Privacy Policy
Effective date: 27 October 2026. Version: 2026-10-27d
1. Who we are
PDQ Invoice (pdqinvoice.com) is an online service that lets businesses send quotes, estimates, and invoices to their customers, and lets those customers review, accept, and pay them. It is operated by PDQ Invoice LLC, a Georgia limited liability company, 1454 Oakmont Dr., Acworth, GA 30102 ("PDQ Invoice," "we," "us").
We play two different roles, and this policy explains both:
- For businesses that sign up ("Businesses") and their staff, we are the provider of the service. This policy describes how we handle your information directly.
- For a Business's customers (people and companies who receive quotes and invoices, "Customers"), we hold your information on behalf of that Business, which decides what to collect and how to use it. If you have a question about your information, please contact the Business that sent you the document first; we will help them answer it.
2. Information we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account information | Name, email address, phone number, and a password (stored only in scrambled, "hashed" form by our sign-in provider) | You, when you sign up or are invited |
| Sign-in security (optional) | Two-step sign-in: the authenticator app setup (kept by our sign-in provider), backup codes (stored only in hashed form), and remembered devices (a hashed token, the browser and system name, and when it expires). Google or Microsoft sign-in: your name, email address, and that account's ID. | You, when you turn on two-step sign-in or connect a Google or Microsoft account; and Google or Microsoft, when you sign in with them |
| Business information | Business name, legal name, address, phone, email, website, logo, tax rate, saved wording for documents | The Business |
| Customer records | Customer names, billing emails, phone numbers, addresses, and preferred language; the people who have a login to a customer's portal | The Business, and Customers who accept an invitation |
| Documents | Quotes, estimates, invoices, line items, notes and terms, accept or decline responses, typed signatures | The Business and its Customers |
| Payment records | Amount, date, method, reference, and status of payments; refunds and disputes | The Business, and our payment processor (Stripe) for online payments. We never receive or store card or bank account numbers. |
| Email records | Who an email was sent to, its subject, when, and whether it was delivered | Generated when the service sends an email |
| Security and usage records | Sign-ins, password changes, data exports, the IP address and browser used, and when a page was last active | Generated automatically when the service is used |
| Subscription information (Businesses) | Plan, trial dates, billing status | Our payment processor (Stripe Billing) |
3. How we use it
We use information only to run, protect, and improve the service:
- to create and show quotes, estimates, invoices, and receipts, and to email them and their reminders to Customers on a Business's behalf;
- to process online payments and subscriptions through Stripe;
- to keep each Business's information separate and accessible only to that Business and its own Customers;
- to keep accounts secure, for example signing people out after 12 hours without activity, offering two-step sign-in, confirming password and two-step changes by email, and keeping an access log;
- to provide support when a Business or Customer asks for help;
- to meet legal obligations, such as tax and accounting rules or valid legal requests (see section 4).
We do not sell personal information, we do not use Customer information to advertise to anyone, and we do not use it for any purpose of our own beyond running the service.
4. Who we share it with
The Business you deal with. A Customer's documents, responses, and payments are visible to the Business that sent them. Customers see only what that Business sent them. Businesses never see each other's information.
Service providers that run parts of the service for us, under contracts that limit their use of the information to providing their service:
| Provider | What they do for us |
|---|---|
| Supabase | Database, sign-in, and file storage (for example, logos) |
| Vercel | Hosting the website |
| Stripe | Online payments, identity verification of Businesses that accept payments, and subscription billing |
| Google and Microsoft | Sign-in, only if you choose to sign in with or connect a Google or Microsoft account. They tell us your name and email address; we never see that account's password. |
| Google Workspace | Our own email (info@pdqinvoice.com), when you write to us |
| Postmark (ActiveCampaign, LLC) | Sending emails, such as quotes, invoices, receipts, reminders, and sign-in emails |
Legal requests. We disclose information to government or law enforcement only when required by valid legal process, such as a subpoena, court order, or search warrant. When we receive a request, we:
- confirm with our attorney that it is genuine and legally valid;
- provide only the information the request requires;
- notify the affected Business (and, where appropriate, Customer) before disclosing, unless the law or a court order prohibits it; and
- keep a record of the request and what we provided.
We may also disclose information when we believe in good faith that it is necessary to prevent imminent physical harm or to protect the security of the service.
Business transfers. If PDQ Invoice is sold or merged, information may transfer to the new owner, who must continue to protect it as described here. [Attorney: confirm notice requirements.]
5. Cookies
We use only cookies needed for the service to work. We do not use advertising or cross-site tracking cookies.
| Cookie | Why | How long |
|---|---|---|
| Sign-in session | Keeps you signed in | Until you sign out, or after 12 hours without activity |
| Last activity | Signs you out after 12 hours without activity | 30 days |
| Remembered device | Skips the two-step code on this device, only if you tick "Remember this device" | 30 days, or until you forget the device |
| Business choice | Remembers which business you are working in, if you belong to more than one | 1 year |
| Language | Remembers English or Spanish | 1 year |
| Appearance | Remembers light, dark, or system appearance | 1 year |
The service also stores a few items in your browser's own storage on your device, such as a copy of unsaved work kept when you are signed out automatically. These items never leave your device unless you choose to restore and save them.
6. How long we keep it
- While a Business's account is active, we keep its information so the service can show its history, unless the Business deletes it. Businesses can permanently delete customers and documents, except that invoices and customers with payments recorded are kept, because payments are financial records.
- When a Business cancels, its account becomes read-only for 90 days so it can download its records, and is then permanently deleted.
- Backups of the database are kept for 7 days and then overwritten.
- The access log (sign-ins, password changes, data exports) is kept for 3 years.
- Payment records that we, Stripe, or a Business must keep for tax or accounting purposes may be kept for as long as the law requires.
- We may keep information longer when required by law or a legal hold.
7. Security
We protect information with measures appropriate to its sensitivity, including:
- encrypted connections (HTTPS) for all traffic;
- database rules that keep each Business's information separate and limit Customers to their own documents;
- passwords stored only in hashed form by our sign-in provider, and confirmation emails when a password changes;
- private document links in emails that are long, random, single-purpose, and expire after 90 days, with only a scrambled copy stored by us;
- optional two-step sign-in with an authenticator app, which a Business can require for its team and which PDQ Invoice's own staff must use; one-time backup codes; and an email whenever two-step sign-in is turned off or reset;
- automatic sign-out after 12 hours without activity;
- an access log of sign-ins, password changes, and data exports;
- card and bank details handled entirely by Stripe, never by us.
No system is perfectly secure. If we learn of a security breach that affects personal information, we will notify affected Businesses and individuals, and authorities where required, as required by applicable law, including Georgia's data breach notification law. [Attorney: confirm timing and content.]
8. Your choices and rights
- Businesses can view and update their information in the portal's settings, download their records, and ask us for a full export or deletion by contacting us.
- Customers can update their name and password in the portal. For anything else, including access to, correction of, or deletion of your information, please contact the Business that sent you the documents; we will help them respond.
- Everyone can, on their Account page, turn two-step sign-in on or off (unless their Business requires it), forget remembered devices, and connect or disconnect a Google or Microsoft account. Signing in with Google or Microsoft is optional; a password always works.
- Emails from the service are transactional (quotes, invoices, receipts, reminders, account security). Reminders are controlled by the Business; contact it to stop them.
- Depending on where you live, you may have additional rights under state privacy laws. [Attorney: confirm which state laws apply at PDQ Invoice's size, and add any required wording.]
9. Children
PDQ Invoice is a service for businesses and is not directed to children. We do not knowingly collect information from anyone under 18.
10. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is significant, we will tell Businesses by email or in the portal before it takes effect.
11. Contact
PDQ Invoice LLC, 1454 Oakmont Dr., Acworth, GA 30102. Email: info@pdqinvoice.com.