Privacy Policy

1. Overview

Soffit Invoice reads invoices and purchase orders from the email, messaging, and chat tools you connect, extracts the relevant data using an AI model, checks each invoice against your vendor history for signs of fraud, and syncs verified records to your accounting or ERP system. This policy covers the personal and business data involved in that process.

2. Information we collect

We collect the following categories of information:

• Account information — your name, work email address, company name, and password or authentication credentials when you create a Soffit Invoice account.
• Invoice and vendor data — invoice documents, purchase orders, vendor names, bank account details, line items, amounts, and payment history that you upload or that we extract from connected services.
• Connected-service content — message and email content from services you explicitly connect (see Section 3), limited to what is needed to identify and extract invoice-related information.
• Usage data — pages viewed, features used, and actions taken within the application, collected to maintain and improve the product.
• Device and log data — IP address, browser or app version, operating system, and timestamps, collected automatically for security and troubleshooting.

3. Connected services

Soffit Invoice integrates with third-party services that you choose to connect, including Gmail, Google Drive, Slack, Outlook, and WhatsApp Business. When you connect a service, you grant Soffit permission — through that service's own authentication flow — to access a defined scope of your data, such as:

• Reading emails and attachments that appear to relate to invoices, purchase orders, or vendor correspondence.
• Reading messages in channels or threads you designate for invoice processing.
• Sending messages or emails on your behalf when you use Soffit to reply to a vendor.

We request the minimum scope of access each provider allows for this purpose. Data obtained through Google Workspace APIs is used solely to provide invoice-processing features described in this policy and is not used to serve ads, and any use of that data for developing or improving generalized AI or machine-learning models is subject to Google's API Services User Data Policy, including the Limited Use requirements, where applicable.

4. How we use information

We use the information described above to:

• Extract, validate, and organize invoice and purchase order data.
• Detect anomalies such as bank-detail drift, duplicate invoices, and unusual volume, and route flagged items to your review queue.
• Maintain the audit trail and ledger records described in the product.
• Sync verified records to the ERP or accounting system you've connected.
• Provide customer support, respond to your requests, and secure your account.
• Improve the reliability and accuracy of the product, using aggregated or de-identified data wherever possible.

5. AI processing

Soffit Invoice uses AI models to read and extract data from invoice documents and messages. By default, this processing runs on the model Soffit provides. If you enable "bring your own AI" and supply your own API key for a provider such as OpenAI, Anthropic, Google Gemini, or DeepSeek, invoice content is sent directly to that provider under the terms of your own account with them, and their respective privacy and data-use policies govern that processing. If you connect a locally hosted model (for example, through Ollama), invoice content is processed on your own infrastructure and is not transmitted to us or to any third-party AI provider.

We do not use your invoice or vendor content to train AI models for use by other customers.

6. How we share information

We do not sell your personal or business data. We share information only in the following circumstances:

• With your AI provider — as described in Section 5, if you've connected your own model.
• With your ERP or accounting system — when you enable sync, to write verified invoice records.
• With service providers — hosting, storage, and infrastructure vendors who process data on our behalf under confidentiality obligations.
• For legal reasons — if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Soffit, our users, or the public.
• With your consent — in any other case, only after you've explicitly agreed.

7. Data retention

We retain invoice, vendor, and audit-trail data for as long as your account is active, and for a reasonable period afterward to comply with accounting, tax, and audit obligations that commonly apply to financial records. You can request deletion of your account and associated data as described in Section 9, subject to any records we're legally required to retain.

8. Security

We use encryption in transit and at rest, access controls limiting who can view invoice and vendor data, and a tamper-evident audit log for changes to financial records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights and choices

Depending on where you're located, you may have the right to access, correct, export, or delete the personal data we hold about you, and to withdraw consent for connected services at any time by disconnecting them in Settings. To exercise any of these rights, contact us using the details in Section 13. We'll respond within a reasonable time and in accordance with applicable law.

10. International transfers

Soffit Invoice is built for businesses operating in Kenya, and our infrastructure and service providers may be located in Kenya or other countries. Where we transfer personal data across borders, we take steps intended to ensure it receives an equivalent level of protection, such as contractual safeguards with our processors.

11. Children's privacy

Soffit Invoice is a business tool intended for use by adults in a professional capacity. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly. Continued use of Soffit Invoice after a change takes effect means you accept the revised policy.

13. Contact us

If you have questions about this policy or how your data is handled, contact us at privacy@acludemy.com, or by mail at LA Octa Tech Labs, Nairobi, Kenya.