Privacy Policy

WorkInvoice is an online invoicing tool for freelancers and small businesses in Singapore. For the purposes of the PDPA, the organisation responsible for your personal data is Sakthiish s/o Vijayadass, based in Singapore.

You can reach our data protection contact at privacy@workinvoice.app.

We collect only what the service needs to work.

When you sign up. Your email address. We use a sign-in link rather than passwords, so we never hold a password for your account.

When you set up your business profile. Your name or business name, business email, business address, phone number, UEN and GST registration number if you have them, your PayNow proxy (mobile number or UEN), and your bank account details if you choose to show them on invoices. These appear on the invoices you issue, which is why we hold them.

When you use the product.The clients you add (their name, email, phone, address and UEN) and the invoices you create. Your clients' details are personal data that you have collected — see section 8.

When you join the waitlist or express interest in a plan. Your email address, the plan you clicked, and basic attribution: the site that referred you, any campaign tags in the link you followed, the page you first landed on, and the country your request came from.

Technical data. Our hosting and database providers keep short-lived server logs, which include IP addresses, for security and troubleshooting. We do not store IP addresses in our own database, and we do not build advertising or behavioural profiles about you.

We do not knowingly collect data from anyone under 18, and we do not collect NRIC numbers, financial account credentials, or any special categories of personal data.

• To provide the service — creating your account, generating invoices and PayNow QR codes, and keeping you signed in. You provide this data voluntarily so that we can supply the service you asked for.
• To take payment and activate paid plans — matching a PayNow transfer to your account and upgrading it.
• To contact you about your account — sign-in links, billing, service notices and security matters. These are not marketing and you cannot unsubscribe from them while you hold an account.
• To follow up on a plan you asked about— if you give your email when choosing a paid plan but don't finish signing up, we may email you once about that plan. Nothing more unless you reply or ask for it.
• To send launch and product updates — only if you asked us to, by joining the waitlist or ticking the box on a form. Every such email carries an unsubscribe link, as required by the Spam Control Act 2007.
• To understand how people find us — attribution and, if you accept analytics cookies, aggregate usage statistics.
• To meet legal obligations — including keeping records where tax or accounting law requires it.

Cookies that keep you signed in are strictly necessary and are always on. Google Analytics is optional, is off until you accept it, and can be turned off again at any time. The full detail — every cookie, what it does and how long it lasts — is in our Cookie Policy.

We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our instructions:

• Supabase — database, authentication and file storage. Hosts your account, profile, clients and invoices.
• Vercel — application hosting and delivery.
• Resend — sends our transactional and notification emails.
• Google Analytics — aggregate website statistics, and only if you accepted analytics cookies.

We may also disclose personal data where the law requires it, or to establish or defend a legal claim.

The providers above operate servers outside Singapore, so your data may be stored or processed overseas — including in the United States and the European Union. As required by the PDPA's Transfer Limitation Obligation, we take reasonable steps to ensure each recipient is bound by contractual terms that provide a standard of protection comparable to the PDPA. You can ask us which country your data is held in at any time.

• Account, invoice and client data — for as long as your account is open. If you delete your account we delete this data within 30 days, except where we must keep records of payments for tax purposes.
• Waitlist and plan-interest records — until you ask us to remove them, or for 24 months without any contact from you, whichever comes first.
• Server logs — kept by our providers for a short period, typically no more than 30 days.

When you add a client, you are the organisation responsible for that person's data under the PDPA, and we act on your instructions as a data intermediary. You are responsible for having a proper basis to give us their details and for making sure they are accurate. We use client data only to provide the service to you — never for our own marketing.

Under the PDPA you may:

• Ask for a copy of the personal data we hold about you and how it has been used in the past year.
• Ask us to correct anything that is wrong. Most details can be edited yourself in Settings.
• Withdraw consent to any use of your data, including marketing emails. Withdrawing consent needed to run your account means we can no longer provide the service, so we will close it.
• Ask us to delete your account and its data.

Write to privacy@workinvoice.app. We will respond within 30 days, and tell you if we need longer. If you are not satisfied you may complain to the Personal Data Protection Commission at pdpc.gov.sg.

Data is encrypted in transit. Access to the production database is restricted, and rows are protected so one account cannot read another's. Sign-in uses one-time email links, so there is no password to be stolen or reused. No system is perfectly secure; if a breach occurs that is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the PDPA requires.

If we change this policy we will update the date at the top of the page, and for significant changes we will email account holders before the change takes effect.