Privacy Policy

Invox Privacy Policy

Last updated: 09 July 2026

This Privacy Policy explains how Invox, operated by NeXQuantum Solutions Ltd, collects, uses, stores, protects and shares information in connection with the Invox platform for financial documents, invoices, scans, reports and business workflows.

1. Controller / service operator and scope

The service is operated by NeXQuantum Solutions Ltd. This Policy applies to users, account administrators, employees, representatives, accountants, advisors and any person granted access by or on behalf of a customer or organization.

Where a business customer uploads or connects information relating to third parties, the customer is responsible for ensuring that it has the authority and legal basis to provide and process such information through the service.

2. Information we collect or process

• Account and user details: name, email, organization identifier, role, permissions, user status, login details and authentication data.
• Financial and business documents: invoices, receipts, payment requests, PDF files, images, reports, attachments and related metadata.
• Automatically extracted data: dates, amounts, VAT, document numbers, suppliers, customers, categories, notes, review status and OCR/AI processing results.
• Connected mailbox and integration data, only according to permissions granted and for the purpose of locating, retrieving, filtering and processing relevant documents.
• Technical and operational data: IP address, browser type, device identifiers, logs, security events, errors, access times and usage information required for operation, security, monitoring and improvement.
• Support information: requests, correspondence, files submitted for support, case notes and communications with company representatives.

3. Purposes of processing

• Operating the service and managing accounts, permissions, organizations, documents, scans, reports and workflows.
• Identification, authentication, access control, prevention of unauthorized use, system stability and security.
• Data extraction, classification, search, archiving, views, reports and support for customer accounting workflows.
• Support, troubleshooting, quality assurance, performance improvement and user experience improvement.
• Compliance with legal obligations, authority requests, information security requirements, accounting requirements, audits, fraud prevention and protection of rights.
• Business communications, service notices, technical updates, security notices and material service updates.

4. Legal basis and permissions

Processing may be based, as applicable, on consent, performance of an agreement, legitimate interests of the company or customer, legal obligation, or any other basis permitted by applicable law. Where permission is required for a mailbox, third-party account or integration, use will be limited to the permissions granted and the relevant provider restrictions.

5. Sharing with third parties

We do not sell personal information. Information may be transferred to or processed by service providers acting on our behalf, including cloud, hosting, security, monitoring, email, OCR, AI, communications, backup, support and infrastructure providers, as necessary to operate the service.

Information may also be disclosed where required by law, court order, competent authority, enforcement of terms, dispute handling, debt collection, fraud prevention, security incident response, or protection of the rights, property and safety of the company, users or third parties.

6. AI, OCR and automated processing

The platform may use OCR tools, algorithms, automated models and AI services to read documents, extract data, classify and present recommendations. Such outputs may be inaccurate, incomplete or erroneous. The user and customer are responsible for reviewing and approving all data before any accounting, legal, commercial, reporting or binding use.

Where external processing providers are used, information is transferred only to the extent necessary to operate the service and subject to customary security and use limitations.

7. Information security

The company applies reasonable and customary safeguards, including access controls, role-based permissions, secure communications, account separation, operational monitoring, backups and measures designed to reduce the risk of unauthorized access, loss, alteration or disclosure.

However, no internet-connected system can guarantee absolute security. The company does not warrant that the service will be completely immune from intrusion, failure, loss, third-party provider failure, force majeure or unauthorized activity beyond its reasonable control.

8. Retention, deletion and backups

Information will be retained for as long as needed for the service, agreements, operation, security, support, audit, legal compliance, legal defense or customer instructions. Deleted information may remain for a limited period in backups, logs or archives until routine deletion or until there is no longer a legal or operational need to retain it.

9. Data subject rights

Subject to applicable law, requests may be made for access, correction, deletion, restriction, objection or additional information. Requests will be reviewed according to the requester’s identity and permissions, accounting and legal retention duties, legitimate interests, third-party rights and instructions of the relevant business customer.

10. Customer and user responsibilities

• Ensure that uploaded or connected information is provided lawfully and with authority.
• Configure appropriate access permissions and revoke access for users who are no longer authorized.
• Keep login details confidential and notify us promptly of suspected unauthorized use.
• Ensure that use of information and reports complies with applicable law, internal policies and the customer’s professional advice.

11. International transfers

Information may be stored or processed in Israel or other countries, including through international cloud and infrastructure providers. In such cases, the company will seek to use customary contractual, organizational and technological safeguards, subject to applicable law.

12. Minors

The service is not intended for minors and is not designed to collect information from minors. If information relating to a minor has been provided without appropriate authorization, please contact us for review of deletion or restriction.

13. Changes to this Policy

The company may update this Policy from time to time. Material changes will be published on the website or in the system, and continued use after the update will constitute acceptance of the updated Policy to the extent permitted by law.

14. Contact

For privacy, information security or data subject requests: info@nexquantum.co.il