Welcome to Invozo ("we", "our", "us"), engineered and maintained by Pansoftech. Invozo is an advanced mobile GST invoicing, ledger tracking, and Input Tax Credit (ITC) management application built for Indian business owners, freelancers, retailers, and MSMEs (Micro, Small, and Medium Enterprises).
We are committed to absolute transparency regarding your data. This Privacy Policy outlines what information we collect when you use our mobile application (Package Name: com.pansoftech.invozo) and related online services, how we protect it, who we share it with, and your statutory rights under the Digital Personal Data Protection (DPDP) Act 2023 (India) and Google Play Store Developer Data Safety Policies.
Key Guarantee: Invozo does NOT sell, rent, monetize, or broker your personal, financial, or client ledger data to any third-party advertisers or marketing networks. All business records remain the sole property of the user.
To generate legally valid tax invoices under Rule 46 of the Central Goods and Services Tax (CGST) Rules 2017 and maintain your business ledger, Invozo collects and processes the following categories of information:
| Data Category |
Specific Data Items |
Purpose & Collection Method |
| Personal & Account Information |
Merchant Full Name, Email Address, Phone Number, Profile Photo (optional). |
Authentication, account creation, account recovery, and security alerts via Google Firebase Authentication and Google Sign-In. |
| Business & Statutory Profiles |
Legal Business Name, Trade Name, Registered Address, State Code, GSTIN (15-digit Goods and Services Tax Identification Number), PAN, Business Signature image. |
Mandatory under Rule 46(a) & 46(f) of CGST Rules 2017 to stamp on issued tax invoices and verify Place of Supply. |
| Financial & Banking Details |
Bank Name, Account Holder Name, Bank Account Number, IFSC Code, UPI VPA (e.g., merchant@bank). |
Rendered onto generated invoice PDFs and encoded into dynamic Bharat UPI QR codes so customers can pay the merchant directly. Invozo never executes or holds merchant bank transfers. |
| Client & Counterparty Data (User Content) |
Customer/Buyer Business Name, Billing Address, Shipping Address, Contact Phone, Email, and Buyer GSTIN. |
Processed strictly as user-generated content to render B2B/B2C invoices, delivery challans, and customer account statements. |
| Transaction & Tax Ledgers |
Invoice numbers, line items, HSN/SAC codes, taxable amounts, CGST, SGST, IGST calculations, payment statuses (Paid/Pending/Overdue), and purchase bills (Input Tax Credit tracking). |
Core app functionality: generating tax invoices, computing monthly liability, and preparing GSTR-1 and GSTR-3B filing summaries. |
| Device & Diagnostic Data |
Device model, Android OS version, IP address, Firebase App Check tokens, crash logs, and performance metrics. |
Application stability, bug resolution, fraud prevention, and session security. |
3.1 Strict Biometric Data Handling Disclosure (USE_BIOMETRIC)
Invozo offers an optional App Lock feature using the Android USE_BIOMETRIC permission (via the Flutter local_auth framework), allowing merchants to protect sensitive financial records with their Fingerprint, Face Unlock, or Device PIN.
Mandatory Google Play Biometric Policy Disclosure:
Biometric authentication is executed entirely on your local device by Android's hardware-isolated Trusted Execution Environment (TEE) / Secure Enclave via the official Android BiometricPrompt API.
Invozo, Pansoftech, and our cloud servers NEVER have access to, receive, collect, process, or store your biometric templates, fingerprints, or facial recognition records.
3.2 Screen Privacy Protection (FLAG_SECURE)
Invozo incorporates hardware-level screen protection via Android WindowManager's FLAG_SECURE (managed via ScreenSecurityService). When active:
- Screenshots and screen recordings of financial ledgers are prevented at the OS level.
- The Android recent apps switcher displays an obscured privacy cover to prevent passersby or malicious applications from capturing confidential GST client accounts.
We process your data strictly under the following legitimate business and legal purposes:
⚡ Core Invoicing & Billing
To produce valid GST invoices, calculate tax splits (CGST + SGST or IGST), format statutory round-offs, and generate exportable PDF invoices.
☁️ Cloud Synchronization
To securely backup your client directories, products catalog, and tax ledgers across multiple devices via encrypted Cloud Firestore.
📨 Document Delivery
To facilitate sharing of invoice PDFs and payment reminders via direct WhatsApp deep-links or authorized email dispatches.
⚖️ Statutory Compliance
To assist Indian merchants in complying with Rule 46 of CGST Rules 2017 and preparing GSTR-1 / GSTR-3B tax returns.
Invozo integrates carefully vetted, industry-standard service providers to deliver robust infrastructure, authentication, and communications. Each provider processes data in compliance with strict data protection agreements:
| Service Provider |
Role in Invozo |
Data Shared |
Privacy Documentation |
| Google Firebase (Google LLC) |
Authentication, Cloud Firestore database, Firebase Hosting |
User account IDs, encrypted business ledgers, device diagnostic signals |
Firebase Privacy & Security |
| Google Sign-In API (Google LLC) |
Federated OAuth 2.0 authentication |
Email address, basic profile name, Google OAuth token |
Google Privacy Policy |
| Transactional Email Service (Render / Node.js) |
Invoice PDF email dispatcher (when triggered by user) |
Recipient email address, merchant name, attached invoice PDF |
Render Privacy Policy |
| WhatsApp (Meta Platforms, Inc.) |
External URL scheme integration (wa.me) |
None directly sent via SDK; launches the native WhatsApp client installed on the user's phone |
WhatsApp Privacy Policy |
6.1 Statutory Tax Invoicing Retention (Section 36, CGST Act 2017)
Under Section 36 of the Central Goods and Services Tax (CGST) Act, 2017, every registered person must keep and maintain books of account and records (including invoices, debit/credit notes, and payment logs) for a mandatory minimum duration of 72 months (6 years) from the due date of furnishing the annual return for the financial year.
Accordingly, transaction records and invoice documents generated on Invozo are maintained to safeguard merchants during statutory audits, GST assessments, and tax reconciliations.
6.2 User Profile & Authentication Retention
Non-statutory personal data (such as login sessions, device tokens, and temporary draft caches) is retained only as long as you maintain an active account. If you request account closure, non-statutory data is permanently purged from active Firebase databases within thirty (30) business days.
We deploy robust multi-layered defenses to prevent unauthorized access, interception, or loss:
- Encryption in Transit: All communications between the Invozo mobile app, Firebase servers, and email relays are protected with Transport Layer Security (TLS 1.3 / HTTPS).
- Encryption at Rest: Cloud Firestore stores database volumes with Google Cloud AES-256 server-side encryption.
- Multi-Tenant Data Segregation: Strict Cloud Firestore Security Rules enforce tenant-level partition keyed to verified
businessId and authenticated Firebase user tokens.
- On-Device Encryption: Sensitive preferences and session tokens are encrypted using the Android Keystore system via
flutter_secure_storage.
In accordance with the Digital Personal Data Protection Act, 2023 and international privacy standards, you possess the following rights:
- Right to Access & Summary: You can review all invoices, customer ledgers, and profile details stored within your Invozo account at any time.
- Right to Correction: You can amend, edit, or update your registered business profile, address, bank accounts, or customer contacts directly in the app.
- Right to Portability: You can export your invoices, customer statements, and GSTR summaries in universally readable PDF and JSON formats.
- Right to Grievance Redressal: You have the right to register complaints with our appointed Grievance Officer or escalate to the Data Protection Board of India.
- Right to Nominate: You may nominate an individual to exercise your privacy rights in the event of death or incapacity.
In strict compliance with Google Play's User Data & Account Deletion Policy, Invozo provides straightforward mechanisms for users to request the permanent deletion of their account and associated data:
1
Method 1: In-App Account Deletion
Launch Invozo > Open Business Profile & Settings > Scroll to the Account & Security section > Tap Delete Account & Data and confirm your choice.
2
Method 2: Web / Email Deletion Request
Visit our dedicated Data Deletion Request Page, or email our Data Protection team at pansoftech@gmail.com with the subject "Invozo Account and Data Deletion Request" from your registered email account.
Deletion Timeline: Upon receiving your verified request, we will permanently delete your authentication credentials, cloud profile, and draft records within 30 days. Please note that previously issued GST tax invoices may be archived in anonymized form strictly for the mandatory 72-month period required under Section 36 of the CGST Act 2017.
Invozo is an enterprise financial application designed exclusively for commercial business operations. Our service is not directed to, and does not knowingly collect or solicit personal information from, persons under 18 years of age. If we discover that a minor has registered an account, we will immediately purge such data from our servers.
We may update this Privacy Policy periodically to reflect enhancements in our application or statutory revisions in Indian or international law. The updated policy will be posted on this URL with an updated "Effective Date". In the event of material changes, we will provide prominent notice via in-app banners or registered email notices.
In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, the contact details of our appointed Grievance Officer and Data Protection Officer are provided below:
