Privacy Policy

1. Introduction

Welcome to AM Invoice, an online accounting platform operated by Sonnet Infotech ("we", "us", or "our"), a company incorporated in India. We are committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our website at aminvoice.com and our application at app.aminvoice.com (collectively, the "Service"). It is governed by the Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

By using our Service, you consent to the practices described in this Policy.

2. Data Controller

Sonnet Infotech is the data fiduciary responsible for your personal data.

Contact: info@aminvoice.com

3. Information We Collect

3.1 Account Information

• Name, email address, and phone number (provided during sign-up via Google, Facebook, or Phone OTP)
• Profile photo (from your Google or Facebook account, if applicable)
• Firebase Authentication identifier

3.2 Business & Financial Data

• Company details: name, address, tax ID (GSTIN), phone, email, logo
• Invoices, line items, client details, and invoice status
• Expense and income records
• Bank account details and transaction records
• Financial reports and ledger entries

3.3 Payment Information

• Subscription and billing details processed through our payment gateway partner. We do not store full card numbers on our servers.

3.4 Usage Data

• IP address, browser type, device information
• Pages visited, features used, and time spent on the Service
• Error logs and crash reports

4. How We Use Your Information

• To provide, operate, and maintain the Service
• To authenticate your identity and secure your account
• To process payments and manage subscriptions
• To generate invoices, reports, and financial summaries
• To send service-related communications (account alerts, invoices, updates)
• To improve our platform through usage analytics
• To comply with applicable legal obligations
• To respond to support requests and resolve disputes

5. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following lawful bases:

• Consent — you have given clear consent when you create an account
• Contract — processing is necessary to provide the Service you have subscribed to
• Legal obligation — processing required to comply with applicable Indian laws
• Legitimate interests — to improve security, prevent fraud, and enhance our platform

6. Sharing of Information

We do not sell, rent, or trade your personal data. We may share data with:

• Firebase / Google — for authentication and secure login
• Payment Gateway Partners — to process subscription payments
• Cloud Infrastructure Providers — for hosting and data storage in secure environments
• Law Enforcement / Government Authorities — when required by law or court order

All third-party service providers are contractually bound to process your data only as instructed by us and in accordance with applicable law.

7. Data Storage and Security

Your data is stored on servers located in India. We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• Encrypted storage for sensitive financial data
• Access controls and role-based permissions
• Regular security audits and vulnerability assessments
• Firewall protection and intrusion detection

Despite our best efforts, no method of transmission over the internet is 100% secure. In the event of a data breach, we will notify affected users as required under applicable law.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you the Service. Upon account deletion:

• Personal account data is deleted within 30 days
• Financial records may be retained for up to 7 years to comply with Indian tax and accounting laws
• Anonymised, aggregated analytics data may be retained indefinitely

9. Your Rights

Under the DPDP Act 2023 and applicable Indian law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data (subject to legal retention requirements)
• Withdraw Consent — withdraw consent at any time; this will not affect prior processing
• Grievance Redressal — raise a complaint with our Grievance Officer

To exercise your rights, contact us at info@aminvoice.com. We will respond within 30 days.

10. Cookies

We use essential cookies and local storage to maintain your session and preferences. We do not use third-party advertising cookies. You may disable cookies in your browser settings, but this may affect the functionality of the Service.

11. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately at info@aminvoice.com.

12. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or a prominent notice on the Service at least 30 days before the change takes effect. Continued use of the Service after the effective date constitutes your acceptance of the updated policy.

14. Grievance Officer

As required under the IT Rules 2011 and DPDP Act 2023, we have designated a Grievance Officer to address data-related concerns:

15. Contact Us