Privacy Policy — Vasulify

What we collect

Account information: your name, email address, and password (stored only as a secure one-way hash — we never see your plain password). If you sign in with Google or GitHub, we receive your name and email address from them.
Invoice and estimate data: invoice numbers, amounts, due dates, line items, notes, and status that you create.
Client data: names, email addresses, and contact details you add for your clients.
Usage analytics: page visits, feature clicks, and user journeys via PostHog (EU Cloud) and Google Analytics 4, to help us improve the product.
Email open tracking: when a client opens an automated follow-up email, we record the timestamp to help you know when they read it.
Public invoice views: when a client opens a public invoice link (/i/token), we record the first-view timestamp.
Payment records: if a client pays through a linked payment page, we store the payment amount and date (we do not handle card data).

How we use your data

To operate your account and provide the Vasulify invoice automation service.
To send automated follow-up emails to your clients on your behalf via Azure Communication Services.
To display your invoice history, client list, estimate pipeline, and payment analytics.
To improve the product based on anonymised, aggregated usage patterns.
To process your subscription via Razorpay and maintain your billing status.

What we do NOT do

We do not sell your personal data or your clients' data to any third party.
We do not use your data to serve you advertising.
We do not share your invoice or client data with anyone except services directly required to operate (email delivery, payments).
We do not store or process payment card numbers — all card, UPI and netbanking handling is done by Razorpay on its own platform.

Third-party services we use

Azure Communication Services (Microsoft) — email delivery used to send invoice reminders and transactional emails to your clients. Data processed: recipient email, name, and the invoice details needed to compose the email. Privacy policy: https://privacy.microsoft.com
PostHog (EU Cloud) — product analytics. We collect page views, feature usage, and user journey events. Data is associated with your account email for the purposes of understanding how features are used. Data is hosted on PostHog's EU infrastructure. You can opt out by disabling JavaScript. Provider: PostHog Inc. Privacy policy: https://posthog.com/privacy
Google Analytics 4 — web analytics. We collect anonymised page views and session data. IP addresses are anonymised. Provider: Google LLC. Privacy policy: https://policies.google.com/privacy
Razorpay — subscription billing. When you subscribe, payment happens inside Razorpay's secure checkout. We receive your subscription ID and payment confirmation. We do not see or store your card or bank details. Provider: Razorpay Software Pvt. Ltd. (India). Privacy policy: https://razorpay.com/privacy/
Azure SQL (Microsoft) — your data is stored in a Microsoft Azure SQL database in a secure data centre. Provider: Microsoft Corporation. Privacy policy: https://privacy.microsoft.com
Azure Application Insights (Microsoft) — error and performance monitoring: which pages load, how fast, and any errors, so we can fix problems. Email addresses and long numbers are removed from the error reasons we record. Privacy policy: https://privacy.microsoft.com
Cloudflare — protects the site and runs the bot check on the sign-up form (Turnstile). Provider: Cloudflare, Inc. Privacy policy: https://www.cloudflare.com/privacypolicy/
Google and GitHub sign-in — only if you choose "Sign in with Google/GitHub": they share your name and email address with us. Providers: Google LLC, GitHub, Inc.
Google Ads — when you arrive from one of our ads, Google Ads measures whether you then signed up or created an invoice, so we know which ads work. We don't share your invoice or client data with Google. Privacy policy: https://policies.google.com/privacy

Analytics in detail

PostHog: we track which pages you visit, which buttons you click, and which features you use. This helps us prioritise improvements. Data is hosted on PostHog EU Cloud (eu.i.posthog.com). We use person profiles only for identified users (i.e. after you sign in). Retention: 12 months.
Google Analytics 4: we track page views, session duration, and device type. Google Analytics data is anonymised and aggregated. We do not share individual-level data with Google for advertising. Retention: 14 months.
Analytics cookies are first-party cookies set on vasulify.com. Google Ads may set a conversion cookie (_gcl_au) to measure our ads; it is not used to show you ads on other sites based on your Vasulify activity.

Data storage and security

Your data is stored in a secured Azure SQL Server database with TLS encryption in transit and at-rest encryption.
Passwords are hashed using ASP.NET Core Identity (PBKDF2 with HMAC-SHA256). We cannot recover your password.
HTTPS is enforced for all connections. We set Strict-Transport-Security, X-Frame-Options, and Content-Security-Policy headers.
We take reasonable precautions to protect your data, but no system is 100% secure.

Public invoice links

When you share a public invoice link (/i/token), anyone with that link can view the invoice.
The link contains only the invoice details — it does not expose your account, other invoices, or your clients' full contact records.
We record the first time a client views the link so you can see when they opened it.
Share links only with intended recipients.

Your rights (GDPR / data subject rights)

Right to access: you can request a copy of all personal data we hold about you — email [email protected].
Right to deletion: you can delete your account and all associated data from Settings → Security → Delete Account, or by emailing [email protected].
Right to correction: update your name, business details, and contact info from the Settings page at any time.
Right to portability: email [email protected] to request a data export.
Right to object: you may opt out of analytics by disabling JavaScript or using a browser content blocker.
Requests are responded to within 30 days in accordance with applicable data protection law.

Cookies

Authentication cookie: keeps you signed in (HttpOnly, Secure, SameSite=Strict).
Anti-forgery cookie: protects forms against CSRF attacks (HttpOnly, Secure).
PostHog cookie (ph_*): used by PostHog to track sessions and identify returning users. Set on your first page visit.
Google Analytics cookies (_ga, _gid): used by Google Analytics to distinguish users and sessions.
Google Ads conversion cookie (_gcl_au): measures whether a visit from one of our ads led to a sign-up. No other advertising cookies are set.

Contact

For privacy questions or data requests, email [email protected].
We aim to respond within 5 business days.