DueNotice

Privacy Policy

Last updated November 8, 2026

This Privacy Policy describes how JustLedger (“JustLedger,” “we,” “us,” or “our”) collects, uses, discloses, and retains information in connection with DueNotice (the “Service”). It applies to account holders and to visitors of our public pages. It does not apply to your own customers except to the extent their information is stored in your account because you entered it.

By using the Service, you acknowledge this Policy. If you do not agree, do not use the Service.

1. Who is responsible

JustLedger operates DueNotice and determines how account-holder information is processed. For names, emails, and other details of people you invoice, you decide what to enter. We process that information to provide the Service to you. You are responsible for telling those people how you use their information, where the law requires it.

2. Information we collect

Account and profile. Email address; session identifiers; business name, phone, mailing or service address, currency, payment notes; PayPal, Venmo, Cash App, and Stripe identifiers you choose to connect; timestamps for acceptance of these terms where recorded.

Customer and invoice data you provide. Customer name, email, phone, and notes; invoice lines, dates, amounts, tax, status, reminder drafts, payment records, public share tokens, and a short activity log (for example sent, viewed, paid, void).

Payment of our subscription. If you subscribe, Stripe collects payment-method details. We receive subscription status, customer and subscription identifiers, and related events. We do not receive full card numbers.

Invoice card payments. If you connect Stripe so your customers can pay an invoice, Stripe processes the card. We receive confirmation and identifiers needed to mark the invoice, not the card number.

Technical data. Standard server logs (IP address, user agent, timestamps, request path) used for security, debugging, and abuse prevention. Theme preference may be stored on your device and is not used to track you across other sites.

We do not collect information from your personal mail, calendar, or files outside DueNotice. Sign-in uses an emailed link; we do not store a password. We use the Meta pixel, described below, to count page views, new accounts, and a completed subscription. We use Vercel Web Analytics to count page views and referrers, including UTM tags, in aggregate. It uses no cookies and does not track people across sites.

3. How we use information

We use information to:

  • create and authenticate your account, including magic-link sign-in;
  • operate invoicing, reminders, PDFs, public invoice pages, and status tracking;
  • send transactional email you request (sign-in links and invoices you send);
  • bill the DueNotice subscription and enforce the five-invoice free allowance;
  • enable card checkout on invoices when you have connected Stripe;
  • secure the Service, prevent fraud and abuse, and debug failures;
  • comply with law, enforce our Terms of Service, and protect our rights;
  • communicate material changes to the Service or to this Policy;
  • measure page views, new account creation, and a completed subscription with the Meta pixel.
  • count page views and referrers, including UTM tags, in aggregate with Vercel Web Analytics, which uses no cookies and does not track people across sites.

We do not sell personal information. Page views, a one-time new-account event, and a one-time subscription event are sent to Meta with the pixel described in section 4. Meta may use that information under its own policies. We do not otherwise share personal information for cross-context behavioral advertising.

4. How we share information

We share information with service providers who process it on our instructions:

  • Vercel — hosting and delivery of the application;
  • Vercel — Web Analytics that counts page views and referrers, including UTM tags, in aggregate. It uses no cookies and does not track people across sites.
  • Supabase — database hosting;
  • Resend — transactional email;
  • Stripe — DueNotice subscriptions and, if you connect an account, invoice card payments to you.
  • Meta Platforms — pixel requests for page views, new-account events, and a completed subscription, including technical data Meta collects with those events (such as IP address, browser, and an event id).

Anyone you give a public invoice URL can see the business name, customer name, line items, amounts, due date, and payment methods shown on that page. Treat the URL as you would a paper invoice. Voided invoices are not shown on that page.

We may disclose information if required by law, legal process, or government request; to protect the rights, safety, or property of JustLedger, our users, or others; or in connection with a merger, acquisition, financing, or sale of assets, in which case this Policy will continue to apply or you will be notified of a successor policy.

5. Cookies and similar technologies

We use an HTTP-only session cookie to keep you signed in. It is not used for advertising. Additional short-lived cookies may support sign-in (for example, to complete a magic link on the same device, or to remember the campaign link you arrived with until a new account is created). After a brand-new account is created, a short-lived cookie that the page can read triggers one new-account event and is then cleared. After a verified paid subscription checkout, a similar short-lived cookie triggers one subscription event for that checkout and is then cleared. You can end the session by signing out. The Service may not function if essential cookies are blocked.

The Meta pixel loads from Meta and may set its own cookie, such as _fbp, on this site. Blocking Meta’s scripts in your browser stops that measurement. The rest of the Service still works.

Vercel Web Analytics counts page views and referrers, including UTM tags, in aggregate. It uses no cookies and does not track people across sites.

6. Retention

While your account is open, we retain invoice, payment, reminder, customer, and profile records so the Service can function as a business tool. Sign-in links expire after approximately twenty minutes and are single-use. Hashed tokens and session cookies follow those lifetimes.

If you close the account from your profile, we delete our copy of the business profile, invoices, customers, and sign-in credentials associated with that account, except (a) residual copies in encrypted backups for a limited time, (b) records we are legally required to keep, and (c) information processors such as Stripe retain under their own policies. Server logs are kept only as long as needed for security and operations.

7. Security

We use reasonable administrative, technical, and physical safeguards appropriate to a small hosted application, including hashed sign-in tokens, an HTTP-only session cookie, transport encryption, and isolation of account data in application queries. No method of transmission or storage is completely secure. You are responsible for controlling your email inbox and public invoice links.

8. Your choices and rights

You may access and correct much of your information in the Service, sign out, cancel a subscription, and close the account from your profile. Closing the account is the primary deletion mechanism.

Depending on where you live, you may have additional rights to know, access, correct, delete, or obtain a copy of personal information, or to appeal a refusal. To make a request, email us from the address on your DueNotice account so we can verify you. We will not discriminate against you for exercising rights available under applicable law.

We do not currently meet the quantitative thresholds of every U.S. state privacy statute. Where a law applies, we will honor it. If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases for processing typically include performance of a contract, legitimate interests in operating and securing the Service, and consent where required (for example, optional payment connections). You may have rights of access, rectification, erasure, restriction, portability, and objection, and a right to lodge a complaint with a supervisory authority.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Accounts must be opened by adults for business use. If we learn we have collected information from a child under 13, we will delete it.

10. International transfers

The Service is hosted in the United States. If you access it from another country, you understand that your information will be processed in the United States, which may have different data-protection rules than your country of residence.

11. Changes

We may update this Policy. The “Last updated” date will change. For material changes, we will provide notice by email or in the Service when reasonably practicable. Continued use after the effective date means you accept the updated Policy. If you do not agree, close the account and stop using the Service.

12. Contact

Privacy questions and requests should be emailed to serris@zoho.com from the address associated with your DueNotice account so we can verify you. The controller for account-holder information is JustLedger, operator of DueNotice. Product site: duenotice.justledger.us. Operator site: justledger.us.