What we collect, and why.

This describes what HalechilabsX collects and does with data when you use Invoillo — as a business owner with an account, and on behalf of the clients you invoice through it. It's a plain-English description of our actual practices, not a template, and not legal advice.

Account: your email, and whatever you add in Settings — business name, sender name, reply-to address, phone/address if you choose to enter them, and your payout destinations (a USDT wallet address and/or a PayPal address/email).

What you enter about your clients: name, email, phone number if you add it, and the invoices, amounts, and due dates you create. This is the data Invoillo exists to help you act on — we don't collect anything about your clients beyond what you give us.

Files you upload: invoice attachments, and proof-of-work or proof-of-payment files if you or a client use those features.

We don't run analytics or advertising trackers, and we don't use cookies for anything beyond keeping you signed in.

When a client opens a Hallett pay link, we log that the link was viewed and, if they use it, whatever they submit: a payment-confirmation note and an optional proof file. We don't ask for or store anything else about them — no account, no tracking across visits, no data sold or shared beyond what's needed to show them the invoice they're paying.

If a client pays via USDT, we read the public Tron blockchain to confirm the payment landed — that's a public ledger, not something we're granted special access to, and we only ever check for transactions to your own wallet address, not anyone else's.

Supabase hosts our database, file storage, and authentication. Resend sends the emails Invoillo sends on your behalf. Google's Gemini API drafts chase-email copy and recommends what action to take on an overdue invoice — it receives the invoice facts needed to do that (amount, days overdue, prior reminder count) and returns text; it does not receive your full client list or account details, and it never decides whether something is paid.

TronGrid (a public blockchain data provider) is queried to check whether a payment arrived — we send it a wallet address and an amount to check for, nothing about you or your client.

We don't sell data, and we don't share it with anyone for their own marketing purposes.

We never see or store card details, because we don't process cards. Crypto payments happen wallet-to-wallet on a public blockchain; we only read that ledger to confirm a transaction landed, and only for wallets you've entered yourself.

PayPal payments are manual and happen entirely outside Invoillo — we store only whatever confirmation note or file your client chooses to submit.

Your invoices, client data, and chase history are kept for as long as your account is active, so the app keeps working correctly. Deleting your account removes it from our live systems within 30 days.

To delete your account or request a copy of your data, email the HalechilabsX team — signed-in users can also reach us directly from the app's Feedback box.

Data is access-controlled per account at the database level (row-level security), so one user's data isn't reachable by another. File uploads (attachments, payment proofs) are stored privately and served only via short-lived signed links, not public URLs.

If we materially change what we collect or how we use it, we'll email subscribers before the change takes effect — same as we do for the contract policy.

Questions about this policy, or a data deletion request, go to the HalechilabsX team — signed-in users can also send them straight from the app using the Feedback box.