Effective 23 October 2026. This policy explains how Invoreg (“we”, “us”) handles personal data when you visit invoreg.com, contact us, book a demo, or use the Invoreg service. It is written for the EU General Data Protection Regulation (GDPR) and Malta’s Data Protection Act.
Who is responsible
The data controller for this website and for our marketing is MaltaCareersHub Ltd, which operates Invoreg AI: company number C 102947, VAT MT29473720, registered at 80 Vella Squared, Triq il-Fortizza, Mosta MST 1885, Malta. Contact: hello@invoreg.com.
For documents that accounting firms and their clients upload to the Invoreg service, the firm is the data controller and Invoreg is a data processor acting on the firm’s instructions under a data processing agreement (DPA). A DPA is available on request.
What we collect and why
| Situation | Data | Purpose | Legal basis | Kept for |
|---|---|---|---|---|
| You visit the site | IP address, browser and device type, pages viewed, referrer (server logs) | Run and secure the site | Legitimate interest (Art. 6(1)(f)) | Logs 30 days |
| You accept cookies | Pages viewed, clicks on buttons and forms sent, device and approximate location, and whether you arrived from one of our Google or LinkedIn ads (Google Analytics, Google Ads measurement and the LinkedIn Insight Tag) | Understand which pages and ads help firms decide; show our ads on LinkedIn to people who visited the site | Consent (Art. 6(1)(a)), withdrawable at any time | Google Analytics: up to 14 months; Google Ads and LinkedIn: under their own retention rules |
| You book a demo or contact us | Name, work email, company, country, accounting software, invoice volume, preferred time, your message, and how you reached us (for example the Google ad and search term, or the referring website), read from the page address when you send the form | Reply to you, arrange the demo, follow up about Invoreg; see which ads and pages bring enquiries. If you came from a Google ad, accepted cookies, and later become a customer, we send Google Ads only that ad's click ID and the date, so Google can count the ad as having worked; never your name, email or company | Steps prior to a contract at your request (Art. 6(1)(b)); consent for follow-up marketing where you tick the box (Art. 6(1)(a)); legitimate interest for knowing how you reached us (Art. 6(1)(f)) | Until the enquiry is closed, then up to 24 months unless you become a customer |
| You use the Invoreg service | Account details (name, email, role), organisation settings, activity logs | Provide the service, secure accounts, support | Contract (Art. 6(1)(b)) | Life of the account plus 12 months |
| Documents you upload to the service | Supplier invoices and other documents, which may contain names, addresses, bank details and VAT numbers of third parties | Read, classify and register documents as instructed by your firm | Processed on the firm’s behalf under the DPA; the firm holds the legal basis | As set by the firm; deleted documents are recoverable for the retention period the firm sets, then removed |
We do not sell personal data, and we do not use your documents to train AI models.
Where data is processed
Documents and account data are processed on Invoreg infrastructure located in the European Union. Invoice content is processed and stored in EU regions only. If a sub-processor outside the EU is ever used (for example for email delivery), transfers rely on the European Commission’s Standard Contractual Clauses and are listed in the sub-processor list available on request.
Sub-processors
We use a small number of service providers to run the site and service: hosting and content delivery (Vercel), transactional email (Resend), website analytics and ad measurement (Google and LinkedIn, only if you accept cookies), and the accounting integrations you connect (via OAuth with the minimum scopes needed to read master data and post bills). A current list with locations is available on request and will be published here before launch.
Cookies
When you first visit, a notice asks whether you accept cookies. Nothing below is set unless you choose Accept; Essential only keeps them off.
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
_ga, _ga_* |
Google Analytics | Count visits and see which pages are useful | Up to 2 years |
_gcl_* |
Google Ads | See whether a visit that came from one of our ads led to a demo request | 90 days |
li_fat_id, li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory |
LinkedIn Insight Tag | Measure visits from our LinkedIn ads and show our ads on LinkedIn to people who visited the site | From 24 hours (lidc) to 1 year (bcookie) |
We use Google Consent Mode. The Google tag loads for every visitor, but until you choose Accept it sets no cookies and stores nothing on your device. In that state it sends Google limited signals without cookies (for example that a page was viewed or a form was sent, the time and the browser type), so Google can estimate totals without identifying you. If you accept, Google Analytics and Google Ads measurement may set the cookies above and share data with Google, which acts under its own terms. The LinkedIn Insight Tag is not loaded at all until you choose Accept. If you accept, it may set the cookies above, LinkedIn may show you Invoreg ads on LinkedIn, and we see aggregate reports (for example job functions and industries of visitors) but never who you are. We don't use your visit for ads on any other site, and the site works the same either way. Your choice is stored in your browser. To change it at any time, use Cookie settings at the bottom of every page.
Strictly necessary cookies may be set by the hosting platform for security. Videos use YouTube's privacy-enhanced no-cookie domain.
Your rights
Under the GDPR you can ask us to access, correct, delete or restrict your personal data, object to processing based on legitimate interest, and receive a copy in a portable format. Where processing relies on consent, you can withdraw it at any time. Write to hello@invoreg.com; we respond within one month. If you are unhappy with our answer you can complain to the Information and Data Protection Commissioner in Malta (idpc.org.mt) or your local supervisory authority.
For documents processed on behalf of an accounting firm, please contact that firm first; we will assist them in meeting your request.
Security
Access to the service is role-based and every action on a document is logged. Data is encrypted in transit and at rest. Integration tokens are stored encrypted and can be revoked from the connected accounting system at any time. We notify affected firms of a personal data breach without undue delay, as the DPA requires.
Marketing email
We send marketing email only with prior consent, which is required in Malta for unsolicited email to businesses as well as individuals. Every email includes an unsubscribe link, and we keep a suppression list so you are not contacted again.
Changes
We will post changes here with a new effective date. Material changes affecting customers are notified by email.