Skip to main content
LaloDocs
Create an invoice

Legal

Privacy policy

What we collect, where it lives, who else touches it, and how to take it all back.

Last updated 25 July 2026

The short version

  • If you use LaloDocs without an account, your document is built and rendered entirely in your browser. It is stored in your browser’s local storage so you can come back to it, and it is not sent to us.
  • If you create an account, we store what you give us — your email, your business details, your clients, your items and your documents — so we can show them back to you, email them and track payment.
  • Everything is hosted on AWS in the United States (region us-east-1).
  • We do not sell personal data, and we do not share it for cross-context behavioural advertising.
  • You can export everything or delete your account yourself, at any time, from the account settings page.

Who is responsible

LaloDocs operates this service and is the controller of the personal data described below. For any privacy question, correction or complaint, write to support@lalodocs.lalohq.com. We reply to rights requests within 30 days.

What we collect, and why

Documents you create without an account

Drafts are saved in your own browser using local storage and IndexedDB. They stay on your device. Clearing your browser data deletes them, and we cannot recover them for you because we never had them.

Account data

When you sign in we store your email address, a display name if you set one, your business details, currency, language and timezone, and your plan. Authentication is passwordless — we send a one-time code and a sign-in link — so we never hold a password for you. If you sign in with Google or Apple we receive your email address and a stable identifier from them and nothing else.

Business records

Documents, clients, catalog items, payments you record and the events attached to them (created, sent, viewed, paid) are stored against your account. These frequently contain personal data about your clients. For that data you are the controller and we process it on your behalf — you decide what goes on an invoice, and you are responsible for having a lawful basis to put it there.

Delivery and view tracking

When we email a document we record delivery, bounce and complaint events from our mail provider so we can keep our sending reputation clean and tell you the message did not arrive. When someone opens a hosted invoice link we record the time and increment a view counter.

We do not store the viewer’s IP address. The address is truncated and then hashed with a salt that rotates daily, and only that hash is written. It exists solely so that one person refreshing the page is not counted as five separate views, and because the salt changes daily it cannot be used to follow anyone across time. The raw address is never persisted.

Operational logs

Our infrastructure keeps short-lived request logs for security and debugging: timestamp, request path, response status and user agent. Retention is limited and they are not used to build a profile of you.

Cookies and similar technologies

Strictly necessary storage — the sign-in session, your consent choice, your drafts — is used without asking, because the service does not function without it. Nothing else is set until you say yes.

If advertising is enabled on this deployment, ad slots appear only on public marketing and template pages, only after you accept advertising cookies, and never on the editor, the hosted invoice page or any signed-in screen. We implement Google Consent Mode v2: every signal starts denied, and no advertising script is loaded at all until you grant it. You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page — withdrawing is exactly as easy as granting.

Who else processes your data

  • Amazon Web Services — hosting, database, file storage, email delivery and content delivery. Data is stored in us-east-1 (Northern Virginia, USA).
  • Stripe — payment processing and subscriptions, when payments are enabled. Card details are entered on Stripe’s own hosted checkout and never reach our servers, which keeps our PCI DSS obligations within the SAQ-A scope. Stripe is an independent controller for the payment data it collects.
  • PayPal — the same arrangement, where PayPal is offered as an alternative payment method.
  • Google — AdSense, only on deployments where advertising is enabled and only after consent, and Google or Apple sign-in if you choose to use it.

International transfers out of the EEA and the UK rely on the European Commission’s Standard Contractual Clauses together with the safeguards each provider publishes.

How long we keep things

  • Account and business records: for as long as your account exists.
  • Generated PDF files in our storage bucket: automatically expired 30 days after they are produced. The document itself is kept and can be re-rendered at any time.
  • Document event history, including view events: for the life of the document.
  • After you delete your account: your data is removed from the live system immediately and from encrypted backups as those backups age out, within 35 days.

Your rights

Under the GDPR and the UK GDPR you have the right to access, correct, delete, restrict and object to the processing of your personal data, and the right to receive it in a portable format. Under the CCPA/CPRA you have the right to know, to delete, to correct, and to opt out of sale or sharing — we do neither, so there is nothing to opt out of.

Two of these are self-serve and immediate, with no email to us required:

  • Export everything. Account settings → Export data, or GET /auth/export on the API, returns your complete account as JSON and CSV.
  • Delete everything. Account settings → Delete account, or DELETE /auth/me, erases your account and cascades to every document, client, item, share link and event.

For anything else, write to support@lalodocs.lalohq.com. You also have the right to complain to your local supervisory authority.

Security

Data is encrypted in transit with TLS and at rest in our database and storage buckets. Database backups use point-in-time recovery. Access to production follows least privilege. Passwordless sign-in removes the most common credential-theft path entirely.

We do not currently hold a SOC 2, ISO 27001 or any comparable audit report, and we will not imply one. If you need a formal assurance report for a procurement process, tell us at support@lalodocs.lalohq.com and we will tell you honestly where we are.

Children

LaloDocs is a tool for businesses and is not directed at anyone under 16. We do not knowingly collect data from children.

Changes

If we change this policy materially we will update the date at the top and, for account holders, say so by email before the change takes effect.