Privacy Policy

Last updated: August 15, 2026

EventInvoiceHub ("we", "us") provides invoicing software for freelance live event professionals, available as a web application and as a desktop application. This policy explains what information we handle and how. The short version: your business data belongs to you, we don't sell it, and we collect as little as possible.

The desktop app: your data stays with you

The Windows and macOS desktop apps store everything — clients, shows, invoices, expenses, receipts, settings — in a local database on your own computer. We have no access to it and it is never uploaded to us. The desktop app signs in with your EventInvoiceHub account solely to verify your subscription status; your business data is not transmitted. If you email invoices from the desktop app, the email is sent through your own email account; your email password is stored in your operating system's keychain, not by us.

The web app: what we store

• Account information: your email address and a securely hashed password.
• Your business data: the clients, shows, rates, invoices, expenses, and receipt images you enter. Every record is isolated to your account with database-enforced row-level security — no other user can access it.
• Trial and subscription status: to enforce the one-trial-per-person policy we store a normalized form of your email address, and to manage your subscription we store your plan and Stripe customer/subscription identifiers.

Payments

Payments are processed by Stripe. Your card number never touches our servers — we only receive confirmation of your subscription status from Stripe.

Bank connections (optional)

If you choose to connect a bank account to match incoming deposits to your invoices, that connection is handled by Plaid. This feature is entirely optional and opt-in.

• You enter your bank credentials directly into Plaid's secure window — we never see or store your bank login.
• Access is read-only, and we store only deposit (money-in) records — date, description, and amount — to suggest invoice matches. We never store your spending or outgoing transactions.
• The secure access token that lets us read deposits is stored so that only our backend can use it; it is never exposed to any browser.
• You can disconnect a bank at any time in Settings, which immediately revokes the connection at Plaid and deletes the stored token and any unmatched deposit records.

Connecting your Google account (Gmail)

You can optionally connect your Google account so that invoices you send go out from your own Gmail address instead of ours — better inbox delivery for your clients, and a copy in your own Sent folder. This is entirely optional and opt-in, set up in Settings.

• We request a single, narrow permission — “Send email on your behalf” (the gmail.send scope) — and nothing else. We cannot read, view, modify, delete, or download any of your emails, drafts, labels, or contacts.
• We use this access only to send the specific invoices and directly related messages you choose to send from within EventInvoiceHub.
• The token that lets us send on your behalf is encrypted and stored so that only our backend can use it; it is never exposed to any browser, and we do not store the contents of the messages.
• You can disconnect at any time in Settings, or from your Google Account permissions page, which immediately revokes our access.

EventInvoiceHub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We use a small number of processors to run the service:

• Supabase — database and authentication hosting for the web app.
• Stripe — payment processing.
• Resend — delivery of transactional and invoice emails (used when you have not connected your own mailbox).
• Google (Gmail API) — send-only access to your own mailbox, used to send invoices from your address (only if you connect your Google account).
• Plaid — optional read-only bank-deposit access for invoice matching (only if you connect a bank).

We do not sell your data or share it with advertisers. We do not run third-party analytics or advertising trackers.

Cookies and local storage

The web app stores a session token in your browser's local storage so you stay signed in. That's it — no advertising cookies, no cross-site tracking.

Emails we send

We send transactional emails only: account confirmation, password resets, and billing notices. We don't send marketing email unless you explicitly opt in.

Data retention and deletion

Your data remains in your account while it's active, including read-only access after a trial or subscription ends. To permanently delete your account and all associated data, email support@eventinvoicehub.com from your account email and we'll complete the deletion within 30 days.

Security

All traffic is encrypted in transit (TLS 1.2 or better) and all data is encrypted at rest. Web app data is protected with per-user row-level security enforced by the database itself. Passwords are hashed; we cannot read them. Sensitive payment fields and any bank-access token are further restricted so they are never exposed to the browser. No system is perfectly secure, but the architecture is designed so that even a compromised client cannot read another user's data.

Not tax advice

Tax estimates shown in the app are approximations for planning purposes based on published tax tables. They are not tax, legal, or accounting advice. Confirm your actual obligations with a qualified professional.

Children

EventInvoiceHub is a business tool and is not directed at children under 16. We do not knowingly collect information from them.

Changes

If we make material changes to this policy we'll update this page and note the new date above. Continued use after changes means you accept the updated policy.

Contact

Questions or requests: support@eventinvoicehub.com