Privacy Policy

1. Who we are and what this policy covers

Invatrak LLC ("Invatrak," "we," "us," or "our") provides Invatrak, a cloud inventory and order management service for businesses. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the choices you have. It applies to our website at invatrak.com, our early-access list, and the Invatrak web application (together, the "Service").

Two roles. For information about our website visitors, early-access subscribers and account contacts, we decide how the information is used. For the business records our customers store in or sync to the Service ("Customer Data"), we process that information on behalf of the customer that owns the account, following its instructions and our agreement with it. If you are an employee or contact of one of our customers and have questions about Customer Data, please also reach out to that business.

2. Information we collect

Information you give us

• Early-access signups: your email address and, if you choose to share them, details such as your name, company and role.
• Account information: name, work email, company name, phone number, job role, and sign-in details such as passkey or two-factor settings. We store passwords only in hashed form.
• Billing information: billing contact and plan details. Card payments are handled by our payment processor; we do not store full card numbers.
• Communications: messages, support requests and feedback you send us.

Customer Data

When you use the Service, you and your users enter or import business records such as items, stock levels, locations, serial and lot numbers, customers, vendors, quotes, orders, shipments, invoices, payments and related contact details and addresses.

Information collected automatically

• Usage and log data: pages and features used, actions taken, dates and times, and error reports.
• Device and connection data: IP address, browser type, operating system and approximate location derived from the IP address.
• Cookies and similar technologies: see Section 6.

3. Data from connected integrations

You can choose to connect the Service to third-party services. We only connect when an authorized user on your account turns on an integration, and we access only the information allowed by the permissions you approve on that provider's authorization screen.

• QuickBooks Online (Intuit): to keep your records in sync, we may read and write accounting information such as company profile details, customers, vendors, products and services, accounts, tax settings, estimates, invoices, purchase orders, bills, payments and related transactions.
• ShipStation: to quote rates and create labels, we may exchange shipment details such as ship-to names and addresses, package weights and dimensions, carrier and service selections, label files and tracking numbers.
• Avalara AvaTax (optional): to calculate sales tax, we may send transaction details such as ship-from and ship-to addresses, item tax codes, amounts and customer exemption information, and receive calculated tax amounts in return.

Access tokens. Integrations use secure authorization methods such as OAuth. We receive access and refresh tokens (or API keys, where a provider requires them), store them in protected form, and use them only to perform the actions you have enabled. We never ask for or store your password for these services.

Limited use. We use data obtained through integrations only to provide and support the features you have turned on. We do not sell it, use it for advertising, or share it with third parties for their own purposes.

Disconnecting. You can disconnect an integration at any time in the Service or from the provider's own connected-apps settings (for example, within your Intuit account). When an integration is disconnected, we stop accessing that account and delete or revoke the stored tokens. Records that were already synced remain part of your Customer Data until you delete them or your account is closed.

4. How we use information

• To provide, operate and maintain the Service, including syncing with the integrations you choose.
• To create and secure accounts, verify sign-ins, and prevent fraud, abuse and unauthorized access.
• To respond to questions and provide customer support.
• To send service messages, such as security alerts, billing notices and changes to our terms.
• To send early-access and launch updates to people who signed up for them. You can unsubscribe at any time.
• To understand how the Service is used and to fix problems and improve features, using aggregated or de-identified information where possible.
• To comply with law, enforce our agreements and protect the rights and safety of our customers, users and company.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you or your organization, our legitimate interests in running and improving a secure business service, your consent (for example, for optional marketing emails), and compliance with legal obligations.

5. How we share information

We share information only as described here:

• Service providers (subprocessors): companies that help us run the Service under contracts that limit their use of the data to the services they provide to us. These fall into categories such as cloud hosting and infrastructure, content delivery and website security, database and file storage, email delivery, payment processing, customer support tools, and error monitoring. A current list of subprocessors is available on request at invatrak@gmail.com.
• Integrations you enable: when you connect QuickBooks Online, ShipStation, Avalara AvaTax or another integration, we send data to that provider as needed to perform the action you requested. Each provider handles that data under its own privacy policy.
• Within your organization: account administrators can see and manage data and activity for their company's account.
• Legal and safety reasons: when we believe in good faith that disclosure is required by law or legal process, or is needed to protect rights, property or safety.
• Business transfers: as part of a merger, acquisition, financing or sale of assets, subject to the commitments in this policy.
• With your consent: in any other case where you ask us to or agree to it.

6. Cookies and similar technologies

The web application uses cookies and similar storage that are necessary to keep you signed in, remember preferences and protect against misuse. Our marketing website is served through a content delivery network that may process request data, such as IP addresses, to deliver pages quickly and block malicious traffic. We do not use advertising cookies. If we add optional analytics in the future, we will update this policy and offer choices where the law requires.

7. Retention and deletion

• Customer Data is kept for as long as the customer's account is active. After an account closes, the customer may request an export for 30 days. We then delete Customer Data from our active systems within 90 days, and remaining copies in backups are overwritten on their normal cycle, typically within 35 days.
• Integration tokens are deleted or revoked when an integration is disconnected or the account closes.
• Early-access signups are kept until you unsubscribe or ask us to delete them, or until they are no longer needed for launch communications.
• Account, billing and log records may be kept longer where needed for security, to resolve disputes, or to meet legal, tax and accounting obligations.

Customers can ask us to delete their data sooner by contacting invatrak@gmail.com.

8. Security

We use administrative, technical and physical safeguards designed to protect information, including encrypted connections (TLS) for data in transit, protected storage of integration credentials, access controls based on the principle of least privilege, and account protections such as passkeys, two-factor sign-in, role-based permissions and optional login-hour restrictions. No system is perfectly secure, so we also encourage you to use strong sign-in methods and to review user access regularly. If a security incident affects your information, we will notify you as required by law.

9. Your rights and choices

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that is inaccurate;
• delete your personal information;
• receive your information in a portable format;
• object to or restrict certain uses, and withdraw consent where we rely on it;
• not be treated differently for exercising these rights.

To make a request, email invatrak@gmail.com. We will verify your request and respond within the time the law requires. If your information is part of a customer's account, we may refer your request to that customer and assist it in responding. You can also unsubscribe from marketing emails using the link in any message, and you can disconnect integrations at any time as described in Section 3. If you are in the EEA or UK, you may also lodge a complaint with your local data protection authority.

10. International users

The Service is operated from, and information is stored in, the United States. If you access it from elsewhere, your information will be transferred to and processed there. Where required, we use appropriate safeguards for these transfers, such as standard contractual clauses.

11. Children

The Service is built for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy as the Service evolves. We will post the new version here with a new effective date and, if the changes are significant, notify account holders by email or in the Service before they take effect.

13. Contact us

For privacy questions or requests, contact: