Privacy Policy

1. Who we are

Recurring Invoices (“Recurring Invoices”, “we”, “us”) is an online service for creating, sending and tracking invoices, recurring invoices and payments. It is operated by MagisSolutions, Inc., D1 Unit GS4-02V, 2F Gems Plaza Bldg., Circumferential Road, Dalig, City of Antipolo, Rizal, Philippines. For any question about this policy or your data, contact us at [email protected].

This policy explains what personal data we collect, why, who we share it with and the choices you have. It applies to our website, our web application, our API and our MCP server used by AI assistants such as Claude and ChatGPT (together, the “Service”).

2. Our role: controller and processor

For your own account data (your name, email, login history and so on), we are the controller.

For the business data you put into the Service about your clients — their names, contacts, email addresses, postal addresses, invoices and payments — you (or your team) are the controller and we act as your processor, handling that data only to provide the Service to you, under the data processing terms in our Terms of Service.

3. Data we collect

Account and team data

• Your name, email address, password (stored only as a one-way hash), optional profile photo and timezone.
• Email verification status and, if you enable it, two-factor authentication secrets and recovery codes (stored encrypted).
• Teams you create or join: team name, web address (slug), logo, default currency, invoice templates and default notes, and which members belong to the team.
• Optional white-label settings: a custom domain for your client-facing pages, and your own outgoing email settings (SMTP or email-provider host, username, sender name and address). Mail passwords and API secrets are stored encrypted.

Business data you enter

• Clients and their contacts: names, contact names, email addresses and postal addresses.
• Invoices and recurring invoices: invoice numbers, dates, due dates, sender and recipient details, line items, amounts, tax, discounts, currency, notes, status and schedule (for recurring invoices).
• Payments: amount, date, payment method, reference, notes, and any proof-of-payment files uploaded by you or by your client.
• Invoices imported from other systems (for example a FreshBooks export) through our import tools.

Data about your clients' interactions

When you send an invoice, your client receives an email with a private, signed link. We record when the invoice is viewed, when a PDF is exported and when the client records a payment, so that you can see an invoice's history. Clients who sign in can see the invoices sent to their email address.

Usage, security and technical data

• Authentication log: each sign-in and sign-out, with IP address, browser user agent, device information and whether the attempt succeeded, used to protect your account and detect suspicious activity.
• Sessions: IP address, user agent and last activity time for each active session.
• Activity and audit history: a record of changes made to records in the Service (who changed what and when), including previous versions of edited records, so changes can be reviewed and restored.
• Usage statistics: aggregated counts of which pages and endpoints are requested, with the user, team, IP address, response status and date.
• Email log: a copy of emails we send on your behalf or to you (sender, recipients, subject, body, attachments and delivery status), so we can show delivery problems and resolve disputes.
• Diagnostics: error reports and short-lived debugging data (automatically deleted after about 48 hours), which may include request details and the identity of the signed-in user.
• API and AI-connector tokens: a hashed copy of each token, which team it belongs to, who created it and when it was last used.

Cookies

We use cookies that are strictly necessary for the Service to work: a session cookie, a security (CSRF) cookie and cookies that remember interface preferences such as light/dark appearance and whether the sidebar is open. We also remember your cookie choice in your browser's local storage. These do not need your consent.

We use Google Analytics to measure visits to the Service, but only with your consent. The first time you visit, a banner lets you accept or reject analytics cookies, and nothing is stored by Google Analytics unless you click “Accept”. Until then (and if you reject), Google Analytics runs in Google's Consent Mode with analytics and advertising storage denied: it sets no cookies and may only receive basic, cookieless signals about the page view (such as your IP address, browser and the page visited). We never use Google Analytics for advertising. You can change or withdraw your choice at any time using the “Cookie settings” link at the bottom of our public pages; withdrawing consent deletes the Google Analytics cookies from your browser.

4. How we use your data

• To provide the Service: store your invoices, generate recurring invoices on schedule, send invoice emails and track payments.
• To authenticate you, keep your account secure and prevent spam and abuse.
• To provide support and send you service messages (for example email verification and password resets).
• To monitor, debug and improve the reliability and performance of the Service.
• To comply with legal obligations, such as tax and accounting record-keeping.

Legal bases (where GDPR or similar laws apply): performance of our contract with you; our legitimate interests in securing and improving the Service; compliance with legal obligations; and your consent where we ask for it (for example analytics cookies).

5. Service providers we share data with

We share data only with providers who help us run the Service, under contracts that require them to protect it. Depending on our configuration at any given time, these are:

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition.

6. AI connectors (Claude and ChatGPT)

You can optionally connect an AI assistant such as Claude (claude.ai, Claude Desktop or Claude Code) or ChatGPT to Recurring Invoices through our MCP (Model Context Protocol) server. See How to connect Claude and ChatGPT for setup instructions.

What the assistant can access

• Only the one team you authorised. Each connection is tied to a single team that you choose when you sign in (or that the access token was created for). The connection is not granted access to your other teams or to any other customer's data.
• Within that team, the assistant can read and change clients, invoices, recurring invoices and payments — the same actions listed on the help page — and only while you remain a member of that team.

What happens to that data

Data the assistant retrieves from Recurring Invoices is sent to the AI provider you connected (Anthropic or OpenAI) so it can answer you. From that point, the provider handles it under its own terms and privacy policy and your settings with that provider. We do not control how long the provider retains your conversations. We record the tool calls the assistant makes in the same activity, audit and usage logs described above.

We do not receive the content of your conversations with the assistant beyond the tool requests it sends us.

Revoking access

• In Recurring Invoices: go to Team settings → AI agents and revoke the token. The assistant immediately loses access to that team.
• In Claude: Settings → Connectors → select Recurring Invoices → Disconnect (or remove the connector).
• In ChatGPT: Settings → Apps (or Plugins) → select Recurring Invoices → Disconnect or delete.
• Removing a user from a team also immediately stops any of their connections from reaching that team.

7. International transfers

Our servers are located in Singapore. The service providers listed above may process data in other countries, including the United States. We remain responsible for personal data we transfer to them.

8. How long we keep data

• Account and business data: for as long as your account or team exists. Deleted invoices and clients (with their contacts, payments, attachments and recurring invoices) are kept in a soft-deleted or archived state for 365 days before permanent deletion. A deleted client is kept for as long as an invoice still refers to it.
• Debugging data: about 48 hours.
• Email logs: pruned automatically after 365 days. Health checks: after 5 days. Scheduler logs: after 30 days.
• Authentication and activity logs: deleted after 365 days.
• Backups: 365 days.
• We may keep some records longer where the law requires it (for example tax records).

9. Security

We use technical and organisational measures appropriate to the risk, such as encryption in transit (HTTPS), hashed passwords and tokens, encrypted storage for mail credentials and two-factor secrets, role-based access to teams, rate limiting and bot protection. No system is perfectly secure; if a breach affects your data we will notify you where required by law.

10. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can update most account information yourself in your settings and delete your account or team from the settings pages. For anything else, email [email protected]. You may also complain to the National Privacy Commission of the Philippines or your local data protection authority.

If you are a client of one of our users and want to exercise your rights over invoices sent to you, please contact the business that invoiced you; we will assist them as their processor.

11. Children

The Service is intended for businesses and is not directed to anyone under 16. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new “Last updated” date and notify account holders where required by law.

13. Contact

MagisSolutions, Inc.
D1 Unit GS4-02V, 2F Gems Plaza Bldg., Circumferential Road, Dalig, City of Antipolo, Rizal, Philippines
Data Protection Officer: [email protected]