Privacy Policy

Who we are

Elnivo is an invoicing service run by Elnivo Solutions (SSM 202603291654 (003905841-X)), a sole proprietorship in Malaysia owned by Chin Chee Hoe, of Lot AL 250D, Kampung Baru Sungai Buloh, 47000 Sungai Buloh, Selangor, Malaysia ("we"). This policy explains how we handle personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). Contact us at support@elnivo.app. This policy is also available in Bahasa Malaysia. If the versions differ, the English version applies. Our Terms of Service apply to your use of Elnivo.

What we collect

• Account details: your email address, a securely hashed password, your user ID and your plan. Guests use an anonymous session with a user ID and no email.
• If you continue with Apple or Google: the account ID that service gives Elnivo, your email address, and your name if you choose to share it. With Apple's Hide My Email, we get an Apple relay address instead of your own, and emails we send to it reach you through Apple. We don't post to, or read anything else from, your Apple or Google account.
• Business details: your business name, address, phone number, email, website, registration and tax numbers, payment details and logo.
• Payment details: the bank details, payment links, payment QR images and other payment instructions you choose to show on your invoices. Elnivo only prints them on your documents: it doesn't process payments, store card numbers, or open, check or contact the payment services you link to. QR codes for your payment links are made by Elnivo.
• Your records: customers (including their names, contact people, phone numbers, emails, addresses, and registration and tax numbers), items, invoices, receipts, payments, notes and attachments (images and PDFs).
• Activity history: actions on your documents, such as when they were issued or shared and by which method, and when your business last used Elnivo.
• Technical data: sign-in cookies, IP addresses, server logs and, for bot protection, browser or device signals read by Cloudflare, used to run and protect the service.
• Messages you send us, such as support emails and Pro access requests.

Why we use it

• To provide Elnivo: creating and storing your documents, and preparing them for you to share.
• To send service emails, such as confirming your email or resetting your password.
• To keep the service secure, limit abuse, fix problems and improve it.
• To answer you and to manage your plan.
• To meet our legal obligations.

We don't sell personal data, show advertising or use advertising trackers. Giving us your email is needed for an account. Without it you can only use Elnivo as a guest.

Your customers' data

When you enter details about your customers, you decide what is collected and why, and you are responsible for having the right to use it. We handle it on your behalf to provide the service.

Sharing your documents

• You send documents yourself. Send / Share gives you the PDF through your device's share options, or opens WhatsApp or your email app with a message you can edit. That message includes the customer's name and the document's number and amount, and for invoices any due date and Pay now link. Download PDF saves a copy.
• Elnivo doesn't send documents to your customers and has no public share links. Inside Elnivo, a document's PDF only opens for someone signed in to your business.
• Apps you choose to share with handle what you send under their own terms.
• We record that a document was shared or downloaded, and by which method, in its activity history. We don't know whether your customer received it.
• We can't recall a copy once you have sent it. Voiding an invoice or deleting your account doesn't remove copies your customers already have.

Where data is stored and who helps us

Your database and files are hosted in Singapore, outside Malaysia. By using Elnivo you understand that data is transferred there and to the providers below, each only as needed for its service:

• Supabase: database, sign-in and file storage (Singapore).
• Vercel: application hosting (processing in Singapore; content delivery worldwide).
• Resend: sending service emails (Japan).
• Cloudflare: domain, email forwarding and bot protection.
• Google: our support inbox, for messages you send us; and Continue with Google, if you use it.
• Apple: Sign in with Apple, if you use it.
• Sentry: error monitoring, set up to leave out invoice contents, names, emails and tokens.
• RevenueCat: managing App Store subscriptions (purchase status only; no card details) (United States).

How long we keep it

• Guests: a guest who doesn't create an account and hasn't used Elnivo for 30 days is permanently deleted, with their data and files. Clearing browser or app data also loses access to guest invoices.
• Accounts: we keep your data while your account is open.
• Deleting your account: deletion happens 30 days after you request it, and you can cancel until then. Your data and files are then deleted.
• Backups: deleted data can remain in backups for up to 7 days.
• Abuse-protection counters that include IP addresses are normally deleted within about a day.
• Support emails: kept as long as needed to handle your request, then deleted within 2 years.
• Pro access requests: kept with your business's data and deleted with it.

Your choices and rights

• Access and correct: most details can be changed in the app. You can also ask us for access to, or correction of, your personal data.
• Export: account holders can download their data from Account → Export My Data.
• Delete: use Account → Delete Account. Export first, because you are responsible for keeping any records the law requires. If you use Sign in with Apple, deleting your account also removes Elnivo's access to your Apple ID.
• Disconnect Apple or Google: remove Elnivo in your Apple ID settings (Sign in with Apple) or your Google account (Third-party connections). Keep a password on your Elnivo account first if you still want to sign in.
• Withdraw consent or limit processing: email us. We may then be unable to provide some or all of the service.

Email support@elnivo.app for any of these. You can also complain to Malaysia's Personal Data Protection Commissioner.

Users outside Malaysia

This section also applies if you are in the EU, the UK or another place whose data protection law applies to our handling of your data.

• Legal bases: we rely on performing our contract with you, our legitimate interests in keeping the service secure and improving it, our legal obligations, and your consent where we ask for it.
• Extra rights: where your local law gives them, you can also ask for a portable copy of your data, object to our processing, or ask us to erase your data or restrict its processing. Email us to use them.
• Complaints: you can complain to your local data protection authority.

The iOS app

This section applies if you use the iOS app.

• App Store purchases are processed by Apple, and subscriptions are managed through RevenueCat. We receive purchase status, not card details.
• The app may send crash and diagnostic data through Sentry, with the same scrubbing: invoice contents, names, emails and tokens are left out.

Cookies

We use only the cookies needed to keep you signed in and keep the service secure. They aren't used for advertising.

Security and incidents

We use encrypted connections, private file storage and access rules that keep each business's data separate. No service is perfectly secure. If a data breach affects you, we will notify you and the authorities where the law requires it.

Age

Elnivo is for people aged 18 or over who use it for business.

Changes

We will post changes here and tell account holders about important ones before they take effect.