Privacy Policy

Effective and last updated: July 12, 2026

Caravaca Labs, LLC operates Invoice Generator and is responsible for the information handled through this service. This policy distinguishes anonymous browser use from optional account and sharing features.

Anonymous use and PDF generation

• Draft editing occurs in your browser and does not require an account.
• Local History and saved template data are stored in your browser. You can remove them using the erase controls on the History page.
• When you request a PDF, document data is sent to the application server to render the file. The rendering endpoint returns the PDF and does not intentionally persist that payload.
• Calculator inputs are processed in your browser and are not submitted as calculation records.

Account and cloud data

If you create an account or sign in, the service may store your name, email address, password hash or authentication-provider identifiers, session data, organization settings, customers, documents, templates, API key hashes, and API usage. This data is used to authenticate you and provide syncing, customer management, sending, sharing, and API features that you choose to use.

Passwords are stored as one-way hashes, not readable plain text. API keys are also stored as hashes. If an external sign-in provider is enabled and you choose it, that provider processes authentication under its own privacy terms.

Public links and email sending

When you send a document, the service stores the document and creates a hard-to-guess public link for the recipient. Anyone with a valid, unexpired link may be able to view its contents. Do not share the link beyond intended recipients. Recipient email addresses, the message, delivery status, and link metadata may be processed to provide the sending feature.

Analytics and cookies

The production service uses Google Analytics and Umami to understand page use and improve reliability. Analytics can receive technical and usage information such as page URL, browser and device details, approximate location derived from network information, referrer, and interaction events. Invoice field contents are not intentionally sent as analytics event properties.

Authentication, language, theme, and analytics preferences may use cookies or browser storage. You can disable optional analytics for this browser below.

Service providers and disclosures

The service relies on hosting, database, authentication, analytics, and email-delivery providers that process data to perform those services. Information may also be disclosed when required by law, to protect users or the service, or as part of a business transfer subject to appropriate safeguards. We do not sell invoice contents or customer lists.

Retention and deletion

Browser-only data remains until you erase it or clear site storage. Cloud records remain while needed to provide the account features, meet legal obligations, resolve disputes, and protect the service. Public links may have an expiration date but linked records can remain in the account until deleted. To request access, correction, or deletion, follow the privacy instructions on the contact page.

Security

We use technical and organizational safeguards intended to protect account and document data, including encrypted transport, hashed credentials, access controls, and non-indexed public document routes. No internet service can guarantee absolute security. Protect your login and public links, and avoid entering information that is not necessary for the document.

Children and international use

The service is intended for business users and is not directed to children. Data may be processed in countries other than your own, subject to the safeguards used by Caravaca Labs and its service providers.

Changes and questions

Material changes will be reflected by a new effective date on this page. For privacy questions or requests, use the contact page and do not place personal or confidential information in a public issue.