Legal
Privacy Policy
Last updated: October 22, 2026
This Privacy Policy explains how AeroInvoice ("AeroInvoice," "we," "us," or "our") collects, uses, and shares information when you use our website (aeroinvoicing.com), web application, and mobile applications (collectively, the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
1. Information We Collect
1.1 Account Information
When you create an account, we collect the information you provide directly, such as your name, email address, and password (or, if you sign in with Google, your Google account name, email, and profile photo). Authentication is handled by Firebase Authentication, a Google Cloud service.
1.2 Business & Customer Data You Enter
To provide the Service, we store the business data you create, including:
- Business profile details (company name, logo, address, tax information)
- If you choose to accept direct bank transfers, the bank name, account holder name, routing number, and account number you enter so clients can pay you by ACH or wire. This is masked wherever it is shown to a client; the full number is visible only to you.
- Invoices, estimates, and other documents you generate
- Client and customer contact information you add
- Catalog items, pricing, and cost data
- Expenses, time entries, and mileage logs
- Customer project and milestone records
- Photos or files you attach to documents (e.g., jobsite photos, receipts)
This data is stored in your account's private workspace on Google Cloud Firestore and, for offline access, cached locally on your device.
1.3 Receipts, Estimates and Logos
Receipt photos are read on your device: the text recognition runs locally and the image is not sent to AeroInvoice or any third party for reading. If you save a receipt photo or attach one to a document, it is stored in your private workspace like any other attachment (see 1.2). Trade estimate templates run on your device. Two optional features send what you enter to Google's Gemini API through our servers: the "describe the job in your own words" tool sends the text you type, to generate suggested line items; and the Logo Studio sends your company name, industry, style choices and edit instructions, plus the logo image you upload if you choose to edit an existing logo, to generate or edit a logo. Gemini API inputs are not used to train AI models, and AeroInvoice does not keep them beyond returning the result to you. A logo you choose to save is stored in your workspace.
1.4 Bank Account Connections (Plaid, coming soon)
Bank and card connections are coming soon and are not available in AeroInvoice yet, so no bank data is collected today. This section describes how they will work. If you connect a bank or card account once this feature is available, the connection is made through Plaid Inc. You log in to your bank inside Plaid's secure window; AeroInvoice never sees or stores your bank username or password. With your permission, Plaid provides us read-only access to account names, the last four digits of account numbers, balances, and transactions (date, merchant, amount and category). We use this only to import your business charges and match them to your receipts. When you connect, we request up to 90 days of transaction history and then retrieve new transactions as they post. Imported transactions are kept in your private workspace until you delete them or delete your account; disconnecting a bank stops further imports. The access token Plaid issues is stored only on our servers and is never readable by your device or other users. You can disconnect a bank at any time in the app, which revokes our access through Plaid. Plaid's handling of your data is described in the Plaid End User Privacy Policy.
1.5 Payments and Subscriptions (Stripe and app stores)
Subscription purchases and invoice payments from your customers are processed by Stripe, Inc. Card numbers and bank details are entered directly into Stripe's secure pages and are never received or stored by AeroInvoice; we receive only payment status, amounts, and identifiers needed to show that an invoice is paid or a plan is active. If you accept card payments from customers, Stripe collects the business and identity information it requires to verify your account. Where a purchase is made through Google Play or the Apple App Store, that store processes the payment and we receive only the purchase token and product ID to verify it.
1.6 Device & Usage Information
We may automatically collect limited technical information, such as app version, device type, operating system, and crash/error logs, to help us maintain and improve the Service. To enforce free-plan limits on AI logo generation we keep a usage counter tied to your account and a one-way hash of your IP address (not the address itself). When you visit our website, our hosting provider, Google Firebase Hosting, processes standard server logs such as IP address and browser type. The website uses Metricool for visit statistics, and Google Analytics only if you agree; see 1.7. The home page, the free invoice generator, and the logo maker load code libraries or fonts from public content delivery networks (jsDelivr, unpkg, Google Fonts), which receive your IP address and browser details when those pages load.
1.7 Website Analytics and Cookies
This section covers the website, www.aeroinvoicing.com. The AeroInvoice app does not use Metricool or Google Analytics.
Metricool (always on, no cookies). On each page view, Metricool receives your IP address, your browser and device type (user agent), the page you are viewing, the site that referred you, and your screen size. Metricool does not set cookies or store anything on your device.
Google Analytics 4 (only if you accept). The website asks before using Google Analytics. Until you click “Accept analytics cookies”, nothing from Google is loaded. If you accept, Google Analytics sets these first-party cookies to count visits and see which pages and sign-up buttons are used:
| Cookie | Purpose | Lifetime |
|---|---|---|
_ga | Tells one visitor's visits apart from another's, using a random ID | 2 years |
_ga_<ID> | Keeps track of the current visit (session) | 2 years |
With your consent, Google Analytics receives your browser and device details, an approximate location derived from your IP address, the pages you view, the site that referred you, any campaign tags in the link you followed, and clicks on our Start free and founding member buttons. Google Analytics 4 does not log or store IP addresses. We have turned off Google signals and ad personalization, and advertising storage stays denied.
Your choice. Your answer is saved in your browser's local storage (as aero_consent), not in a cookie, until you clear it. If your browser sends a Do Not Track or Global Privacy Control signal, we treat that as “Decline” and do not ask. If local storage is blocked, we treat that as no consent.
Changing your mind. Click “Cookie settings” at the bottom of any page and choose “Decline”. Google Analytics stops collecting and its _ga cookies are deleted. You can also delete cookies in your browser settings at any time.
The website uses no advertising cookies. It uses analytics cookies only if you accept them.
2. How We Use Information
- To provide, operate, and maintain the Service
- To sync your data across your devices
- To import bank transactions you have connected and match them to receipts
- To process subscription and invoice payments
- To respond to support requests
- To detect, prevent, and address technical issues or fraud
- To communicate service-related updates (not marketing, unless you opt in)
We never sell your data or use your financial information for advertising.
3. Third-Party Services
We rely on the following service providers, each of which processes data under its own privacy policy:
| Service | Purpose |
|---|---|
| Google Firebase (Auth, Firestore, Cloud Functions) | Account authentication and cloud data storage/sync |
| Plaid | Optional, read-only bank and card transaction import (coming soon; not yet in use) |
| Stripe | Subscription billing and customer invoice payments |
| Google Gemini API | Optional scope suggestions and Logo Studio generation |
| Google Play Billing / Apple App Store | In-app purchases, where applicable |
| Google Analytics 4 | Website visit statistics on www.aeroinvoicing.com, only after you accept analytics cookies |
| Metricool | Cookieless visit statistics on www.aeroinvoicing.com (not the app) |
We do not sell your personal information to third parties.
4. Data Storage & Security
Your data is stored on Google Cloud infrastructure, encrypted in transit (TLS 1.2+) and at rest. Access to your workspace is restricted to your authenticated account by Firestore security rules, and every server request requires a verified sign-in. Secrets and bank access tokens are held only server-side in Google Secret Manager or server-only database records. We maintain a written information security policy covering access control, multi-factor authentication, and incident response. While we take reasonable measures to protect your information, no method of electronic storage or transmission is 100% secure.
5. Data Retention & Deletion
We retain your account and business data for as long as your account is active. You can delete your account at any time in the app under Settings → Delete Account. Deletion removes your cloud data and sign-in, and, once bank connections are available, disconnects every linked bank through Plaid so we can no longer access it. Data cached on a device is cleared when you delete from that device. You can also request deletion by emailing us at the address below, and we will complete it within 30 days, except where retention is required by law.
6. Your Rights & Choices
Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us using the information below. California residents may have additional rights under the CCPA; EEA/UK residents may have additional rights under the GDPR.
7. Children's Privacy
The Service is not directed to children under 13 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
8. International Data Transfers
Your information may be processed and stored on servers located outside your country of residence, including in the United States, through our use of Google Cloud infrastructure.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do, and material changes will be communicated through the Service.
10. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:
Email: privacy@aeroinvoicing.com
Security issues: security@aeroinvoicing.com