InvoicePaw Privacy Policy

Effective date: October 20, 2026

1. Who we are and what this policy covers

InvoicePaw is operated by RandomWalkr Technologies Inc., based in Ontario, Canada. This policy covers personal information handled through our website, text-based invoicing service, invoice and preview pages, payments for our service, and support. It applies to merchants, their representatives, website visitors and customers whose information merchants provide.

Our privacy contact is the person responsible for privacy at RandomWalkr Technologies Inc. Contact hello@invoicepaw.com or write to 18 King Street East, Suite 1400, Toronto, ON M5C 1C4, Canada.

2. Our roles

We use merchant account, billing, support, security and website information to operate our business. We process customer information supplied by merchants to provide their requested invoicing services. Merchants are responsible for their customer relationships and lawful invoicing instructions. We remain responsible for our own privacy obligations. Our Terms of Service describe the service and each party's responsibilities.

3. Information we collect

We collect information you provide, information supplied by merchants about their customers, and information generated through use of the service:

• Merchant and business information: phone numbers, names, email, website, country, addresses, business tax-registration details, invoice preferences and payment instructions.
• Messages and invoices: incoming and outgoing message content, contact details, message and delivery records, customer details, descriptions of work, amounts, taxes, dates, notes, payment instructions and reported payment status.
• Purchases and card settings: payment references, purchase and credit records, refunds or disputes, saved-card permissions and limited card details such as brand and last four digits. Our payment provider collects full card details through its own payment forms; our payment integration does not store full card numbers or security codes.
• Consent and support: permission and opt-out records, the notices presented, correspondence and information reasonably needed to verify identity or authority.
• Technical and usage information: network addresses, browser and device details, requested pages, timestamps, approximate location inferred from phone or network information, errors and security events. We use this information for relevant account settings, website analytics, service operation and abuse prevention.

Free-text messages and invoice descriptions may contain information we did not request. Do not send passwords, full card details, government-issued personal identifiers, unnecessary medical information or other sensitive details unrelated to a legitimate invoice. Contact us if sensitive information was sent by mistake.

4. Why we use information

We use information to:

• set up, maintain and secure accounts and process business updates;
• interpret instructions, collect missing details, create previews and carry out confirmed invoice requests;
• generate, store, deliver and display invoices;
• process invoice-pack purchases, credit, optional saved cards, refunds and disputes;
• provide requested service communications and support and respect communication choices;
• understand website use, improve reliability and usability, prevent misuse and investigate incidents; and
• meet legal, accounting, privacy-request and dispute-resolution obligations.

We do not use merchants' customer lists for our own direct marketing. Unrelated promotional communications require the notices and permissions applicable to them.

5. AI processing

We use third-party AI services to interpret messages and prepare business details and invoice drafts. Relevant message content, conversation context, business information and draft details may be sent for this purpose, including customer contact information, descriptions of work and amounts. Merchants must review the results and give the required confirmation before an invoice is sent.

We do not train our own general-purpose AI models using invoice or message content or authorise provider model training with that content without appropriate notice and any required permission. AI providers may retain submitted content for processing, safety monitoring and legal obligations; we do not promise zero retention. Contact our privacy contact for details about the providers and retention applicable to the service.

AI-assisted interpretation is part of the text-invoicing service. Only send information reasonably needed for the request. You may contact us about withdrawing consent and the resulting effect on service availability.

6. Who receives information

When a merchant authorises an invoice, we send it to the intended recipient and may copy the merchant's registered business email. The email may include the merchant's contact details for replies. Anyone who obtains a working invoice or preview link may be able to view its contents.

We use service providers for the following functions:

• Messaging and email delivery: relevant message or email content, contact details, consent information and delivery records.
• AI-assisted processing: relevant message, business and customer information and draft invoice details, as described above.
• Hosting and storage: account, message, invoice and operational records, documents and technical request information needed to run the service.
• Payments: purchase and payment details, optional card setup, payment verification, refunds and disputes.
• Analytics and security: technical and usage information needed to understand website activity, protect the service and prevent abuse.

Providers and their subcontractors receive information relevant to their functions. We require appropriate confidentiality, security and purpose limitations for processing on our behalf. Some providers also process information for their own lawful purposes, such as payment fraud prevention, service security and regulatory compliance, under their applicable privacy notices. Contact our privacy contact for current provider identities and further information about their processing.

Information may also be shared with authorised personnel or professional advisers, where reasonably necessary to investigate misuse or protect rights and safety, or as required or permitted by law. Information involved in a business transfer remains subject to applicable confidentiality, privacy and notice requirements.

We do not sell personal information or share it for third parties' own advertising or cross-context behavioural advertising. Mobile opt-in information and consent are not shared for other parties' marketing.

7. Processing locations and cross-border access

Information may be stored or processed in Canada, the United States and other countries used by our service providers and their subcontractors. It may be accessible to courts, law enforcement or national-security authorities under those countries' laws.

We use safeguards required by applicable law for service-provider processing and international transfers. Contact our privacy contact for information about providers, processing locations and applicable safeguards.

8. Links, device access and security

Invoice and preview links can allow access without a separate login. Keep them private and forward them only to intended recipients. Draft links may expire or become unavailable when a draft changes. Disabling a link cannot recall copies already downloaded or shared.

We use reasonable technical and organisational safeguards designed to protect information, but no system is completely secure. Ordinary SMS is not end-to-end encrypted, and others may gain access to a phone, email account or shared link. Notify us if your account or number is compromised.

We investigate security incidents and provide notices and assistance required by applicable law.

9. Cookies, analytics and third-party pages

Our website and service providers may use browser storage, scripts and similar technologies for functionality, analytics and abuse prevention. These can process the technical and usage information described above. Blocking necessary technologies may affect forms or payment functions.

Where required, we provide choices or obtain consent for these technologies and honour legally applicable opt-out preference signals. This policy does not itself provide consent for advertising tracking.

Third-party payment forms and external websites have their own privacy notices. We remain responsible for information under our control, but do not control an independent merchant's website or copies of invoices independently retained by others.

10. Retention, closure and deletion

We retain information for as long as reasonably needed for the purposes described here, considering account activity, transaction history, sensitivity, legal requirements and unresolved claims or security issues.

Account, message, draft and invoice records support the service and requested access to invoices. Financial and transaction records may need to be retained after account closure for accounting and dispute obligations. Consent and suppression records may be kept to demonstrate permission or prevent unwanted communications. Support, security and incident records are retained for their relevant purposes. Backups and provider systems may have separate deletion cycles.

We delete or de-identify information when no longer needed for a permitted purpose. Account closure or a deletion request does not require immediate deletion of every record. We limit retained information to its remaining permitted purposes and explain applicable exceptions when responding to requests.

Legal recordkeeping duties may limit deletion of issued invoices. Copies independently held by merchants or recipients are outside our sole control. Contact our privacy contact about closure, deletion or retention for a particular record.

11. Your choices and rights

Depending on applicable law and our role, you may request access, correction, deletion, information about use and disclosure, withdrawal of consent or restrictions on processing. Additional rights, including portability, appeal or particular opt-outs, apply where provided by law.

Send requests to hello@invoicepaw.com. We may reasonably verify identity or authority, protect other people's information and apply lawful exceptions. Authorised agents may act where permitted. For information processed for a merchant, we may coordinate with that merchant without limiting your right to raise concerns about our own processing.

Where PIPEDA applies, we ordinarily respond to written access requests within 30 days, subject to lawful extensions and notice requirements. Access is provided at minimal or no cost; we give advance notice of any proposed lawful charge. We follow other applicable deadlines where relevant.

Withdrawal of consent may affect services that need the information. We explain those consequences and do not unlawfully penalise privacy requests. Withdrawing optional marketing consent does not require giving up unrelated services.

Reply STOP or UNSUBSCRIBE to stop texts, HELP for help, or START to resume. We also handle other legally effective requests. SMS opt-out does not automatically close an account, delete records or cancel an already-authorised invoice or payment. Contact support for those requests. Receiving an invoice does not enrol a customer in our marketing list.

12. Children and sensitive information

Merchant accounts are intended for adults with legal capacity to enter business contracts. We do not knowingly enrol children as merchants. Contact us if a child supplied information without appropriate authority so we can address applicable requirements.

The service is not a specialised medical-records service. Do not provide unnecessary sensitive information. Business tax details and payment instructions should be limited to what is appropriate for the intended invoice.

13. Complaints and regional rights

Contact our privacy contact about concerns or to request review of a privacy-request decision. We investigate complaints and explain our response. You may also complain to the Office of the Privacy Commissioner of Canada or another regulator with jurisdiction.

Rights and obligations depend on the applicable law. We provide additional notices, choices, appeal procedures or protections where required.

14. Policy changes and contact

We update the effective date when this policy changes and provide notice of material changes and further consent where required.

Privacy contact: person responsible for privacy, RandomWalkr Technologies Inc.
Email: hello@invoicepaw.com
Mail: 18 King Street East, Suite 1400, Toronto, ON M5C 1C4, Canada