based on legitimate interest. We respond within 30 days. Email me@abassinvoice.com from the address on the account.

• ●Access. Settings includes a download of clients, invoices, estimates, time entries, and expenses as CSV, plus invoice and estimate PDFs. That download works on every plan, including Free. You can also email us and we will send what we hold.
• ●Rectification. You can edit business details, clients, and draft documents in the product. Email us if something in a bookkeeping copy is wrong.
• ●Erasure. Delete the account in Settings. Issued invoices are kept for the bookkeeping period above, which is the limit on erasure.
• ●Restriction. Email us and say what you want paused. We will stop using it for anything other than storage, or the reason the law still allows, while we sort it out.
• ●Portability. The CSV and PDF download is the portable copy of what you put into Incusia.
• ●Objection. Email us if you object to the legitimate-interest uses, which are security and fixing the product. We will stop unless we have a compelling reason to continue.

You can lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, at datatilsynet.no. You can do that without asking us first.

Where data is processed

On 2 October 2026 the live site responded with a Vercel header showing the application function in Washington, D.C. (iad1) and the edge that answered that check in Stockholm (arn1). The edge changes with the visitor. We could not confirm the Supabase database region from the project URL or response headers, so this policy does not name one.

Where a provider processes personal data outside the EEA, we rely on that provider's standard data processing terms, including the Standard Contractual Clauses they publish. The providers and the data they touch are on the sub-processor list.

Cookies and analytics

A session cookie keeps you logged in. It is required for the account to work.

Google Analytics runs only after you accept analytics cookies. If you reject them, Google Analytics does not load. It receives page and click data, not your client list or invoice contents. You can change that choice from Cookie Preferences in the footer.

Vercel Web Analytics is also on. It records page views for the marketing site and does not wait for the cookie banner. It does not receive client or invoice records. That is a gap if you expected every analytics tool to wait for consent, and it is stated here so the page matches the code.

Anything you type into a free tool is saved in your own browser and is never sent to us. An email address given to receive a file is kept only to send that file and one follow up.

Security and breaches

How the product is protected is described on the security page. If we become aware of a breach of personal data, we will tell the affected customer without undue delay and within 72 hours. Where we are the controller, we will also notify Datatilsynet when the GDPR requires it.

Children

Incusia is not for people under 18. We do not knowingly collect their data.

Changes

If this policy changes in a way that affects your data, we will update this page and email account holders when the change is significant. The date at the top is the last update.