Privacy policy

01Who is responsible

This service is operated as Invoice Loft, and the address at the bottom of this page reaches the people who run it. Anything in this policy that you want explained, corrected or acted on starts there.

There is no support portal, no account to log into and no form standing between you and an answer.

02In short

The whole of this policy in five lines. Everything below is the same thing said carefully.

• There is no account, so we do not hold a name, an email address or a password for you.
• What you type into a document is stored so the document can be rendered and so you can come back to it.
• Your documents are tied to this browser by a random token in a cookie — not to you as a person.
• Documents are deleted 180 days after they are last touched, automatically.
• There is no advertising, no analytics and no profile of your behaviour being built anywhere.

03What is stored

Only what a document needs in order to exist. Nothing here is collected about you; it is content you wrote, kept so you can finish it, print it and find it again.

• The contents of the documents you make: both parties' names, addresses and tax numbers, your line items, amounts, notes, terms and payment details.
• Any logo or signature stamp you upload, stored as an image file under a random identifier.
• The random owner token that ties those documents to your browser.
• Ordinary server logs — an IP address, a timestamp, the URL requested — kept for a short period to keep the service running and to stop abuse.

04What is never asked for

The absence is the design. An email address we do not hold cannot leak, cannot be sold and cannot be handed to anyone who asks for it.

• No email address, no name, no phone number, no password.
• No payment details of any kind. Nothing here is paid for, so there is no card to store.
• No advertising or cross-site tracking, and no third-party analytics script.
• No access to your contacts, files or anything else on your device beyond the image you deliberately upload.

05Cookies and local storage

One cookie does real work here. It holds a random owner token, it is marked httpOnly so no script on the page can read it, and it is what lets you return to documents you made earlier. Without it a document you saved is unreachable — including by us.

Everything else kept in your browser is a preference and never leaves it: which colour scheme you chose, whether you have dismissed the announcement bar, whether you have seen the guided tour, and whether you asked us to stop offering the bookmark hint.

The live chat widget in the corner of the page is provided by Tawk.to and sets cookies of its own when it loads. It is the one third-party component on the site.

06How long anything is kept

A document is deleted 180 days after it was last saved. That is automatic and not something you have to ask for.

The owner-token cookie deliberately outlives that, so a returning visitor sees an empty list rather than silently becoming a new person with someone else's documents hidden behind them.

A PDF you have downloaded is yours and is not touched by any of this. If a document matters to you, download it — this is a generator, not an archive.

07Who else sees any of it

As few parties as it takes to serve a page. There is no data broker, no ad network and no marketing platform in this list, because there is no marketing list to fill.

Fonts are served from our own domain rather than fetched from a font provider, so loading a page does not announce your visit to a third party.

• Our hosting and infrastructure providers, which run the servers the site and the document service sit on.
• Tawk.to, if you use the live chat, which then handles what you type into that window under its own privacy policy.
• Anyone you send a PDF to, which is entirely your decision and outside this service.

08Your rights, and how to use them

You can delete any document from the documents list, immediately and permanently. That is the fastest route and it needs nobody's permission.

For anything else — a copy of what is held, a deletion you cannot perform yourself, a question about how something works — write to the address below. Because there is no account, we can only act on documents you can identify: send the document link or its number.

If you are in a jurisdiction that grants rights of access, correction, erasure, portability or objection, those rights apply and this is how to exercise them. If you believe we have handled something badly, tell us first — and you keep the right to complain to your local data protection authority regardless.

09Changes to this policy

The date at the top of this page is the real date it last changed, and it is set in the code alongside the page rather than typed into the text.

If a change ever meaningfully affects what is stored or who can see it, it will be said plainly here rather than folded into a paragraph. Continuing to use the service after a change means the current version applies.