Privacy

Last updated 16 October 2026.

JobInvoicer is used by contractors to bill their own customers. That means there are two kinds of people here: the contractor who signs up, and the customer they invoice. Most of the information in the system is about the second, entered by the first.

What is stored

• Your account. Name, email address, the address you work from, and a password that is stored only as a hash. We cannot read the password, and neither can anyone who takes a copy of the database.
• Your customers. Whatever you enter: name, email, phone, billing and service address.
• Your work. Jobs, quotes, invoices, line items, payments and statements.
• Photos you attach to a job. These are resized on upload and their location metadata is stripped before they are saved, so a photo of a driveway does not carry that driveway's coordinates.
• Messages you send to a customer, and their replies once they come back to you.
• Text messages. Not what was said — no text's content is ever stored, in or out — just that one went out or came in, when, and what it cost. Separately, for every opt-in: the phone number, when, which of the two ways it happened (submitted on our public opt-in page, or given directly to a business at the time of service), the exact disclosure text shown at that moment, and, for a web opt-in, the IP address it was submitted from. That record is kept so it can be produced if a carrier ever asks for proof of consent.

Checking an account is not a second one

The free plan is one per business, so when somebody signs up we check whether the account already exists. Doing that means keeping a little more than the form asks for, and it is only fair to say what.

• A simplified copy of your email address, used only for comparing. Capital letters, dots and anything after a + are removed on the providers that ignore them, so one mailbox cannot become several accounts. The address you actually typed is what we keep and what we write to.
• A simplified copy of your business address, in the same way — punctuation and spelling of "Street" against "St" folded together, house and unit numbers untouched.
• The network address and browser you signed up from, and a record of sign-ups that were refused as automated. Kept for seven days, then deleted.

A second account at an address we already have is not refused. It is flagged for a person to look at, because two businesses genuinely do share a yard, an office or a family home. Nobody is turned away by a comparison alone.

None of this is used for advertising, sold, or shared. It exists to keep one free plan from becoming five, and for nothing else.

Who else sees it

Five services, each for one job:

• SocketLabs delivers the email. Anything you send to a customer passes through them.
• An AI service reads a sample when you import a customer list. To work out which column is which, the first five rows of your file are sent along with the header — and those rows contain real customer details. If you would rather that did not happen, map the columns by hand instead of importing. Questions you type into the in-app Help box are also sent there to be answered.
• Authorize.Net handles card payments once you are set up to take them (see Terms for how that account is boarded). Card numbers are never sent to or stored on this server; what is kept is a reference held by the gateway.
• Telnyx sends and receives your texts. The message itself passes through them and is not kept on our end; see "What is stored" above for what we do keep.
• The phone carriers (via Telnyx), when you turn texting on. Registering a number to send business texts requires giving them your business's legal name and EIN exactly as they appear on your IRS documents, your business address, and a contact — the carrier checks this against IRS records before your number is allowed to send. We do not store your EIN; it is collected directly from you when we submit the registration and is not kept in this app's database afterward.

We do not share mobile phone numbers or SMS consent data with third parties or affiliates for marketing purposes. Telnyx and the phone carriers above see a number only to the extent carrying and delivering your own text requires it — not to advertise to it, sell it, or hand it to anyone else's marketing list.

Opening a merchant account through our processing relationship (see Terms) involves its own underwriting — things like banking details and identity verification for whoever owns the business. That is handled directly between you and the processor as part of boarding, not entered into or stored by this app; what we keep afterward is only the API credentials that let this app talk to your account, encrypted before storage (see Security below).

Nothing is sold, and nothing is handed to advertisers. There are no advertising trackers on this site.

Cookies

One session cookie, so the site knows you are signed in. No analytics cookies and no third-party tracking.

Getting a copy, or getting it deleted

Ask, and your account and everything in it will be exported or deleted. Deleting a business account deletes its customers, invoices, photos and messages with it. Bear in mind that an invoice is also a business record you may be required to keep for tax purposes — export before you delete.

If we close an account — because it is a duplicate, or its address was never confirmed, or our terms were broken — nothing is deleted at that point. It stays until you ask for it, so you can still get your invoices and customer list out. Ask for it to be removed instead and it will be.

If you are a customer of a contractor who uses JobInvoicer, your details were entered by that contractor and belong to their account. Ask them first; we will help them action it.

Your texting number and your merchant account are yours, not something deleting your JobInvoicer account can take with it. If you leave, ask and we will help you move either one out rather than lose it.

Law enforcement and legal requests

We do not hand out account information as a matter of course. If we are legally required to — a subpoena, a court order, or similar — or if we believe in good faith that it is necessary to investigate fraud, a security incident, or an attack on the service, or to protect the safety of someone using it, we will disclose what is actually needed to deal with that, and no more. Where we are legally able to tell you first, we will.

Security

The site is served over HTTPS. Passwords are hashed. Gateway credentials are encrypted before storage. This is a small operation, not a company with a security department, and it would be dishonest to imply otherwise.