Privacy Policy

INPAID ("we", "our", "INPAID"), a company being incorporated in Paris, France, is the data controller for personal data collected through withinpaid.com and the INPAID application (together, the "Service"). For any question regarding this policy, contact us at hello@inpaid.tech.

We collect the following categories of data:

• Contact data: first name, last name, work email, company, role — when you fill out a demo, contact, or signup form.
• Account data: login credentials, preferences, dashboard usage history.
• Billing data: information required to process payments (handled by our payment processor, never stored directly by INPAID).
• Documents submitted for review: contractor invoices you upload to the platform for analysis.
• Technical data: IP address, browser type, pages visited, cookies (see section 7).

Your data is processed for the following purposes, under the legal bases indicated:

• Providing and improving the Service (contract performance);
• Responding to demo or contact requests (pre-contractual steps / legitimate interest);
• Analyzing invoices you upload, holding or releasing the associated payment, and generating compliance reports and corrective actions (contract performance);
• Billing our services and complying with accounting obligations (legal obligation);
• Sending you product communications, unless you opt out (legitimate interest / consent as applicable);
• Ensuring Service security and preventing fraud (legitimate interest).

The Service is hosted by Vercel Inc., and structured data (accounts, invoices, compliance reports) is stored via Supabase. No transfer outside the EU takes place without appropriate safeguards (European Commission Standard Contractual Clauses) where strictly necessary for the Service to function.

• Invoices submitted for review: analyzed then deleted within 90 days, unless you explicitly consent to extended retention for your compliance history.
• Account data: retained for the duration of the contractual relationship, then 3 years from the last contact for commercial purposes.
• Billing data: retained for 10 years in accordance with French accounting and tax obligations.
• Form data (demo/contact) not converted into a customer: 3 years from collection.

Under the General Data Protection Regulation (GDPR), you have the following rights over your personal data: access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent at any time where processing is based on it. You can exercise these rights by writing to us at hello@inpaid.tech. You also have the right to lodge a complaint with the French data protection authority (CNIL — www.cnil.fr) or your local supervisory authority.

The Service uses cookies strictly necessary for its operation (authentication, language preference, geo-detection for currency display) as well as, where applicable and with your consent, analytics cookies. You can configure your browser to reject non-essential cookies.

We implement appropriate technical and organizational measures to protect your data: encryption in transit (TLS) and at rest, per-customer data isolation, role-based access control, access logging, and regular review of our security practices.

We use the following subprocessors:

• Anthropic — invoice document analysis (AI processing);
• Supabase — storage of account, invoice, and report data;
• Vercel — site and application hosting.

Each subprocessor is bound by a Data Processing Agreement (DPA) ensuring a level of protection equivalent to the GDPR. A detailed DPA is available on request for Scale and Enterprise plan customers.

For any question regarding the protection of your data, you can contact our GDPR compliance lead at: hello@inpaid.tech.

This policy may be updated periodically. Any material change will be notified to you by email or via a banner on the Service.