Privacy Policy
1. Who we are
KesMic: Invoice & Quote Maker ("KesMic", also shown on devices as "KesMic Invoice") is provided by its developer ("we", "our" or "us"), who is the controller of your personal data. It is a mobile app for Android and iOS that helps tradespeople, freelancers and small businesses create invoices and quotes, manage customers and products, schedule jobs and record payments.
This policy explains what personal data the app collects, why, who it is shared with, how long it is kept and the choices you have. It applies to the KesMic app and to this website.
Contact: support@kesmichq.com
2. Data we collect
Account data. Your name, email address and a password (stored only as a secure hash), or the details you share when you sign in with Google or Apple (see section 3).
Business data you enter. Business name, address, phone number, email, website, tax and registration numbers, bank or payment details you choose to show on invoices, logo, signature, invoice templates and settings.
Your customers' data. Names, email addresses, phone numbers and addresses of the customers you add. You decide what to enter and are responsible for having a lawful basis to store it.
Documents and records. Invoices, quotes, line items, products and services, jobs, payments, notes and the PDFs the app generates.
Photos and attachments. Images you take with the camera or choose from your photo library to attach to invoices, quotes or jobs. The app only accesses photos you select.
AI invoice requests. The text you type or dictate when you ask the app to draft an invoice or quote, and the draft it returns.
Voice input. When you use dictation, speech is converted to text by your phone's built-in speech recognition (Apple or Google). We do not receive or store audio recordings; we only receive the resulting text if you submit it.
Subscription data. Your plan, trial and renewal status, the store product purchased and an anonymous purchase identifier. Payments are handled by Apple or Google; we never receive your card or bank details.
Technical data. Information needed to run the service securely, such as sign-in sessions, device platform, app version and server logs (IP address, time and request type).
We do not collect your location or your contacts, we do not use advertising or analytics SDKs, and we do not track you across other apps or websites.
3. Signing in with Google or Apple
If you choose Sign in with Google, the following applies to the Google user data we receive:
- Data accessed: we request only the basic scopes openid, email and profile. From your Google Account we receive your name, email address, profile picture URL and a Google account identifier. We do not access your Gmail, Contacts, Drive, Calendar or any other Google data.
- How we use it: only to create your KesMic account, sign you in securely, show your name and picture in your profile, and pre-fill your name and business email. It is not used for advertising, profiling, marketing or AI model training.
- How we store it: your name, email, profile picture URL and Google account identifier are stored in your account record in our database (Supabase, EU), encrypted in transit and at rest, and accessible only to your own account.
- How we share it: we do not sell, rent or transfer Google user data to third parties. It is processed only by our hosting provider (Supabase) to operate your account. It is never sent to our AI providers.
- Retention and deletion: we keep it while your account exists. When you delete your account (Settings → Delete account, or via this page) it is deleted from our live systems, and backup copies expire within 30 days. You can also revoke access at any time at myaccount.google.com/connections.
If you choose Sign in with Apple, we receive your name (first sign-in only) and either your email address or an Apple private relay address, and use them the same way.
Google API Services User Data Policy. KesMic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, do not use it to train AI models, and do not let people read it except with your consent, for security, or where required by law.
4. How we use your data
- To create and secure your account and keep you signed in.
- To store your business records and sync them across your devices.
- To generate invoice and quote PDFs and let you share them with your customers.
- To draft invoices and quotes from your text or dictation using AI.
- To manage your subscription, free trial and plan limits.
- To answer support requests and handle data and deletion requests.
- To prevent fraud and abuse and to keep the service reliable.
We process your data only to provide the app you signed up for, to keep it secure and reliable, and to meet legal obligations such as keeping records of purchases.
5. AI features
When you use the AI invoice feature, the text you submit is sent to our AI processing providers, Google (Gemini API) and, as a fallback if it is unavailable, OpenAI (API), only to produce the draft you asked for. Your name, email and Google account data are not sent. Please avoid including unnecessary sensitive personal information in AI requests.
We keep the text of AI requests for 30 days and the generated drafts for up to 365 days (for troubleshooting and abuse prevention), then delete them automatically. AI history is also deleted when you delete your account, or earlier on request.
6. Who we share data with
We do not sell or rent your personal data. We share it only with service providers that process it on our behalf to run the app:
- Supabase – database, file storage, authentication and server functions (hosted in the EU, Frankfurt).
- Google – Google Sign-In, Gemini API for AI drafts, Google Play billing (Android).
- Apple – Sign in with Apple and App Store billing (iOS).
- OpenAI – fallback AI processing for invoice drafts.
- RevenueCat – subscription status and purchase validation.
When you share an invoice or quote, it goes to the recipient you choose through your phone's share sheet (for example email or messaging apps). We may also disclose data if required by law or to protect our users and service.
Some providers may process data in other countries. Each provider is bound by contract to protect your data and use it only to provide its service to us.
7. How long we keep data
- Account and business data: for as long as your account exists.
- AI request text: 30 days. AI drafts: up to 365 days.
- Generated PDF exports: up to 365 days.
- Subscription and billing events: up to 2 years, for accounting and dispute purposes.
- After you delete your account, your data is removed from our live systems, and residual copies in backups expire within 30 days.
8. Security
All data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider. Access to each business's records is restricted to its own account by database access rules, passwords are stored as secure hashes, and server keys are never included in the app.
9. Your rights and choices
- Access and portability: download a copy of your data in the app (Settings → Download my data).
- Correction: edit your profile, business and records in the app at any time.
- Deletion: delete your account in the app (Settings → Delete account) or see Delete your account.
- Revoke Google access: remove KesMic at myaccount.google.com/connections.
- Permissions: camera, photos and microphone access can be turned off in your phone settings.
- Questions or concerns: contact us and we will help.
To exercise any right, email support@kesmichq.com. We respond within 30 days.
10. Children
KesMic is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will change the "Last updated" date above and, for significant changes, notify you in the app.