Privacy Policy

Last updated: August 2026

1. Who Controls Your Data

Cake Invoicing is operated by Cake Invoicing, LLC, a limited liability company registered in the State of Iowa, United States. For the purposes of the UK and EU GDPR, Cake Invoicing, LLC is the data controller for the personal data described in this policy. You can reach us about anything on this page at support@cakeinvoicing.com.

One exception is worth naming up front: for the sale of a subscription, our payment provider Polar acts as the merchant of record and is a controller of your billing data in its own right. Section 4 explains what that means in practice.

2. Information We Collect

Account information. Your name, email address, company name, address, and phone number, provided when you create an account or update your profile.

Content you enter. The data you put into the service while using it: client details, task records, invoices, and payments you record against them. Client records contain personal data about other people, and you are responsible for having a lawful basis to enter it. Section 10 covers that.

Billing information. Handled by Polar, not by us. We never see or store your card number. What we keep is the customer and subscription identifiers Polar gives us, the billing email held on your Polar account, and your subscription status and renewal date, which is what tells the app whether your account is active.

Email delivery records. When we send mail on your behalf or to you, we record the recipient address, subject, and whether the message was sent, delivered, bounced or opened. This is how we keep invoice email working and detect deliverability problems.

Support conversations. Messages you send through the in-app helper, kept so we can answer you and refer back to the thread.

Technical information. IP address and request data processed by our hosting provider, and aggregate page analytics described in section 6.

Free invoice generator submissions. If you use the free generator at cakeinvoicing.com without an account, see section 7, which covers that separately.

3. How We Use Your Information, and Our Legal Basis

To provide and maintain the service, including storing your work, generating invoice PDFs and sending them. Legal basis: performance of our contract with you.
To authenticate you by sending magic-link sign-in emails. Legal basis: performance of our contract.
To take payment and manage your subscription. Legal basis: performance of our contract.
To send service and account notices, such as subscription and renewal notices, and important changes to this policy or our terms. Legal basis: performance of our contract, and our legitimate interest in keeping you informed.
To send marketing communications. Legal basis: your consent, which you can withdraw at any time in Settings without affecting your account.
To keep the service secure and reliable, including rate limiting, abuse prevention, error diagnosis and an internal record of administrative actions. Legal basis: our legitimate interest in protecting the service and its users.
To meet tax, accounting and other legal obligations. Legal basis: compliance with a legal obligation.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We do not use your content to train machine learning models.

4. Payments and the Merchant of Record

Subscriptions are sold and processed by Polar Software, Inc., which acts as the merchant of record and authorized reseller for Cake Invoicing. When you subscribe, you complete checkout on Polar’s hosted page and your payment details go to Polar and its payment processor, Stripe. They never pass through our servers, and we have no access to your card number.

Polar processes your name, billing email, billing address, payment method and transaction history as a controller for the purposes of taking payment, issuing receipts, and calculating and remitting sales tax and VAT. Its handling of that data is governed by Polar’s own privacy policy at polar.sh. What comes back to us is limited to the identifiers and subscription status described in section 2, which is all the app needs in order to know whether your account is active.

5. Service Providers

We rely on a small number of vetted providers to operate Cake Invoicing. Each processes data only on our instructions or, where noted, as a controller in its own right, and each is bound by its own security and privacy commitments.

Vercel (United States): application hosting, content delivery and privacy-friendly analytics.
Managed database hosting (United States): the Postgres database where your account and content are stored.
Resend (United States): transactional and invoice email delivery.
Polar Software, Inc. and its processor Stripe (United States): checkout, payments, receipts and sales tax, as merchant of record.

If we add or replace a provider we will update this list. If you are a customer and need our database provider identified for your own compliance records, contact us at support@cakeinvoicing.com. We do not disclose your data to anyone else except where we are legally required to, or to protect our rights or the safety of others.

6. Cookies, Local Storage and Analytics

We use no advertising cookies and no third-party tracking cookies. What we do use is limited to the following.

A session cookie, set when you sign in, that keeps you signed in. Strictly necessary; the service cannot work without it.
A short-lived support cookie, set only when a member of our team views your account in read-only support mode, as described in section 8. Strictly necessary.
Local storage in your browser, holding interface preferences such as your light or dark theme choice. This never leaves your device.

For analytics we use Vercel Web Analytics and Vercel Speed Insights. Both are cookieless, both measure page views and loading performance in aggregate, and neither builds a profile of you or follows you across other websites.

7. The Free Invoice Generator

The free invoice generator is open to visitors with no account, and it works differently from the rest of the service, so it gets its own section.

Everything you type into the generator stays in your browser until you ask to download the PDF. At that point we ask for a phone number, and optionally an email address, and we record that contact information along with a copy of the invoice you generated, your IP address, and any campaign parameters in the link that brought you to the page.

We use that contact information to send you a copy of your invoice if you gave us an email address, and to contact you, including by phone, about Cake Invoicing. Our legal basis is our legitimate interest in marketing our own service to a business that has just used it. You can tell us to stop at any time by replying to a message or emailing support@cakeinvoicing.com, and we will remove your details. We do not sell or share this information with anyone outside the providers listed in section 5.

Generator submissions are cleared on a rolling basis by age. Using the generator does not create an account and does not sign you up for anything.

8. Support Access to Your Account

So that we can help when something goes wrong, a member of our team can open your account in a read-only support mode. It shows us what you see and permits no changes: nothing can be created, edited or deleted while it is active. Every use is recorded in our internal log with who did it and when.

9. Data Storage, Security and International Transfers

Your data is stored in a managed, access-controlled database and transmitted securely using HTTPS/TLS. We implement appropriate security measures including input validation, rate limiting, role-based access controls and encrypted, regularly tested backups. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority without undue delay, as the law requires.

We are based in the United States and our providers are listed in section 5. If you are in the UK or the European Economic Area, your personal data is transferred to and processed in the United States. Where required, those transfers rely on the Standard Contractual Clauses approved by the European Commission, or an equivalent safeguard, as set out in our agreements with each provider.

10. Your Clients’ Data

When you enter client records into Cake Invoicing you are the controller of that personal data and we process it on your behalf, on your instructions, for as long as your account exists. We do not use it for any purpose of our own. You are responsible for having a lawful basis to enter it and for answering any request your clients make about it, and the export and deletion tools in Settings are there to help you do that.

11. Data Retention

We retain your account and content for as long as your account is active. When you delete your account from Settings, your profile, clients, tasks, invoices, payments, reminders, support messages and email delivery records are permanently deleted from our database. This is immediate and cannot be undone, so export your data first if you want to keep it.

Two things deliberately survive that deletion. An entry in our internal administrative log records that the deletion happened, which we keep as a security and compliance record; it is disconnected from your account and holds only the fact of the action and the email address it applied to. Separately, Polar retains the transaction records for any payment you made, because it is legally obliged to keep them for tax purposes; that retention is governed by Polar’s privacy policy, not this one.

Expired authentication tokens and free generator submissions are purged automatically on a rolling basis by age.

Free accounts that never subscribe are also removed on a schedule: once an account has gone 90 days without a sign-in, we may delete it and its content the same way. We keep your email address, your marketing consent choice, and the date the account was last used, so that we can honour the one-allowance-per-customer rule in our Terms and, only if you consented, tell you about the product later.

12. Your Rights

Wherever you live, you can exercise the following rights, and we will not treat you differently for doing so.

Access the personal data we hold about you, and export your full account in machine-readable JSON from Settings
Rectify inaccurate data, by editing your profile in Settings
Erase your data, by deleting your account from Settings, subject to section 11
Port your data, using the same JSON export, which is re-importable
Object to or restrict processing we carry out on the basis of our legitimate interests
Withdraw consent for marketing communications at any time, in Settings, without affecting your account

We do not sell or share personal data as those terms are defined under California law, so there is nothing to opt out of. If you are in the UK or the EEA you also have the right to lodge a complaint with your local supervisory authority. We would appreciate the chance to resolve it with you first.

To exercise any right that is not self-service, email support@cakeinvoicing.com and we will respond within one month.

13. Children

Cake Invoicing is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to This Policy

We may update this policy from time to time. The date at the top of this page always reflects the current version, and if a change materially affects your rights we will tell you by email before it takes effect.

15. Contact

For privacy inquiries or to exercise your data rights, contact us at support@cakeinvoicing.com. For questions about payments, receipts or billing data specifically, you can also contact Polar, the merchant of record, at support@polar.sh.