SimpleInvoicely

Effective Date: September 11, 2026, Last Updated: September 11, 2026

SimpleInvoicely ("SimpleInvoicely," "we," "us," or "our") is operated by SIMPLE INVOICELY LTD, a company registered in Nigeria. This Privacy Policy explains how we collect, use, disclose, and protect information when you use simpleinvoicely.com and any related subdomains, applications, or services (collectively, the "Service").

Please read this policy carefully. By creating an account or otherwise using the Service, you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.

1. Who This Policy Applies To

The Service is used by two distinct groups of people, and this policy treats them differently because our relationship to their data is different:

Organization Users. These are the businesses that sign up for SimpleInvoicely, and their staff (owners, managers, sales reps, accountants, and so on). For this group, we are the data controller, meaning we decide how their account data is used to operate the Service.
End Customers. These are the customers of an Organization, who may receive invoices, receipts, or waybills, or use the optional customer self-service portal. For this group's data (names, contact details, purchase history, and similar), we act as a data processor on behalf of the Organization, which remains the data controller. If you are an End Customer with a question about how your data is used, your first point of contact should be the Organization you transacted with, since we process that data on their instructions.

2. Information We Collect

2.1 Information You Provide Directly

Account registration details: name, email address, phone number, business name, business address
Organization data you enter into the Service: products, customers, invoices, pricing, staff records, supplier information, and similar business records
Payment and billing information for your SimpleInvoicely subscription. This is processed by our payment partners; we do not store your full card numbers.
Payment gateway credentials you provide to connect your own Paystack, Flutterwave, or Stripe account for collecting payments from your customers (stored encrypted; only you can use them to process your own transactions)
Support communications, feedback, and feature requests you submit to us

2.2 Information Collected Automatically

Log data: IP address, browser type, device information, pages visited, timestamps
Usage data: how you interact with the Service, features used, actions taken (this powers audit logs, which exist for your own security and accountability)
Cookies and similar technologies, used for authentication (keeping you logged in), security (detecting suspicious activity), and basic analytics. We do not use cookies for third-party advertising.

2.3 Information About Your End Customers

If you use the Service to create invoices, receipts, or a customer portal account for your own customers, you may enter their name, contact information, and transaction history into the system. You are responsible for having a lawful basis to share this information with us and for your own customers' privacy rights. See Section 9 for more on this.

3. How We Use Information

We use collected information to:

Provide, operate, and maintain the Service
Process your subscription billing and your customers' payments through connected gateways
Send you service-related communications: invoice notifications, low-stock alerts, payment confirmations, subscription reminders, and security alerts
Detect, investigate, and prevent fraud, abuse, and security incidents
Provide customer support, including, where necessary, accessing your account under the controlled process described in Section 6
Comply with legal obligations, including tax and financial recordkeeping laws applicable to us
Improve and develop the Service

We do not sell your personal information or your customers' personal information to third parties, and we do not use your business data to train third-party advertising products.

4. Legal Basis for Processing

Where the Nigeria Data Protection Act ("NDPA") or another applicable data protection law requires a legal basis for processing, we rely on one or more of the following: your consent, the necessity of processing to perform our contract with you (i.e., to provide the Service you signed up for), our legitimate interests in operating and securing the Service, and compliance with legal obligations.

5. How We Share Information

We share information only in the following circumstances:

Payment processors. Paystack, Flutterwave, and/or Stripe process subscription billing and, where you connect your own account, your customers' payments to you. Each processor has its own privacy policy governing the information it handles directly.
Infrastructure and service providers. This includes our hosting/server providers, our email delivery provider (Resend), and security or anti-abuse services such as Cloudflare Turnstile and Google reCAPTCHA. Each acts under contract, and only to the extent necessary to provide their function.
Legal and safety reasons. We may share information where required by law, court order, or governmental request, or where it's necessary to protect the rights, property, or safety of SimpleInvoicely, our users, or the public.
Business transfers. If the company operating SimpleInvoicely is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a policy offering at least equivalent protection.

We do not share your data with third parties for their own independent marketing purposes.

6. Support Access and Account Impersonation

To diagnose technical issues, our authorized support staff may, in limited and controlled circumstances, temporarily access your account in a support capacity ("impersonation"). This access is: logged with a stated reason, time-limited, visibly indicated within the interface at the time it occurs, and recorded in an audit trail. You may request a record of any such access to your account by contacting us.

7. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. Following account closure or subscription lapse, your data remains accessible to you for export for a reasonable period (see our Terms of Use for specifics), after which it may be retained only as required for legal, tax, audit, or dispute-resolution purposes, or deleted, at our discretion, in line with applicable law.

8. Data Security

We apply administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including encryption of sensitive credentials at rest, encrypted transmission (HTTPS/TLS), access controls, and audit logging. No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your own login credentials and for enabling two-factor authentication where available.

9. Your Rights

Depending on applicable law, including the NDPA, you may have the right to: access the personal information we hold about you, request correction of inaccurate information, request deletion of your information (subject to our legal retention obligations), request a copy of your data in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent.

To exercise these rights, contact us using the details in Section 14. If you are an End Customer of an Organization using our Service, please also refer to Section 1. The Organization may be the more appropriate first point of contact for certain requests.

10. International Data Transfers

Our infrastructure and third-party service providers may process or store data outside Nigeria. Where this occurs, we take reasonable steps to ensure such transfers are conducted in a manner consistent with applicable data protection law.

11. Children's Privacy

The Service is intended for business use by adults. We do not knowingly collect personal information from individuals under the age of 18. If you become aware that a minor has provided us with personal information, please contact us so we can take appropriate action.

12. Cookies

We use cookies necessary for authentication, security, and core functionality of the Service. You may configure your browser to refuse cookies, but doing so may prevent parts of the Service from functioning correctly.

13. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and, where required, the relevant regulatory authority, in accordance with applicable law and without undue delay.

14. Data Protection Compliance (Nigeria Data Protection Act)

We take our obligations under the Nigeria Data Protection Act, 2023 ("NDPA") and its subsidiary regulations seriously, and this section sets out the specific measures we maintain in addition to the general commitments described above.

Data minimization. We collect only the information reasonably necessary to provide the Service, and we do not require you or your Organization to provide information beyond what is needed for account operation, billing, and support.
Accuracy. You are responsible for keeping your account and business information accurate and up to date. You may correct inaccurate information yourself through your account settings, or by contacting us.
Storage limitation. Personal data is not kept for longer than is necessary for the purposes described in this policy, subject to our legal, tax, and audit retention obligations described in Section 7.
Accountability and internal governance. We maintain internal policies and access controls governing who within our organization may access personal data, and we restrict that access to what is reasonably necessary for the relevant staff member's role.
Data Protection Officer / Compliance Contact. Questions, complaints, or requests relating to data protection specifically, as distinct from general support questions, may be directed to the contact details in Section 14 below, marked for the attention of our data protection compliance contact.
Regulatory registration. Where the NDPA or guidance from the Nigeria Data Protection Commission ("NDPC") requires us, as a data controller or data processor of a certain size or risk profile, to file a compliance audit return or register with the NDPC, we will do so in accordance with applicable deadlines.
Breach notification timelines. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the NDPC and, where required, affected individuals, within the timeframes prescribed by the NDPA (currently 72 hours of becoming aware of the breach, where feasible), in addition to the general commitment described in Section 13.
Processor obligations. Where we act as a data processor on behalf of an Organization (see Section 1), we process End Customer data strictly on that Organization's documented instructions, and we do not use it for our own independent purposes.

Nothing in this section limits the general rights and protections described elsewhere in this Privacy Policy; it supplements them with NDPA-specific detail.

15. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at:

SIMPLE INVOICELY LTD / SimpleInvoicely Email: privacy@simpleinvoicely.com Website: simpleinvoicely.com

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate the "Last Updated" date at the top of this page, and, for material changes, will provide additional notice (such as an email or in-app notification) where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.