InvoiceSheet Lite

InvoiceSheet Lite Privacy Policy

Effective date: 8 October 2026. Last updated: 8 October 2026.

This is the privacy policy for InvoiceSheet Lite, the web app at https://invoicesheet.online. InvoiceSheet Lite converts invoices and receipts (PDF or images) into a spreadsheet you can download as CSV or Excel. The home page explains that purpose and lets you extract a file without an account. English is the official text of this policy. A Chinese translation is included on this page and is shown when you choose Chinese in the language control.

This policy describes the information we collect, how we use it, who we share it with, how long we keep it, and how you can ask us to delete it. It includes Google user data received when you choose Continue with Google.

1. Data controller and contact

Write to that address for access, correction, or deletion requests. We reply within 30 days.

2. Information we collect

We collect only what is needed to extract invoice fields, run optional Hosted AI, bill a subscription, or sign you in if you choose an account. You can use the rules mode and your own API key without creating an account and without Google.

Invoices you upload
PDF, PNG or JPG files (and the text or page images read from them). Used only to return a table for that request. Not stored after the request. Not sold. Not used to train AI models.
Google user data (optional)
Only if you choose Continue with Google. Scopes are openid, email, and profile. The data is your email address, name, profile picture, and Google account ID. See section 4.
Email and password account (optional)
If you register with email and password, Supabase Auth stores the email, a hashed password, and sign-in timestamps. At email sign-up only, a short-lived 6-digit confirmation code is emailed so we can confirm the mailbox.
Creem billing email
The email you enter at Creem checkout, plus license and subscription identifiers. We never see or store your card number.
Hosted AI content
When you use Hosted AI, invoice images and/or text from the file you uploaded are sent to the configured AI provider solely to return extracted fields for that request. Google user data is not included.
localStorage on this browser
License key, extract history, language, mode, trial counter, sign-in session, and BYOK settings, as described under Cookies and local storage.
Server logs
Request method, path, status code, and response time. Your IP address is used in memory for rate limiting. Our host may keep standard access logs.

3. Invoices you upload

  • You upload invoice or receipt files (PDF, PNG or JPG, one at a time, up to 15 MB). They may contain business details such as vendor names, addresses, tax IDs, and amounts.
  • PNG and JPG images are read in your browser. PDFs are sent to our server so it can read the text layer or render the pages as images. The file is processed in memory or a temporary folder and deleted as soon as the response is sent.
  • We do not keep copies of your files or of the extracted results on our servers, and we do not use them to train AI models.
  • For scanned files the browser may load open-source OCR and PDF libraries (Tesseract.js, PDF.js) from the jsDelivr CDN. They run locally. Your file is not sent to the CDN.

4. Google user data

Google Sign-In is optional. Rules extraction and your own API key work with no Google account. If you choose Continue with Google, sign-in is handled by Supabase Auth using Google as the identity provider.

We request only these OAuth scopes:

  • openid — to receive a stable Google account ID (the OpenID subject identifier) for that sign-in
  • email — to receive the email address of the Google account
  • profile — to receive the name and profile picture Google sends with basic profile

From those scopes, Google may share, and Supabase Auth may store, the following Google user data:

  • email address
  • name
  • profile picture
  • Google account ID

InvoiceSheet Lite uses the confirmed email address to start your session and to find a Hosted subscription purchased with that email. This browser stores the session tokens, that email, and the Supabase user id in localStorage (isl_auth) until you sign out. We do not copy your profile picture into our subscription database. We do not request Gmail, Drive, Calendar, Contacts, or any other Google data. We do not post to your Google account. We do not use Google user data for advertising, for credit decisions, or to train AI models.

InvoiceSheet Lite does not use Google APIs or user data for AI-generated or non-consensual intimate imagery (NCII); Google user data is not used to train AI models.

5. How we use information

  • Extract invoice fields from files you upload and return CSV or Excel.
  • Send invoice images or text to Hosted AI, or relay a BYOK request, only when you choose that mode.
  • Identify your account and look up a Hosted subscription when you sign in, including with Google.
  • Create and look up a Hosted subscription using the Creem billing email.
  • Enforce the free trial and the monthly fair-use cap, and prevent abuse.
  • Answer support and privacy requests sent to gyan71@outlook.com.

We do not sell personal data. We do not use your invoices or Google account data for advertising.

6. Google API Services User Data Policy and Limited Use

InvoiceSheet Lite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The policy is published at https://developers.google.com/terms/api-services-user-data-policy (Google API Services User Data Policy).

In line with Limited Use, InvoiceSheet Lite will:

  • Use Google user data only to provide the user-facing feature described in this policy: identifying your account and the Hosted subscription tied to your email.
  • Not transfer Google user data to others, except to the service providers needed to provide that feature (Supabase Auth stores the Google identity), for security, to comply with applicable law, or as part of a merger with notice as the policy allows.
  • Not allow humans to read Google user data unless you ask us to (for example a privacy request that includes your email), it is necessary for security, or the law requires it. We have no feature that shows Google profile data to staff for product improvement.
  • Not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
  • Not use Google user data to train generalized or non-personalized AI or machine-learning models.

7. How we share information

We do not sell personal data. We do not rent or trade it. We share it only with the processors below, or when the law requires it.

PartyWhat they receiveWhy
Supabase (Supabase Auth and the database) If you create an email account: email address, hashed password, sign-in timestamps, and a short-lived 6-digit confirmation code at sign-up. If you choose Continue with Google: email, name, profile picture, and Google account ID, plus session tokens. In the database: Creem billing email, license key, Creem customer and subscription IDs, subscription status, billing-period dates, Hosted AI usage counts, an anonymous trial browser id, and a salted hash of an IP address (never the raw IP). Optional sign-in, and to store the subscription and the fair-use counter. Supabase is a processor. Google user data is stored there only so the sign-in and the subscription lookup work.
Creem The billing email you enter at checkout, and payment details. Card numbers go to Creem and are not sent to us. We receive back the customer id, subscription id, status, and the checkout email. Creem is Merchant of Record. It collects applicable tax, charges the subscription, and issues the customer receipt.
Render The application server runs on Render. Uploaded PDFs are processed in memory or a temporary folder and then deleted. Render may keep standard hosting logs (IP address, URL, status, time). Host InvoiceSheet Lite and run extraction. Invoice files are handled there. A signed-in request also sends the session token so we can find the subscription. That token is not your profile picture, and Google user data is not included in the Hosted AI request.
AI providers used for Hosted AI Only when you run Hosted AI: the invoice text and/or invoice images for that one request, plus a prompt that asks for invoice fields. Not your Google email, name, profile picture, or Google account ID. As of the effective date the configured providers are OpenCode (https://opencode.ai) and, when image calls are routed separately, DeepSeek (https://api.deepseek.com) or another OpenAI-compatible provider we configure. Return the extracted invoice fields for that request. We do not send Google user data to these providers, and we do not use the invoice contents to train our own models.
Google If you choose Continue with Google, you authenticate on Google’s page. Google then provides the openid, email, and profile fields listed in section 4 to Supabase Auth. Optional sign-in. We do not receive Gmail, Drive, or other Google product data.
jsDelivr Your browser may download Tesseract.js and PDF.js. The invoice file is not sent to jsDelivr. Run open-source OCR and PDF rendering locally in the browser.

8. Your own API key (BYOK)

  • The API key, base URL, and model you enter are saved only in this browser’s localStorage. By default your browser calls your provider directly.
  • If your provider blocks browser requests and the relay option is on, the request (including your key) passes through our server once on its way to your provider. The relay does not log or store your key or the request contents.
  • What your provider does with the data is governed by your agreement with that provider. BYOK calls do not include Google user data.

9. Hosted AI

  • When you use Hosted AI (the free trial or the $9/month plan), the file — or the text and page images read from it — is sent through our server to the AI provider configured for that request, which returns the extracted invoice fields.
  • That request exists only to read vendor, date, amounts, and similar invoice fields. It is not used to generate images or other unrelated content.
  • Our server handles the request in memory or temporary storage and discards the file and the result once the response is sent.
  • We record minimal operational events such as processing time, token count, model name, and error type. These never include invoice contents, API keys, or Google user data. Those events are deleted after 90 days.

10. Cookies and local storage

We do not use advertising, analytics, or tracking cookies on invoicesheet.online. We use the browser’s localStorage (not first-party tracking cookies) so the app can remember your choices on this device:

  • History: extracted results are saved only in this browser’s localStorage (isl_history_v1). Delete them any time with “Clear history”. History does not include the original file bytes or API keys.
  • License: if you activate a Hosted license in this browser, the key is stored as isl_license.
  • Language (isl_lang), selected mode (isl_mode), anonymous client ID (isl_client_id), free-trial counter (isl_trial_used), sign-in session (isl_auth: tokens, your email, and user id, only if you sign in), and BYOK settings (isl_byok).
  • You can remove this data by signing out, using “Clear history”, or clearing site data in your browser settings.
  • Creem’s checkout and customer portal pages set their own cookies on Creem’s domain.

11. Retention

  • Uploaded files and extraction results on our servers: not kept after the request.
  • License and billing records, including the Creem billing email: while the subscription exists, and afterwards as long as needed for accounting and legal obligations.
  • Supabase Auth account (email, hashed password, or Google identity including name, profile picture, and Google account ID): until you ask us to delete the account, unless a longer period is required by law.
  • Operational events: deleted after 90 days.
  • Anonymous trial counters: kept to enforce the free-trial limit.
  • Browser localStorage: until you clear it or sign out.

12. How to request access, correction, or deletion

You can use InvoiceSheet Lite without an account. To access, correct, export, or delete personal data we hold (for example your license, billing email, or Supabase Auth account, including Google user data stored for that account):

  1. Email gyan71@outlook.com from the account email or the checkout email. Use the subject “Privacy request”.
  2. Say whether you want access, correction, a copy, or deletion, and include the email address on the account.
  3. We will confirm the request and reply within 30 days. For deletion we delete the Supabase Auth user (email, password hash or Google identity) and remove the link between that mailbox and the license where we are allowed to. Billing records that tax or accounting rules require us, or Creem as Merchant of Record, to keep are retained for that period and then deleted.
  4. Sign out in this browser and clear site data so localStorage (session, history, license key) is removed from the device. We cannot erase data that stays only in your browser until you do that.

You can manage or cancel a subscription at any time under “Billing & usage” → “Manage subscription” (Creem customer portal). Signing out ends the Google or password session in this browser.

13. Security

  • The site is served over HTTPS.
  • Passwords are stored only as hashes by Supabase Auth. Our subscription database does not store passwords or card numbers.
  • Uploaded invoices are processed in memory or a temporary directory and deleted when the response is sent.
  • BYOK API keys are not written to our logs. The optional relay does not store them.
  • Session tokens stay in this browser’s localStorage until you sign out or clear site data. Treat that browser profile as you would any signed-in device.

14. Children

InvoiceSheet Lite is meant for business and personal bookkeeping. It is not directed at children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, email gyan71@outlook.com and we will delete it.

15. International transfers

InvoiceSheet Lite is operated by an independent developer. Supabase, Render, Creem, and the Hosted AI providers may process information in the United States and in other countries where they operate. Those countries may not provide the same data-protection rules as your home country. We share data with those providers only as this policy describes, to run the service. By using InvoiceSheet Lite, or by choosing Google sign-in or a paid plan, you understand that your information may be transferred to those countries.

16. Your rights

Depending on where you live, you may have the right to access personal data we hold about you, correct it, delete it, receive a copy, restrict or object to certain processing, and withdraw consent for optional sign-in by signing out and asking us to delete the account. You may also lodge a complaint with a data-protection authority. To use these rights, email gyan71@outlook.com. We will not discriminate against you for making a request. We reply within 30 days.

17. Changes

If we change this policy, we update this page and the effective date above. Material changes are announced to subscribers by email. The version at https://invoicesheet.online/privacy.html is the current policy.

18. Contact us

Privacy questions and requests: gyan71@outlook.com

Product: InvoiceSheet Lite · https://invoicesheet.online

Back to the app