Privacy Policy

InvoraAI is a back-office automation platform built for independent liquor stores, operated by InvoraAI (“we,” “us,” or “our”). You can reach us at michael@invoraai.com.

We use your data for exactly one purpose: running InvoraAI for your store.

Specifically:

• Processing your invoices through OCR to extract line items
• Generating reorder recommendations based on your sales and inventory
• Syncing bills to QuickBooks
• Showing you analytics about your store’s performance
• Sending AI-generated insights about what needs attention

We do not use your data to train AI models. We do not sell your data.

Running InvoraAI requires us to share certain data with the following services:

Each of these services is subject to data use restrictions under their applicable terms of service and privacy policies.

InvoraAI is a multi-tenant platform. Every piece of your data is tagged with your store ID at the database level. Row-Level Security policies on our database are designed to ensure that each store’s data is accessible only to that store’s authorized users. We implement these controls as a core part of our security architecture.

When you connect QuickBooks, we access your company’s chart of accounts and the ability to create and read bills. We request the minimum QuickBooks permissions required to sync your distributor invoices as bills. We do not access your bank accounts, payroll, customer records, or any data outside of bills and accounts. You can disconnect QuickBooks at any time from your Settings page, which immediately revokes our access.

You create employee accounts for your staff. As the store owner, you are responsible for informing your employees that their activity within the Employee Hub is logged — including stock counts, delivery captures, and checklist completions. This data is visible to you as the store owner. We do not share employee activity data with anyone outside your store account.

Employee names and information may appear in invoice documents you upload. This information is processed by our subprocessors (Mindee for OCR, Anthropic for AI analysis) solely for the purpose of extracting invoice data.

We use essential cookies to keep you logged in and maintain your session. We use Vercel Analytics for anonymous usage statistics. We do not use advertising cookies or cross-site tracking. You can disable cookies in your browser but the platform will not function without session cookies.

InvoraAI voluntarily provides the following rights to California residents as a matter of policy. Under the California Consumer Privacy Act (CCPA), California residents have the right to know what personal information we collect, request deletion of their personal information, and opt out of the sale of personal information. We do not sell personal information.

Categories of personal information we collect: identifiers (name, email, IP address); commercial information (invoice data, sales records, subscription status); employment-related information (employee names and activity logs); inferences drawn from the above to generate recommendations.

Categories of third parties with whom we share personal information: subprocessors listed in the table above, for the business purpose of providing the InvoraAI service.

To exercise your rights, contact michael@invoraai.com. We will use commercially reasonable efforts to respond within 30 days. In cases of complex requests, we may extend this period by an additional 30 days with notice.

We may disclose your data when required by law, court order, or regulatory subpoena, including requests from state alcohol control authorities, law enforcement agencies, or other government bodies with lawful authority. We will notify you of such requests unless prohibited by law or court order from doing so. We will provide only the minimum data required to comply with the legal obligation.

• Your data is retained for as long as your account is active
• If you cancel your subscription or your account is suspended for non-payment, your data is retained for 30 days, then permanently deleted from our active systems
• Deletion from backup systems occurs on our standard backup rotation cycle, which may extend up to 90 days after deletion from active systems
• Subprocessors (Anthropic, Mindee) process your data in real time and do not maintain long-term retention of your data under their current terms; we cannot guarantee deletion from their systems independent of our own deletion
• If there is an active billing dispute or legal hold at the time of your cancellation, data deletion may be delayed until the dispute is resolved
• You can request deletion by emailing michael@invoraai.com. We will use commercially reasonable efforts to respond within 30 days.
• Stripe retains billing records per their own retention policies regardless of account cancellation

You can:

• Request a copy of all data we hold about your store
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Disconnect QuickBooks or any integration at any time

To exercise any of these rights, email michael@invoraai.com. We will use commercially reasonable efforts to respond within 30 days. In cases of complex requests, we may extend this period by an additional 30 days with notice.

If we make material changes to how we handle your data — including changes to our subprocessors or their data use terms — we will email you at the address on your account at least 14 days before the change takes effect. Notice is deemed delivered 24 hours after the email is sent to the address on your account, provided we do not receive a delivery failure notification. You are responsible for maintaining a current email address in your account settings.