Privacy Policy
Last updated: July 1, 2026
Star LLC ("we", "us", "our") operates InvoiceXO at invoicexo.com. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.
1. Information We Collect
| Data | Why we collect it | Retained |
|---|---|---|
| Name, work email, company | Account creation and communication | Until account deleted |
| Invoice PDFs (in transit) | AI extraction processing | Not retained — deleted after extraction |
| Extracted invoice data (vendor, amount, PO, date) | Service functionality | Until account deleted |
| Microsoft OneDrive access token | Save files to your OneDrive | Until revoked or account deleted |
| Login timestamps, last activity | Security and account management | 90 days rolling |
| Sender email metadata (for fraud checks) | Invoice fraud detection | Not retained |
2. How We Use Your Information
- To provide invoice extraction and OneDrive save functionality
- To detect invoice fraud and sender spoofing via PhishGuard
- To send account-related emails (trial expiry, billing, support)
- To improve extraction accuracy over time
- To comply with legal obligations
3. Invoice PDF Processing
When you click "Extract Invoice Data", the PDF attachment is transmitted to our servers over encrypted HTTPS. It is processed by Claude AI (Anthropic) to extract structured data and is immediately deleted after extraction — we do not store your invoice PDFs. The extracted data fields (vendor name, amount, PO number, due date) are stored in your account to provide the service.
4. Microsoft OneDrive Integration
InvoiceXO requests permission to write files to your OneDrive. We store an access token to perform saves on your behalf. We only access OneDrive to save invoice files you explicitly request — we never read, scan, or modify other OneDrive content. You can revoke access at any time via your Microsoft account permissions page.
5. Third-Party Services
- Anthropic Claude API — processes invoice PDFs for data extraction. Subject to Anthropic's Privacy Policy.
- Microsoft Graph API — saves files to OneDrive. Subject to Microsoft's Privacy Policy.
- PayPal — processes subscription payments. Subject to PayPal's Privacy Policy.
- PhishGuard — checks sender domains for fraud signals. Sender metadata is analyzed but not stored.
6. Data Security
All data is transmitted over HTTPS. Passwords are hashed using bcrypt. Access tokens are stored encrypted. We follow industry-standard security practices. In the event of a data breach we will notify affected users within 72 hours.
7. Data Retention
We retain your account data for as long as your account is active. If you delete your account, we delete all associated data within 30 days. Invoice PDFs are never retained beyond the processing request.
8. Your Rights
You have the right to:
- Access the data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Revoke Microsoft OneDrive access at any time
- Opt out of non-essential emails
To exercise any of these rights, email hello@invoicexo.com.
9. Cookies
InvoiceXO uses session cookies for authentication only. We do not use tracking cookies or advertising cookies.
10. Children's Privacy
InvoiceXO is a business tool not intended for use by anyone under 18. We do not knowingly collect data from minors.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email. The date at the top of this page reflects the most recent update.
12. Contact
Privacy questions or requests: hello@invoicexo.com
Star LLC · invoicexo.com