Privacy Policy
Smart-Invoicer, operated by MLTS Canada. Last updated 15 August 2026.
This policy explains what information Smart-Invoicer collects, why we collect it, who we share it with, and what you can ask us to do with it. It is written to be read, not to be skipped.
Who we are
Smart-Invoicer is an invoicing and estimating application for Canadian businesses, operated by MLTS Canada. You can reach us about anything in this policy at deep@mltscanada.ca.
What we collect
Information about you
When you create an account we collect your business name, email address, contact number, business address, tax registration number and, if you upload one, your business logo. We also store your password in a one-way hashed form — we cannot read it, recover it, or tell you what it is.
Information about your customers
Smart-Invoicer exists to produce invoices and estimates, so it stores the customer details you enter: names, addresses, email addresses and phone numbers, together with the estimates, invoices, line items, tax amounts, discounts and payment records you create. This is your data about your customers. We process it on your behalf so that the application can do its job. We do not sell it, mine it, or use it to market to your customers.
Information we generate
We keep basic operational records: when you sign in, when documents are created or changed, when emails are sent from the system, and standard web server logs including IP addresses. These exist so that we can keep the service running, investigate problems, and give you an explainable audit trail for your own records.
Payment information
Subscription payments are processed by Stripe. Card numbers are entered on Stripe's own checkout page and are never sent to, seen by, or stored on our systems. What we keep is a record that a payment succeeded — the amount, the currency, the date, the plan, and Stripe's own reference identifiers — so that we know your subscription is active and so you have a payment history.
Stripe handles that payment data under its own privacy policy, which you can read at stripe.com/privacy.
Why we are allowed to hold it
We hold your account information because we need it to provide the service you asked for. We hold your customers' information because you instructed us to, by entering it. We keep transaction and tax records because Canadian law requires businesses to be able to produce them.
Who we share it with
We share your information with a very short list of parties, and only where it is necessary:
- Stripe, to take subscription payments.
- Our email provider, to deliver the estimates, invoices and reminders you choose to send.
- Our hosting provider, which operates the servers the application runs on.
- Google Analytics, and only for the four pages described under “Cookies and analytics” below. It receives no customer, estimate, invoice or payment information.
We do not sell your data. We do not share it with advertisers. We will disclose information if we are legally required to — a court order, a lawful request from a government authority — and we will tell you when we are permitted to.
Where it is stored
Your data is stored on servers operated on our behalf. If those servers are located outside Canada, your information may be accessible under the laws of that country. Contact us if you need to know the specific location for your own compliance purposes and we will tell you.
How long we keep it
While your account is open, we keep your data so the service works. If you close your account we retain your invoices, estimates and payment records for the period Canadian tax law requires records to be kept — generally six years — because deleting them sooner could leave you unable to answer questions from the Canada Revenue Agency. After that they are deleted.
Your rights
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you can ask us to show you the personal information we hold about you, correct it if it is wrong, explain how we have used it, or delete it where we are not required to keep it. Write to deep@mltscanada.ca and we will respond within thirty days.
If you are one of our customers' customers — if you received an invoice from a business that uses Smart-Invoicer — that business controls your information, not us. Please contact them directly. We will help them respond to you.
Security
Traffic to and from the application is encrypted with HTTPS. Passwords are stored using PBKDF2-SHA256 with a unique random salt per password, which means they cannot be reversed even by us. Access to your data is scoped to your own account: the application checks ownership on every document before it is shown, printed, emailed or changed.
No system is perfectly secure. If a breach ever affects your information we will tell you and the relevant authorities, as PIPEDA requires.
Cookies and analytics
We use an authentication cookie to keep you signed in. It is not used for advertising or cross-site tracking. If you block it, you cannot sign in.
We also use Google Analytics, and we have deliberately limited it to the pages you can reach without an account: the sign-in page (which is also this site's front page), the sign-up page, and the Terms of Service and Privacy Policy pages you are reading now. It is not loaded anywhere inside the application.
On those pages it records which page was viewed, an approximate location derived from your IP address, the type of device and browser you used, and whether a new account was created. That last one is a count. It carries no name, no email and nothing that identifies who signed up.
What is never sent to Google: your name, business name, email address, phone number, business address or tax registration numbers; anything you type into a form; and any customer, estimate, invoice, payment or tax information whatsoever. Those things live on pages Google Analytics is not loaded on, and no invoice or customer identifier is ever included in what is measured.
Google processes this on our behalf and may store it outside Canada. You can block it with a browser setting, a content blocker, or Google's own opt-out add-on, and everything in Smart-Invoicer will continue to work normally — unlike the authentication cookie, this one is not needed to use the service.
Changes to this policy
If we change this policy we will update the date at the top of this page. If a change materially affects how we handle your information, we will tell you by email.