Privacy policy

1. Who we are

Invoice Investigator is operated by Kovra Pay Inc., a Delaware corporation doing business as Layer 5 Labs, at 1100 Roseville Parkway, Suite 1218, Roseville, California 95678.

2. What we collect

Account information, including your email address and organization or workspace name. Your password is hashed by our authentication provider; we do not store it in readable form.

The invoices and supporting evidence you upload, along with extracted data, audit results, generated reports, and email drafts.

Some bills you may choose to upload, such as medical bills, insurer Explanations of Benefits, legal bills and email correspondence, can contain health information, details of a legal matter, or other people's personal information. We use them only to run the audit you request, keep them in private storage readable only by your workspace, and delete the documents on the schedule below. Please upload only documents you are entitled to share.

The answers you give to questions we ask about a bill, and any notes you add to them. They are stored with the audit and shown in its report as your statements.

Usage and cost logs needed to operate and protect the service, support correspondence, and billing records. Stripe handles payment-card details; we never see or store full card numbers.

Analytics data about how this website is used, including pages viewed, approximate location derived from your IP address, device and browser type, and the site that referred you. This is collected through Google Analytics and is not linked to the contents of your invoices.

3. Why we use it

We use this information to run the audits you request, keep your account and audit history, prevent abuse, bill you, and provide support.

We do not use your information for advertising, and we have not enabled Google's advertising or ads-personalization features in our analytics. We do not sell personal information.

4. Service providers and AI analysis

We use Netlify for hosting, Supabase for database services, authentication and private file storage, Stripe for payments, Anthropic for AI document analysis, and Google Analytics for website usage measurement. Data is processed in the United States.

If you use email intake, forwarded emails are received through Postmark as a service provider. We keep only accepted PDF attachments in private storage under the same 30-day retention policy. We retain sender, subject and intake activity metadata to operate the feature, and Google forwarding confirmation text so you can complete forwarding setup.

Documents you upload are sent to our AI provider, Anthropic, to perform the analysis you request. Anthropic's commercial terms state that it does not use business customers' API inputs or outputs to train its models. We do not use your documents to train any model of our own.

5. How long we keep information

Uploaded invoices and supporting documents are deleted automatically 30 days after upload. You can delete them sooner from Documents & retention. Vendor reference documents are kept until you delete them.

Audit results, findings and reports are kept with your account until you delete them or close the account. Billing records are kept for as long as the law requires.

6. Your choices

You can delete an individual document or all documents for an audit from Documents & retention. You can request account deletion in Account settings. Paid plans can export audit history as a CSV file.

For any privacy request, email privacy@invoiceinvestigator.com. We may need to verify that you control the account concerned before completing the request.

7. California privacy rights

California residents may have the right to know what personal information we collect and use, request deletion or correction, receive a portable copy, and exercise these rights without discrimination. We do not sell or share personal information for cross-context behavioral advertising.

Email privacy@invoiceinvestigator.com to make a request. We will respond within 45 days, subject to identity verification and any exception or extension allowed by law.

8. Security

We use private storage buckets with access limited to your workspace, short-lived signed links, encryption in transit, row-level database security, restricted administrative access with logging, and file-type validation.

No method of storage or transmission is completely secure. These measures reduce risk, but they cannot eliminate it.

9. Cookies

We use cookies and similar browser storage needed to keep you signed in and to operate the service. These cannot be turned off without breaking the service.

We also use Google Analytics cookies to measure how this website is used. These are set in your browser under the names _ga and _ga_GTXJ6ERWGP. You can block them with a browser extension or your browser's tracking protection and the service will continue to work normally. We do not use advertising trackers.

10. Children

The service is not intended for anyone under 18.

11. Changes to this policy

We may update this policy as the service or legal requirements change. We will post the updated policy here and change the Last updated date. If a change materially affects how we handle your information, we will also notify account holders by email or through the service.

12. Contact

Kovra Pay Inc., doing business as Layer 5 Labs, 1100 Roseville Parkway, Suite 1218, Roseville, California 95678.

Phone: 916-206-4040. General support: support@invoiceinvestigator.com. Privacy requests: privacy@invoiceinvestigator.com.