Who is responsible for InvoQuill
In this policy, “InvoQuill”, “we”, “us” and “our” refer to InvoQuill, the trading identity of the UK sole-trader publisher of the InvoQuill app.
- App operator / data controllerInvoQuill
- Privacy contactprivacy@invoquill.com
- Postal correspondence addressInvoQuill
124 City Road
London
EC1V 2NX
United Kingdom
You can contact us by email or write to the postal correspondence address above.
The short version
InvoQuill stores your business records on your device. You do not need an InvoQuill account, and we do not run our own server that receives or stores those records.
If you use iCloud, Apple can also store and synchronise supported records in the private CloudKit database for your Apple Account. A conversation you record is the exception: the written words and the note synchronise, and the sound itself does not — it stays on your own device and never reaches iCloud. Optional features send information only to the Apple service, connected service, payment provider, app or person you choose.
InvoQuill does not sell personal data, show third-party advertising or track you across other companies’ apps and websites. The current app does not include advertising or behavioural analytics tools.
Information the app processes
The exact information depends on the features you choose to use.
Business and contact information
This can include business and owner names, trading details, addresses, telephone numbers, email addresses, logos, registration details, tax identifiers, customer and supplier information, notes, groups, payment defaults, catalogue items, descriptions, barcodes and images.
InvoQuill does not upload your address book to an InvoQuill server. If you use contact import, Apple’s system contact picker provides only the details you deliberately select to bring into your workspace.
Documents, work, money and tax records
This can include quotations, estimates, invoices, credit notes, orders, delivery or work records, document numbers, line items, notes, terms, totals, currencies, tax settings and saved copies of issued documents that cannot be edited. It can also include jobs, appointments, work stages, where the work is, expenses, receipts, imported bank transactions, matching decisions, payment records, mileage, reports, export preferences, templates, reminders and workflow settings.
Photos, scans and attached files
When you choose these features, the app can process business logos, catalogue images, receipt scans, quotation or statement files and job photos. A job photo can include its original capture date and location details when they are available from the chosen image or an authorised location reading. The app may prepare a smaller copy for storage and reports.
Apple’s picker controls which library items you make available. Camera and photo permissions can be declined, although features that require an image will then be unavailable.
Conversations you record
This feature is called “What was said” in the app. It is optional, it does nothing until you start it, and it can be replaced entirely by typing what was said.
When you start a recording, the app listens through the microphone and writes down what is spoken as it is spoken, using Apple’s on-device speech recognition. When you stop, Apple’s on-device model writes the conversation up into a note, on a device that supports Apple Intelligence and has it switched on; where it does not, the words are still written down and you write the note yourself. Both steps happen on the device itself. Neither the sound nor the words are sent to InvoQuill, and there is no InvoQuill server to send them to.
The written record can include every word that was heard, any stretch where listening stopped and for how long, the note the app produced, your own edits to it, whether the words were heard or typed, and the job the conversation belongs to. That written record is ordinary workspace information and is stored and synchronised like the rest of your records. If you type the conversation instead — which is how the app works on a phone that cannot write down speech — no sound is captured at all.
The sound itself is handled differently from everything else in the app:
- it is kept as a file on the device that recorded it, in a folder a connected computer cannot browse;
- it is never written to your private iCloud database and never reaches your other devices. Only its file name and the date it expires are stored in the synchronised record;
- it is excluded from your iPhone or iPad backup, and it is not part of a backup the app creates;
- it is held under iOS file protection, so it cannot be read until the device has been unlocked once since it started up; and
- it stops playing the moment the time you chose runs out, and the file itself is removed the next time the app starts — or straight away if you delete the conversation.
You choose how long recordings are kept, from a week to for good, and the choice applies to recordings you have already made. When a recording’s time is up it deletes itself, and the written words and the note stay. The full rules are under Backups, retention and deletion.
If you start a recording on your Apple Watch, the watch asks for its own microphone permission, keeps the sound on the watch, and sends it to your paired iPhone over Apple’s own Watch link. Nothing is written down on the watch; your iPhone does that the next time you open the app. The watch holds its copy until the phone confirms the recording has arrived.
Nothing from a conversation appears on a report your customer reads until you have read it and approved it. You choose what such a report may carry — the note alone, the note with the figures, or every word that was said — and a new business starts with the note alone. Sharing a conversation shares the words you chose to share; the recording itself is never handed over.
Precise location, route points and motion signals
Location use is optional and feature-specific. Depending on your choices, the app can process a one-time fix for job check-in, check-out or a new photo; trip start and finish coordinates and labels; a bounded, filtered set of route coordinates for a trip you start; location or Motion & Fitness signals used on the device by Smart Mileage; and, if you switch on arrival alerts, a watched area around the places you have work booked at.
Saved mileage path points omit a per-point timestamp, speed, altitude, course and accuracy. A mileage record can still contain trip-level times, distance, duration, start and finish coordinates and the filtered path.
A manually started trip can continue while the app is in the background or the phone is locked. Smart Mileage, when enabled, can watch a 200-metre area around a job you have checked in to, begin recording only after departure and driving are detected, and stop watching shortly after the work finishes. iOS controls whether background execution, location and motion remain available. Low power, permission changes, force quitting, signal loss or system limits can interrupt capture. Review every saved mileage record before relying on it.
Arrival alerts are off until you switch them on. When they are on, the app asks iOS to watch a small area around the places you have work booked at, in the background, so that it can offer to check you in when you pull up. It waits four minutes before saying anything, so driving past or dropping a key through a door does not set it off; it never watches the address you work from; and where it cannot tell one address from the one next to it, the alert names the street rather than a particular door. So that it can tell a stop from driving past, the app notes on the device when you arrived at a watched address; that note is dropped when you leave and is never synchronised. Nothing reaches your work records unless you choose an action on the alert, and if you do, the app records the time you arrived rather than the time you tapped. If iOS withdraws the background location access the feature needs, the app switches the feature off and tells you why.
You can turn Smart Mileage off and change Location or Motion & Fitness access in iOS Settings. Hiding coordinates in a generated report changes only that report; it does not delete already saved location evidence.
Subscription and device information
Apple handles purchases. InvoQuill receives only the information needed to show and verify your subscription, such as the product, subscription status, purchase and expiry dates, transaction reference and whether Apple has revoked access. InvoQuill does not receive your payment-card details.
The app also keeps your preferences, app version and build, security settings, backup settings and limited iCloud sync status on the device. The device Keychain stores the minimum subscription information needed for offline checks and a secure verifier for the InvoQuill passcode. The passcode itself is not stored.
How information is used
Information is processed to provide the actions you request, including:
- creating, issuing, displaying, searching and exporting business records;
- calculating totals, tax, reports, payment status and mileage;
- writing down a conversation you record and preparing its note, on the device;
- synchronising your workspace through your private iCloud database;
- producing PDFs, reports, backups, payment links, calendar events, reminders, widgets, Watch views and Siri or Shortcuts results;
- protecting the workspace with App Lock and hiding details from widgets, notifications and other quick views while it is active; and
- diagnosing iCloud or app behaviour on your device when you choose to view or export diagnostic information.
Where UK data-protection law applies to information that we actually receive, we rely on performance of a contract or steps requested before a contract, our legitimate interests in operating and securing InvoQuill and responding to support, compliance with legal obligations, and consent where the law requires it. Most workspace information stays on your device or in your private iCloud database and is not received by us.
Where information goes
On your device
Your working records are stored on the device using Apple’s standard storage and remain useful offline. Preferences and security information are also kept using Apple’s protected device storage where appropriate.
Your private iCloud database
When iCloud sync is available for the Apple Account on the device, Apple’s CloudKit service can keep a matching copy in that account’s private database and sync it to the owner’s devices. InvoQuill does not use a public CloudKit database or share one workspace between different users. The app operator does not receive a copy through an InvoQuill server. A conversation recording is deliberately left out of that copy: the sound is never written to CloudKit, and only its file name and the date it expires travel with the record.
Apple processes iCloud data under Apple’s terms and privacy policy. An iCloud account change is kept separate so records from two accounts are not silently merged.
Apple and user-directed system features
Information can leave your working records when you choose a feature that needs another service, app or recipient:
- StoreKit and the App Store: purchase, trial, subscription access, cancellation and refund handling;
- Mail and sharing: document content, messages, PDFs, links or files you choose to send;
- Files and backups: reports, imports and backup archives you save, share, import or delete. An optional passphrase encrypts an InvoQuill backup using AES-GCM before it is written;
- Calendar: a one-way copy of selected job information after you enable export and grant access. Separately, if you switch on the day’s schedule and grant calendar access, the app reads today’s events from the calendars on your device, to show your day in the app and to count them on your morning reminder. Reading changes nothing in your own calendars, and entries InvoQuill itself created are left out;
- Maps and location services: maps, address labels, location fixes and route presentation supplied through Apple frameworks;
- Siri, Shortcuts, Spotlight and notifications: the information needed to carry out the action you choose; and
- Widget and Apple Watch: a limited snapshot that shows useful information on your devices, and, if you record a conversation on your watch, the sound file the watch sends to your paired iPhone over Apple’s own Watch link, as described above. App Lock removes business details from these quick views, on the phone and on the wrist.
Apple Intelligence features in InvoQuill use Apple’s on-device model, and InvoQuill does not send those requests to an InvoQuill server. A suggested description or expense category changes nothing until you accept it. A conversation you record works differently: the app writes the note up on its own as soon as you stop recording, and keeps it with the record. The note is yours to edit, and nothing from it reaches a report your customer reads until you have read it and approved it.
Siri and InvoQuill shortcuts can record facts that are yours alone — a cost, the time you started, the time you finished, a trip you have driven — and can prepare or open work for you to check. Asking Siri for an invoice opens the draft on screen; it does not become a document until you say so. They do not issue or send a document, take money, or begin location recording. Nothing Siri does runs on a locked phone: Face ID or your passcode comes first, every time. A saved shortcut never carries a customer’s name in its title, and if App Lock is on, open and unlock InvoQuill before business details can be shown.
Payment links and other destinations
If you add and use a payment link, opening or sharing it sends the URL and any information encoded in it to the provider or website. Depending on the link type, that can include an amount, currency, document number or reference. The provider processes its copy under its own terms and privacy policy. InvoQuill does not receive the customer’s card details, confirm settlement or automatically mark the document as paid.
If you deliberately export or share information to any other app or service, that recipient becomes responsible for its copy. Review its privacy terms before sharing customer, financial, tax, photo or location information.
Backups, retention and deletion
Workspace data normally remains until you edit or delete it. Some issued documents, numbering, payment and history records are deliberately kept to protect your accounting trail. Deleting an entire business removes that business and its related records from the device. If private iCloud sync is active, the deletion is sent to CloudKit and reaches your other devices when they sync.
A conversation recording keeps its own clock. You choose how long recordings are kept — a week, two weeks, three weeks, a month, two months, three months, a year, or for good — and three weeks is the starting point. The setting applies to every recording you already have, measured from the day each one was made, so shortening it brings older recordings forward and choosing “for good” keeps yesterday’s. When a recording’s time is up it can no longer be played, and the file is removed the next time the app starts. The written words and the note are not removed with it: you lose the sound, not the record. Deleting a conversation deletes its recording there and then.
Deleting the app removes its local container but does not necessarily delete a private CloudKit copy or files you previously exported. To remove a synced workspace, use the in-app deletion controls and allow devices to synchronise before uninstalling.
Backups and exported files are separate copies. Deleting a working record does not delete a backup, sent PDF, Files export, Calendar event or recipient copy. Delete those copies wherever you saved or shared them when they are no longer needed. Automatic local backups keep the number of versions you select in the app; manually shared copies follow the rules of the service or person that received them. Losing an encryption passphrase makes an encrypted backup unrecoverable, including by InvoQuill support.
Apple can retain iCloud, App Store, device-backup and diagnostic information under Apple’s own policies and legal obligations.
Diagnostics, analytics and website data
The app does not send customer, document, tax, payment, photo, recording, transcript or location data to an InvoQuill analytics service. Its iCloud diagnostic log records technical sync details rather than business content, and it leaves the device only when you choose to export it. Apple may provide App Store or operating-system crash and diagnostic information according to your Apple settings and Apple’s policies.
This website is a static information and support site hosted through OpenAI Sites. It contains no advertising, behavioural analytics, forms, third-party fonts or marketing cookies. The hosting service can process ordinary technical request information, such as an IP address, browser headers and requested page, to deliver and secure the site under its own terms and retention practices.
If you email support or privacy, we receive the address, message, attachments and other information you choose to include. Do not send passwords, backup passphrases, full payment-card data or unnecessary customer records.
We retain a support or privacy message while it is needed to answer the request, maintain an appropriate support record, resolve a dispute or meet a legal obligation, then delete it when it is no longer reasonably required. You can ask for earlier deletion unless we need to retain it for a lawful reason.
Security
InvoQuill uses Apple platform protections and supports an optional independent app passcode. Optional encrypted backups use a passphrase-derived key and AES-GCM. No method of storage or transmission is completely secure, and an app passcode is not a substitute for the device passcode, Apple Data Protection or appropriate business security practices.
Every PDF the app produces is encrypted and sealed before it leaves your phone. Your customer needs no password to open it, and can read it, print it and use it with a screen reader, but cannot edit it, copy the text out of it, add notes to it, or insert, rotate or remove a page. Nobody holds a password that would undo that, including us. Software that chooses to ignore those settings can still import the page, and anything visible can be photographed or retyped, so treat it as a deterrent rather than a guarantee.
You are responsible for keeping devices, Apple Accounts, exported files, payment links and backup passphrases secure and for limiting access to records about customers, workers or other people.
Your choices and rights
You can:
- decline optional Camera, Photos, Microphone, Speech Recognition, Location, Motion & Fitness, Calendar and notification permissions on your iPhone or iPad, and the microphone permission on your Apple Watch;
- turn Smart Mileage, arrival alerts, the day’s schedule and Calendar export off;
- choose how long a conversation recording is kept, delete one whenever you like, or type what was said instead of recording it;
- control iCloud availability through your Apple Account and device settings, and choose whether to use Siri, Shortcuts, widgets, Watch, payment links, sharing and backups;
- export records and reports in the formats offered by the app; and
- edit or delete records using the app’s controls, subject to deliberate accounting-history safeguards described above.
Depending on where you live, you may also have legal rights to access, correct, erase, restrict, object to or receive a portable copy of personal data, and to complain to a regulator. Because your working records are on your device or in your private iCloud account, the app operator generally does not hold a server copy to search or export for you. Contact privacy@invoquill.com for a privacy request involving information the operator does hold, such as a support email.
Send a request to privacy@invoquill.com. We may ask for information reasonably needed to confirm that the request concerns you, and we will respond within the period required by applicable law. UK users can also complain to the Information Commissioner’s Office.
Changes to this policy
Material changes will be published at invoquill.com/privacy with a new “Last updated” date. Where applicable law requires another form of notice, we will provide it.
Contact
- Privacy questionsprivacy@invoquill.com
- General supportsupport@invoquill.com
- Postal correspondence addressInvoQuill
124 City Road
London
EC1V 2NX
United Kingdom - Support pageinvoquill.com/support
- Terms of Useinvoquill.com/terms