Privacy Policy

Invory ("Invory," "we," "us") provides offline-first inventory and point-of-sale software for retail businesses. This Privacy Policy explains what information we collect, why, and how it's used and protected when you use the Invory app, dashboard, or public storefronts hosted on Invory ("the Service").

Invory sits in two different roles at once, and it matters which one applies to a given piece of data:

• For your own account details as a business owner or staff member, Invory is the data controller — we decide how that information is used, as described below.
• For information a business collects about its own customersthrough Invory (a sale recorded with a customer's name, a credit balance, an order placed on a business's storefront), the business is the data controller and Invory is the data processor— we store and process that information only on the business's instructions, to provide the Service to them.

1. Information We Collect

Account information. Full name, email address, phone number, and password (stored in hashed form, never in plain text) when you sign up or are invited to join a business.

Business information. Business name, category, address, currency, logo, and — if a business enables bank-transfer ordering or custom receipts — bank account details and phone numbers the business chooses to display to its own customers.

Data processed on behalf of a business (its customers' information).If a business enables customer-details capture at checkout, or records a credit sale, or a shopper places an order through a business's public storefront, we store the customer name, phone number, and transaction details the business or their customer provides. This data belongs to, and is controlled by, the business — Invory processes it only to provide the Service.

Payment information.Subscription payments are processed by Paystack. Invory does not collect or store your card number, CVV, or full bank credentials — Paystack handles that directly, and shares with us only what's needed to activate your subscription (amount paid, plan, a payment reference).

Device and technical information.IP address, browser/device type, and — if you enable them — push notification subscription details, so we can send you alerts (e.g. low stock, daily summary) to that device. Invory is built to work offline: product, stock, and sales data is also cached locally on your device (in your browser's storage) so you can keep working without a connection; that local copy syncs back to our servers once you're online again.

Cookies. We use strictly necessary cookies to keep you signed in and to remember which business workspace you last used. We do not use third-party advertising or tracking cookies.

2. How We Use Information

• To create and maintain your account and business workspace.
• To provide the core Service: inventory tracking, sales recording, staff management, reporting, and (where enabled) a public storefront for your business.
• To process subscription payments and communicate about your billing status.
• To send transactional notifications you've enabled (low-stock alerts, daily summaries, staff invitations, order notifications).
• To provide customer support, including when you contact us directly through the Service.
• To detect, investigate, and prevent fraud, abuse, or security incidents.
• To comply with legal obligations.

We do not sell personal information, and we do not use it to serve third-party advertising.

3. Who We Share Information With

We share information with the service providers who help us run Invory, and only to the extent needed for them to do that:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Paystack — payment processing for subscriptions and, where enabled, storefront orders.
• Resend — transactional email delivery (password resets, invitations, notifications).
• Web push notification services provided by your browser vendor (e.g. Google, Apple, Mozilla), used only to deliver the push notifications you've enabled.

We don't share your information with anyone else for their own marketing purposes. We may disclose information if required by law, or to protect the rights, property, or safety of Invory, our users, or the public.

If you are a staff member of a business on Invory, that business's owner can see the data you enter through the Service (sales, stock changes you record, etc.) as part of normal business operations.

4. Data Retention

We keep account and business data for as long as your account is active, plus a reasonable period afterward to comply with legal, accounting, or dispute-resolution obligations. Sales and stock-movement records are kept as a permanent transaction history by design — this is what makes the Service's reporting and audit trail reliable, so individual records aren't deleted on request, though a business can correct mistakes going forward (for example, voiding an accidental sale).

5. Your Rights

Depending on your location and applicable law (including Nigeria's Data Protection Act, 2023), you may have the right to access, correct, or request deletion of your personal information, object to or restrict certain processing, and request a copy of your data in a portable format. To exercise any of these rights, contact us at the address below. If a request concerns data a business collected about its own customer (a sale, a storefront order), we'll direct you to that business, since they control that data — we'll assist them in fulfilling it.

6. If You're a Business Using Invory

When you collect your own customers' information through Invory — names and phone numbers at checkout, credit/debtor records, storefront orders — you are that data's controller under applicable data protection law, and you're responsible for having a lawful basis to collect it and for honoring your own customers' rights over it. Invory processes it on your behalf and secures it, but the underlying legal responsibility to your customers is yours.

7. Security

We use industry-standard safeguards — encryption in transit, access controls scoped so one business can never see another's data, and hashed password storage — to protect information on Invory. No system is completely secure, and we can't guarantee absolute security, but we work to protect your data and will notify affected users if we become aware of a breach affecting their personal information, as required by law.

8. International Data Transfers

Invory's infrastructure providers (Supabase, Vercel) may process and store data outside Nigeria. Where this happens, we rely on those providers' own security and compliance safeguards for cross-border data transfer.

9. Children's Privacy

Invory is a business tool and is not directed at, or knowingly used by, children. We do not knowingly collect personal information from anyone under 18.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly.

11. Contact Us

Questions about this Privacy Policy or your data can be sent to support@contact.invory.online.