Privacy Policy

Effective Date: August 15, 2026

1. Scope of This Policy

This Privacy Policy explains how Chaos To Cash Systems collects, uses, stores, shares, and protects personal data in connection with Invoices Hunter. Invoices Hunter is operated in Israel by Reuven (Hari) Moshkovich under the trade name Chaos To Cash Systems.

2. Data Minimization and Storage Architecture

Invoices Hunter is designed around a data-minimization and zero-retention approach for sensitive financial documents. In particular:

  • Final organized documents, reports, and extracted outputs reside in your Google Drive environment.
  • Source files such as PDFs and images may be processed in volatile memory or temporary backend storage only during the active scan, extraction, and report-generation workflow.
  • After the relevant workflow completes, temporary working copies of source invoice files and document contents are deleted from our active processing systems upon completion of the workflow, subject only to the specific technical and security retention periods defined in Section 9.
  • We may retain account metadata, connection state, authentication and security logs, and operational audit records needed to run and protect the Service.
  • We may also retain subscription, billing, invoicing, and compliance records as required for bookkeeping, tax, fraud prevention, contractual enforcement, or legal obligations.
  • For the WhatsApp add-on, we may retain your WhatsApp phone number and receipt metadata, while WhatsApp image media is processed only as needed to validate, convert, upload, and record the submitted receipt or invoice.

3. How We Collect Data

We collect data directly from you, from Google services and other integrations that you authorize, from payment or messaging providers involved in delivering the Service, and automatically from your use of the website and authenticated product flows.

When you use the WhatsApp add-on, we collect the WhatsApp phone number you provide, WhatsApp message metadata needed to match the sender to your account, and invoice or receipt images you send through WhatsApp. We may also receive delivery and processing context from WhatsApp or Meta services.

4. How We Use Data

We use personal data only as reasonably necessary to operate, secure, support, and improve the Service, including to:

  • Authenticate users, maintain account connections, and carry out requested scans, document extraction, organization, and report generation.
  • Store final outputs in your Google Drive and make the requested user-facing invoice organization workflow function.
  • Send operational messages, receipts, billing communications, security notices, and support responses.
  • Detect abuse, investigate incidents, enforce our terms, comply with law, and maintain security and audit logs.
  • Rely, as applicable, on consent, contractual necessity, legitimate interests, and legal obligations as bases for processing.
  • Validate WhatsApp phone numbers, receive invoice or receipt images through WhatsApp, assess image quality and document relevance, send WhatsApp feedback about unclear or accepted images, convert accepted images to PDF, and upload the resulting files to your Google Drive.
  • Send WhatsApp messages only for service and operational purposes based on your opt-in, and never send marketing or promotional WhatsApp messages without your separate, prior consent.

5. Google API Data and Limited Use

Chaos To Cash Systems' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We access Gmail and Google Drive data only to provide user-facing Invoices Hunter features, including identifying, extracting, organizing, and reporting on invoice-related materials at your request.

To provide these features, the Service requests permission to read your Gmail messages and attachments (the gmail.readonly scope) and to read your Google Drive files (the drive.readonly scope) so it can locate and read invoice and receipt emails, attachments, and files, including invoices you have already saved in your own Drive folders, and it requests per-file Drive access (the drive.file scope) to create folders and upload the organized invoices and reports it generates. Although the read permissions are technically broad, we access and process only the content reasonably needed to identify, extract, organize, and report on invoice- and receipt-related materials at your request, consistent with the Limited Use requirements above.

  • We do not sell Google API data and do not use it for advertising.
  • We do not use Google API data to train generalized artificial intelligence or machine learning models.
  • No human at Chaos To Cash Systems reviews your Gmail or Google Drive content unless you expressly request support that requires such access, or where review is strictly necessary for security, abuse prevention, legal compliance, or protection of rights.

6. AI Sub-Processors and Automated Processing

We may use AI or OCR sub-processors, including OpenAI, to extract text, classify documents, and derive structured fields from your files. Data sent to such providers may include document images, PDF text, extracted fields, and limited related context needed to perform the requested task. We use such providers under commercial agreements that contractually prohibit them from using your data for their own independent purposes or for training generalized artificial intelligence or machine learning models. Data processed by these providers may be temporarily retained by them strictly for their own abuse monitoring and trust and safety purposes, in accordance with their respective security policies.

7. Sharing with Service Providers and Third Parties

We may share personal data only as reasonably necessary to operate the Service, including with:

  • Google, so we can access the Gmail and Drive data you authorize and place outputs in your Google Drive.
  • AI, OCR, hosting, database, logging, email, messaging, WhatsApp/Meta, and other technical providers that help us deliver and secure the Service.
  • Payment processors and payment facilitators we engage from time to time, one or more of which may act as merchant of record and/or authorized reseller for your transaction and process related billing, tax, and refund data on our behalf or as an independent controller for that transaction, as well as accountants and compliance-related providers involved in subscription, billing, invoicing, fraud prevention, or recordkeeping workflows.
  • Advisers, regulators, courts, law-enforcement authorities, or counterparties where reasonably necessary for legal compliance, dispute handling, fraud prevention, or protection of rights.
  • Successors or transaction counterparties in connection with a merger, sale, financing, reorganization, or transfer of all or part of the business, subject to customary confidentiality protections where appropriate.

8. Sharing via Links

The Service may generate PDF/CSV reports containing links to files stored in your Google Drive. Current backend behavior stores those files under your account's Drive permissions rather than making them public by default. Accountant or recipient access depends on the sharing settings you choose or maintain in Google Drive, and you remain responsible for downstream disclosure, forwarding, or misuse once the report or link is in your control.

9. Retention and Deletion

Because the Service is designed not to retain source invoice files after processing, the primary data we continue to hold is generally limited to account metadata, connection state, operational logs, support records, and billing or compliance history. We retain such information only for as long as reasonably necessary to provide the Service, protect the Service, comply with legal obligations, resolve disputes, and enforce agreements. Our general retention schedule is:

  • Source invoice files and WhatsApp media: deleted within minutes to hours of the relevant workflow completing, except where limited retention is technically necessary for security, abuse prevention, incident investigation, legal compliance, or dispute handling.
  • Account, connection, and authentication data: retained for the life of your account, plus up to 12 months after account deletion for fraud prevention and security purposes.
  • Security and audit logs: retained on a rolling 12-month basis.
  • Billing, invoicing, and tax compliance records: retained for up to 7 years, consistent with Israeli recordkeeping practice, or longer where applicable law requires.
  • Support and correspondence records: retained for up to 24 months.
  • WhatsApp phone number and receipt metadata: retained until you disconnect the WhatsApp add-on or delete your account, plus up to 30 days.

These periods are general defaults and may vary where a longer or shorter period is required or permitted by law, or where you exercise a deletion right described in Section 15 below.

10. Security

We use administrative, technical, and organizational measures designed to protect personal data, including access controls, credential protections, encryption where appropriate, logging, and abuse-prevention controls. No system can be guaranteed to be completely secure, and we therefore cannot promise absolute security.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected individuals and, where legally required, the competent supervisory authority, without undue delay and in accordance with applicable law, including the 72-hour notification standard under the GDPR where applicable.

We use only strictly necessary cookies required for authentication and CSRF (cross-site request forgery) protection. We do not use advertising, analytics, or cross-site tracking cookies, and we therefore do not display a cookie-consent banner. You may control cookies through your browser settings, though disabling them may prevent the Service from functioning.

11. International Processing

We and our service providers may process data in Israel and in other jurisdictions. Israel has been recognized by the European Commission as providing an adequate level of data protection for transfers of personal data from the EU/EEA (Commission Implementing Decision 2011/61/EU); accordingly, transfers of personal data from the EU/EEA to us in Israel do not require additional safeguards under the GDPR. For transfers to sub-processors located outside Israel or the EEA in countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or another lawful transfer mechanism recognized under applicable law.

12. Your Rights Under Israeli Law

Subject to applicable law, including the Israeli Privacy Protection Act, you may request to review, correct, or delete certain personal data that we retain about you. Because the Service is designed not to retain source invoice files after processing, the data we continue to hold is generally limited to account metadata, connection state, logs, support records, and billing history. Some information may be retained where required for security, fraud prevention, bookkeeping, tax, legal compliance, or dispute resolution. If you are located outside Israel, Section 13 below describes additional rights that may be available to you.

13. International Privacy Rights (GDPR/UK GDPR and CCPA/CPRA)

European Union / United Kingdom residents (GDPR / UK GDPR). We process personal data on the following legal bases, depending on the purpose: performance of a contract with you (operating the Service you requested), your consent (for example, WhatsApp opt-in messaging), our legitimate interests (for example, security, fraud prevention, and service improvement), and compliance with legal obligations (for example, tax and accounting recordkeeping). Subject to applicable law and any relevant exemptions, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure of your data; request restriction of processing; receive a copy of your data in a portable format; object to processing based on legitimate interests; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place of the alleged infringement. We aim to respond to verifiable rights requests within 30 days, or such longer period as permitted by applicable law where the request is complex or numerous.

California residents (CCPA/CPRA). The categories of personal information we collect are described in Sections 2 through 4 above (identifiers such as email and phone number, account and connection metadata, financial document content processed transiently, and usage/log data). We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. Subject to applicable law and any relevant exemptions, California residents have the right to: know what personal information we collect, use, and disclose; request deletion of personal information; request correction of inaccurate personal information; and not be discriminated against for exercising these rights. You may submit a request by contacting us as described in Section 16, including through an authorized agent. We aim to respond within 45 days of a verifiable request, extendable once by an additional 45 days where reasonably necessary.

EU/UK representative. Where Article 27 of the GDPR or the UK GDPR requires us to designate a representative in the European Union or United Kingdom, we will identify that representative's contact details in this Section once appointed; until then, EU/UK data subjects may direct inquiries to the contact details in Section 16.

14. Children

The Service is not directed to, and may not be used by, individuals under 18 years of age. If a lower age of digital consent applies in your jurisdiction (for example, 16 under the GDPR for information-society services, or 13 under COPPA), you must also independently meet that threshold. We do not knowingly collect personal data from children below the applicable age, and we will delete such data promptly if we learn we have done so.

15. Data Deletion and Revoking Access

You can stop our access to your Google data and delete your data at any time, using any of the following options:

  • Revoke access directly from your Google Account security settings at myaccount.google.com/permissions, which immediately ends our ability to access your Gmail and Drive.
  • Disconnect or unsubscribe from within the Service, which stops future scans and uploads and revokes the Google authorization token stored for your account.
  • Request deletion of your account and associated personal data by contacting us at info@chaostocashsys.com. On account deletion, we revoke the Google authorization, delete the stored Google tokens, account profile, WhatsApp number, scan jobs, and related personal records, and remove generated billing documents from our systems, except for limited records we are required to retain for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes.

Final reports and files already stored in your own Google Drive remain in your Drive and under your control; you can delete those directly in Google Drive at any time.

16. Changes and Contact

We may update this Privacy Policy from time to time, and the updated version becomes effective when posted unless a later date is stated. For privacy requests, legal notices, support, or questions about this Policy, contact us at info@chaostocashsys.com or at 10, Siny, Hod HaSharon, Israel. For security vulnerability disclosures or privacy-related escalations, please use the subject line 'SECURITY' to ensure immediate routing.