Privacy Policy
What data involy collects, why we collect it, who we share it with, and the rights you have over it.
In plain English: involy collects the minimum data needed to run the service. We do not sell your information, we do not share it with advertisers, and you can request an export or deletion at any time. Read on for the full picture.
Information we collect
We collect information in three ways: what you give us directly, what is generated as you use the service, and what flows in through third-party integrations you connect.
Account information
When you sign up, we collect your name, email address, and the credentials you choose: a securely hashed password (we never store your password in plain text), two-factor authenticator settings, and any passkeys you add (we store only their public keys). We also keep hashed one-time recovery codes.
Business and client information
As you use involy, you enter information about your business and your clients: client names, billing addresses, contact details, invoice line items, amounts, notes, and proposal content. This data belongs to you — we hold it on your behalf to operate the service.
Financial and transaction data
involy records the payment amounts, dates, and statuses associated with invoices you send. When you connect online payments through Stripe, we receive confirmation events from Stripe (such as "payment succeeded") and store them alongside your invoices. We do not store your clients' card numbers or bank account numbers — see the Payment data & Stripe section. The one full account number involy keeps is the business's own, if you choose to print your ACH payment details on your invoices; only owners can see or change it.
Bank connections
If you connect a bank account, involy receives that account's posted transactions (date, amount, description, merchant), the account's name, type and last four digits, and your bank's name. We use them only to match transactions to your books. See the Bank connections & Plaid section.
Usage and device data
When you access involy, our hosting provider's servers automatically log standard request data: your IP address, browser type and version, operating system, referring URL, pages visited, and timestamps. We use this to operate the service reliably and to understand aggregate usage patterns.
How we use information
We use the information we collect to:
- Provide and improve the service — creating invoices and proposals, processing payments, generating your AI-powered financial summaries, and making the product better over time.
- Send transactional communications — invoice notifications, payment confirmations, account security alerts, and your AI accountant weekly summary. These are necessary to operate the service and cannot be opted out of while you have an active account.
- Provide customer support — responding to questions and resolving issues you report.
- Maintain security and prevent fraud — detecting abuse, enforcing our Terms of Service, and protecting your account.
- Comply with legal obligations — retaining records as required by applicable law, responding to valid legal requests.
We do not use your data for advertising targeting, sale to data brokers, or any purpose not listed above.
The AI accountant & your data
involy's AI features (the "Ask involy" assistant and the weekly AI accountant summary) are powered by Anthropic Claude, as are receipt and document auto-fill and the short insights on your dashboard. When you use these features, the data needed for the task is sent to Anthropic's API: for example invoice and expense records (including client and vendor names, amounts and dates), and the receipt or document file you upload for auto-fill.
Important: involy's integration with Anthropic is used under Anthropic's commercial API terms, under which your data is not used to train Anthropic's models. The assistant reads your data only through read-only tools limited to your own organization, and the content you provide is handled as data, kept separate from our instructions. Data sent to Anthropic is subject to Anthropic's Privacy Policy.
The AI provides informational responses based on the data you have entered. It is not a licensed accountant. See the "Not financial advice" section of our Terms of Service for the full disclaimer.
Payment data & Stripe
Online payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. When a client pays an invoice online, their card or bank details are entered directly into Stripe's secure checkout — involy never sees, transmits, or stores full card numbers, CVV codes, or bank account numbers.
involy receives from Stripe only the confirmation data needed to record a payment (amount, date, and status, plus at most the last four digits of a card for display). Your Stripe connection is governed by Stripe's Privacy Policy.
Bank connections & Plaid
Live bank connections run through Plaid Inc. You sign in to your bank inside Plaid's own window: involy never sees or stores your bank username, password or security answers. involy asks Plaid for transactions only. It never requests your routing number, full account number, or the account holder's personal details.
The access token Plaid gives involy is encrypted before it is stored and never leaves our servers. Only an owner, admin or accountant on your workspace who signs in with a passkey or two-factor code can connect a bank. When you disconnect a bank, involy revokes its access with Plaid and deletes the token; the transactions already imported stay in your books. Plaid handles your data under the Plaid End User Privacy Policy.
Sub-processors we use
involy relies on the following third-party services ("sub-processors") to deliver the product. Each receives only the data necessary for their specific function.
| Vendor | Purpose | Data involved |
|---|---|---|
| Stripe | Online payment processing | Client billing details; payment events. Full card data stays within Stripe only. |
| Supabase | PostgreSQL database hosting | All application data at rest (accounts, invoices, expenses, clients) and the files you upload. |
| Vercel | Application hosting & edge delivery | Request logs, session tokens in transit, server-rendered page output. |
| Resend | Transactional email | Recipient email address, invoice/proposal content included in outbound emails. |
| Anthropic | AI features | The records an AI request needs (for example invoice and expense rows with client and vendor names) and files you send for auto-fill. Not used for model training. |
| Plaid | Bank connections | Your bank sign-in (entered in Plaid's window, never seen by involy) and the connected accounts' transactions. |
| Twilio | Text message alerts | The phone number you add and the alert text, such as a payment received notice. |
| Address autocomplete (Google Maps Platform) | The address text you type into a client address field. |
We periodically review our sub-processors and will update this table when we add or remove vendors.
Cookies
involy uses a small number of cookies and similar storage mechanisms, primarily to keep you signed in. We do not use advertising cookies or cross-site tracking. For full details, see our Cookie Policy.
How we share information
We do not sell your personal information. We do not share your data with advertisers, data brokers, or any third party for their own marketing purposes.
We share data only in these limited circumstances:
- With sub-processors — as described in the table above, strictly for operating the service.
- With your explicit instruction — for example, when you share an invoice link with a client.
- For legal compliance — if we receive a valid subpoena, court order, or other binding legal process, we will comply and will attempt to notify you unless prohibited by law.
- In a business transfer — if ThinkOpen Inc. is acquired or merges with another entity, your data may transfer as part of that transaction. We will provide notice before your data becomes subject to a materially different privacy policy.
Data retention
We retain your data for as long as your account is active. If you cancel your account, we will delete your personal data within a reasonable period (typically 90 days), except where we are required by law to retain records longer. Financial records (invoices, payment history) may be retained for up to seven years to satisfy applicable tax and accounting regulations — you may request an export before deletion.
You can request deletion of your account and associated data at any time by contacting info@thinkopen.net.
Security
We use industry-standard safeguards: 256-bit AES encryption for data at rest and TLS 1.2 or higher for all data in transit. Access to production systems is restricted to authorized personnel under a least-privilege policy. For the full picture, see our Security page.
No system is perfectly secure. If you discover a potential vulnerability, please report it responsibly to info@thinkopen.net.
Your privacy rights
Regardless of where you are located, you can request at any time:
- Access — a copy of the personal data we hold about you.
- Correction — an update to inaccurate or incomplete data.
- Deletion — removal of your account and personal data (subject to legal retention requirements).
- Export — a machine-readable copy of your business data (invoices, clients, expenses).
- Objection or restriction — to specific processing activities where applicable law provides this right.
California residents (CCPA / CPRA)
If you are a California resident, you have the right to know what categories of personal information we collect, the right to delete your personal information, the right to opt out of the sale or sharing of personal information (we do not sell or share it), and the right to non-discrimination for exercising your privacy rights. To submit a verifiable consumer request, contact info@thinkopen.net.
EEA / UK residents (GDPR good-faith note)
involy is operated from the United States and is not yet formally certified under a specific EU adequacy mechanism. If you are located in the European Economic Area or the United Kingdom, you use the service with the understanding that your data is processed in the US. We take your GDPR rights seriously and will respond to access, rectification, erasure, and portability requests promptly. Our lawful basis for processing is primarily contract performance (operating the service you signed up for) and, where applicable, legitimate interests.
Children
involy is not directed at, and we do not knowingly collect personal information from, individuals under 18 years of age. If you believe a minor has provided us with personal information, please contact us at info@thinkopen.net and we will delete it promptly.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy here and update the effective date at the top. For significant changes that affect how we use your data, we will also send a notice to the email address on your account at least 14 days before the change takes effect.
Your continued use of involy after a policy update constitutes acceptance of the revised terms. If you do not agree, you may cancel your account before the effective date.
Contact us
Questions about this document or your data? We read every message.
involy / ThinkOpen Inc.
5420 McConnell Ave, Los Angeles, CA 90066
Privacy, legal and security: info@thinkopen.net
Phone: 424.437.8173
This document is provided for transparency and is not legal advice. involy is in early access; we will post material changes here and, where required, notify you directly.