InvoiceLead Privacy Policy
This English version is provided for convenience. In case of discrepancy, the German version prevails.
Version of 13 October 2026.
1. Controller
Quantum Liquid LLC, a company governed by the laws of Wyoming, 30 N Gould St, Sheridan, WY 82801, United States of America, operates the InvoiceLead service ("InvoiceLead" or "the Service"). Contact for any question relating to personal data: support@invoicelead.io.
This policy applies under the Swiss Federal Act on Data Protection (FADP) and, for persons located in the European Union or the EEA, under the General Data Protection Regulation (GDPR).
2. Data subjects
- Registered users ("Users"), who sign in to InvoiceLead with their Lead Account.
- The customers, suppliers and contacts of Users, whose data appear in quotes, invoices and accounting entries ("Business Data").
- Visitors to the invoicelead.io website.
3. Data processed
3.1 Account
InvoiceLead does not manage passwords. Sign-in takes place through the Lead Account, the identity service shared by the Lead applications and operated by Quantum Liquid LLC (erplead.io). InvoiceLead receives and stores: the Lead Account identifier, email address, name, language, organisation and role, the InvoiceLead plan and the associated entitlements.
3.1a Subscription
For an InvoiceLead subscription (Pro, Pro+), payment goes through Stripe. Stripe receives the organisation's name, the email address of the administrator who subscribes, the billing address, any VAT number and the card details, entered at Stripe. InvoiceLead stores the Stripe customer and subscription identifiers, the plan, the period, the status and the end date, and reports them to the Lead Account. InvoiceLead stores no card data.
3.2 Business Data
Details of customers and suppliers, quotes, invoices, payments, accounting entries, VAT returns and supporting documents entered by the User. For these data, the User is the controller and InvoiceLead acts as processor, in accordance with the Data Processing Agreement (DPA).
3.3 Technical data
Security logs (date, action, IP address of the request) and an audit log of sensitive actions (sign-in, issuing of a document, change of settings).
As at the date of this version, InvoiceLead uses no audience measurement tools and no advertising cookies.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service (account, quotes, invoices, accounting) | Performance of a contract (GDPR art. 6(1)(b)) |
| Security of the Service, abuse prevention, audit log | Legitimate interest (art. 6(1)(f)) |
| Legal obligations (accounting, requests from authorities) | Legal obligation (art. 6(1)(c)) |
| Processing of Business Data on behalf of the User | Processing on behalf (art. 28 GDPR, art. 9 FADP) |
5. Retention periods
- Account: for as long as the Service is used, then deletion 30 days after closure, unless a legal obligation applies.
- Business Data: for as long as the User keeps them. The User remains required to retain their books and supporting documents for ten years (art. 958f CO); InvoiceLead provides a complete export before any closure.
- Sessions: 12 hours. Security logs: 12 months. Audit log: for as long as the organisation's data are retained.
6. Processors and hosting
| Processor | Role | Location |
|---|---|---|
| Vercel Inc. | Application hosting | United States (Cleveland, Ohio) |
| Neon (Databricks, Inc.) | Database | United States (AWS us-east-2, Ohio) |
| Stripe, Inc. | Collection of InvoiceLead subscription payments | United States |
Any change to this list is announced at least 30 days in advance.
7. Transfers abroad
The data are hosted in the United States, where the company is also established. Transfers are based on the providers' participation in the Swiss-U.S. and EU-U.S. Data Privacy Framework where available and, failing that, on the standard contractual clauses of the European Commission, recognised by the Federal Data Protection and Information Commissioner (FDPIC). The data are encrypted in transit and at rest.
8. Rights of data subjects
Any person may request access to their data, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interest. Requests should be sent to support@invoicelead.io; a response is given within 30 days.
Customers and contacts of a User should first contact that User; InvoiceLead forwards any requests it receives to the User.
A complaint may be lodged with the FDPIC (www.edoeb.admin.ch) or with the supervisory authority of the place of residence in the European Union.
9. Security
Encryption in transit (TLS) and at rest, separation of data by organisation, session tokens stored only as hashes, issued documents locked against changes, audit log, restricted and logged administrative access. In the event of a breach involving a risk, the authorities and the data subjects are informed within the statutory time limits.
10. Artificial intelligence
The data of Users and their customers are never used to train artificial intelligence models.
11. Cookies
InvoiceLead uses only strictly necessary cookies: session, pending sign-in request, language.
12. Changes
Any material change is announced by email or in the application at least 30 days before it takes effect.