Privacy Policy

1. Who we are and what this policy covers

Inbox Invoices ("Inbox Invoices", "we", "us") is a free web tool, available at inboxinvoices.com, that helps freelancers and small businesses find invoices and receipts in their email, organize them and prepare them for an accountant. The service is operated from Israel.

This Privacy Policy explains what information is processed when you visit the website or use the tool, why, on what legal basis, with whom it is shared and what rights you have. It applies to the website in every language (Hebrew, English and Russian). For questions about this policy, write to [email protected].

For the purposes of the EU and UK General Data Protection Regulation (GDPR) and the Israeli Protection of Privacy Law, 5741-1981, we are the controller of the limited website data described in section 4. We are not a controller of your mailbox content, because it is processed only on your own device and never reaches us.

2. How the tool works, in brief

When you choose to scan your mailbox, the following happens entirely between your browser and Google:

• You sign in with Google in a Google window and approve one permission: read-only access to Gmail (the gmail.readonly scope). We never see or store your Google password.
• Google gives your browser a temporary access token. It is kept only in the memory of that browser tab. It is never written to cookies, local storage or our servers, and it is revoked when you click Disconnect. It expires automatically after about an hour.
• Your browser asks the Gmail API for messages that look like invoices or receipts in the date range you choose, and reads their headers (sender, subject, date), a short snippet and attachment details (file name, type and size).
• The file itself (for example, a PDF invoice) is downloaded from Google only when you preview it or create a ZIP file, and only into your browser's memory.
• The results list, the ZIP file, the CSV summary and the accountant email draft are created on your device. Closing or refreshing the tab clears them.

Inbox Invoices has no backend server for the tool. We therefore cannot access, read, store, back up, restore or hand over your emails or documents, even if asked to.

3. Google user data and the Limited Use requirements

Inbox Invoices' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• What we access: Gmail message metadata (sender, recipients, subject, date), message snippets, attachment metadata and, at your request, attachment files and message bodies of the documents you choose to preview or download.
• How we use it: only to provide the feature you asked for: finding, listing, previewing and packaging your invoices and receipts. Nothing else.
• Where it is processed: only in your browser. Gmail data is not sent to our servers or to any other party.
• Storage: none. Gmail data is held in memory for the open tab and disappears when you close it.
• Sharing: we do not transfer Gmail data to third parties, except the files you yourself download or choose to send to your accountant.
• No advertising, no sale: Gmail data is never used for advertising, retargeting or interest-based ads, and is never sold.
• No human access: no person reads your Gmail data. We have no technical means to do so.
• No AI training: Gmail data is not used to develop, improve or train any artificial intelligence or machine learning models.

You can revoke the permission at any time: click Disconnect in the tool, or remove Inbox Invoices from your Google Account permissions page.

4. Information processed when you visit the website

Like most websites, the site processes a limited amount of technical information:

• Hosting and security data. Our hosting and network provider, Cloudflare, processes your IP address, browser type, requested pages and timestamps in order to deliver the site, prevent abuse and keep it secure.
• Usage analytics (Google Analytics 4). Pages visited, referring site, approximate location (country or city, derived from IP), device and browser type, and interactions such as scrolls and outbound clicks. Google Analytics 4 does not log or store IP addresses.
• Behaviour analytics (Microsoft Clarity), on public content pages only (home, guides, pricing and similar): mouse movements, clicks, scrolling and page structure, used for heatmaps and anonymized session replays. Clarity masks typed input by default, and it is switched off on the app screens (connect, scan, review, send and settings), so it never sees your mailbox data.
• Preferences. Your language choice is saved in your browser's local storage so the site opens in the right language next time.
• Messages you send us. If you email us, we receive your email address and the content of your message.

We do not ask you to create an account, and we do not collect your name, phone number or payment details.

5. Why we use the information and our legal bases

• To provide the tool you requested (Gmail access, scanning, ZIP creation): performance of our service at your request (GDPR art. 6(1)(b)), with the processing carried out on your device.
• To run, secure and debug the website: our legitimate interest in a working and safe service (art. 6(1)(f)).
• To measure and improve the website (Google Analytics, Microsoft Clarity): your consent where the law requires it, including in the European Economic Area, the UK and Switzerland, and our legitimate interest elsewhere.
• To show ads, once advertising is enabled: your consent where required, as described in section 7.
• To answer your messages and exercise your rights: legitimate interest and compliance with legal obligations (art. 6(1)(c)).

6. Who we share information with

We do not sell or rent personal information. We use the following service providers, each processing only what it needs for its role:

• Google LLC / Google Ireland Ltd.: Google sign-in and the Gmail API (between your browser and Google directly), Google Analytics and, in the future, Google AdSense. See the Google Privacy Policy and how Google uses information from sites that use its services.
• Microsoft Corporation: Microsoft Clarity behaviour analytics. See the Microsoft Privacy Statement.
• Cloudflare, Inc.: website hosting, content delivery, security and routing of emails sent to our @inboxinvoices.com addresses. See the Cloudflare Privacy Policy.
• Authorities: when we are legally required to, for example by a court order. Because we hold no mailbox data, we cannot provide it.

7. Advertising

Inbox Invoices is free because it is planned to be funded by advertising. Ads are not shown yet. When they are, they will be served by Google AdSense, and the following will apply:

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet.
• You can opt out of personalized advertising in Google Ads Settings, or opt out of some third-party vendors' cookies at aboutads.info.
• Visitors in the European Economic Area, the UK and Switzerland will be asked for consent before personalized ads or advertising cookies are used.
• Ads are never targeted using your emails, invoices or any Gmail data.

8. Cookies and similar technologies

We use cookies and local storage for the language preference, analytics and, in the future, advertising. The full list, the purpose of each and how to control them are in our Cookie Policy. By default, Google tags run in a privacy-preserving mode (Google Consent Mode) that does not store analytics or advertising cookies for visitors in the European Economic Area, the UK and Switzerland until consent is given.

9. How long we keep information

• Gmail data: not kept at all. It exists only in your open browser tab.
• Google Analytics: event data is kept for up to 14 months, then deleted automatically.
• Microsoft Clarity: session replays are kept for up to 30 days, aggregated heatmaps for up to 13 months.
• Cloudflare logs: short-term, according to Cloudflare's standard retention.
• Emails you send us: as long as needed to handle your request, and for up to 3 years afterwards for our records, unless you ask us to delete them sooner.

10. How we protect information

Privacy is built into the design: the tool has no server that holds your mail, it asks for the narrowest Gmail permission that does the job, and the token is never persisted. In addition, the whole site is served only over encrypted HTTPS, uses security headers that block framing and content sniffing, and loads Clarity only where no personal mailbox data is shown.

No system is perfectly secure. Keep your Google account protected with a strong password and two-step verification, and use the tool on a device you trust.

11. International transfers

Google, Microsoft and Cloudflare may process website data in the United States and other countries. Where personal data from the European Economic Area, the UK or Switzerland is transferred, these providers rely on recognized safeguards such as the EU-U.S. Data Privacy Framework and the European Commission's Standard Contractual Clauses. Israel is recognized by the European Commission as providing an adequate level of data protection.

12. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it;
• correct inaccurate information;
• ask us to delete information, or to restrict or object to its processing;
• receive your information in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• lodge a complaint with your data protection authority, such as the Privacy Protection Authority in Israel or your local supervisory authority in the EU or UK.

To exercise a right, write to [email protected]. We will answer within 30 days. Analytics data is pseudonymous, so to find it we may need identifiers from your browser. Since we keep no mailbox data, a request about your emails is fully met by disconnecting the tool and revoking access in your Google account.

California residents: we do not sell or share personal information as those terms are defined in the California Consumer Privacy Act.

13. Children

The service is intended for businesses and adults. It is not directed to children under 16, and we do not knowingly collect information from them. If you believe a child has used the service, contact us and we will delete any related information.

14. Changes to this policy

We may update this policy when the service or the law changes. The "last updated" date at the top shows the latest version. If a change materially affects how we handle Google user data, we will display a notice on the website, and where required we will ask for your consent again.

15. Contact us

Privacy questions and requests: [email protected]. Other legal matters: [email protected]. See also our Terms of Use, Cookie Policy and Accessibility Statement.