Privacy Policy

Last updated: August 28, 2026

This notice explains what data Gennai collects, why, who can see it, how long we keep it and what your rights are. Gennai is an invoice capture service: it finds supplier invoices and receipts in your mailboxes and other channels, reads them with artificial intelligence, organizes them and exports them to your accounting software.

If you use our Chrome Extension, its specific data handling is covered by the dedicated Chrome Extension Privacy Policy.

1. Who we are

Gennai (https://www.gennai.io) is operated by NUVIO LAB - FZCO, a free zone company established in Dubai, United Arab Emirates ("Gennai", "we", "us"). For anything related to your data, write to privacy@gennai.io. For general support, write to support@gennai.io.

2. Our role: your data and the data inside your documents

Gennai handles two kinds of personal data, and our role is different for each:

• Your account, billing and usage data. Here Gennai decides how and why the data is processed (we are the "controller").
• The content of the emails and documents you connect or send us, which may contain personal data of other people (a supplier's contact person, an employee named on an invoice, bank details). We process that content only on your instructions and to provide the service; you, as our customer, remain responsible for it (we are the "processor"). You confirm that you are entitled to give us access to those mailboxes and documents.

3. What we collect, by source

• Account: name, email address, profile picture (if you sign in with Google or Microsoft), language, organization name and country, team members and accountants you invite, and the identifiers assigned to your login.
• Billing: plan, subscription status, credit purchases and payment history. Card details are entered directly with Stripe; we never see or store your full card number.
• Connected mailboxes (Gmail, Outlook, IMAP): the mailbox address, the access credentials you authorize, and the emails we evaluate as described in section 4. For IMAP mailboxes you give us the server address and the mailbox password, which we store encrypted and use only to read your inbox.
• Forwarding: if you forward invoices to the personal address we give you, we receive the forwarded message and its attachments.
• Messaging channels (WhatsApp, Telegram, Slack): the phone number or account you link, the documents and images you send, and message metadata (timestamps, message identifiers). We do not keep text-only messages beyond what is needed to answer you.
• Uploads: PDFs, images and spreadsheets you upload manually, in bulk or through the Chrome Extension.
• Document content: what our AI extracts from each invoice or receipt: supplier and customer names, addresses and tax identifiers, amounts, dates, invoice numbers, line items, and payment details such as the supplier's bank account.
• Accounting integrations (Xero, QuickBooks Online, Holded): the data described in sections 7 and 8, used only to export your invoices.
• Google Drive and OneDrive: the folders and files Gennai creates for you (sections 5 and 6).
• Bank data, only if you use those features: your own payment account details to generate payment files (ABA), and bank statements you upload for reconciliation, including the transactions they contain.
• Usage and device data: pages visited, actions in the dashboard, browser and device type, IP address and approximate country, error reports, and the cookies described in section 15.
• Support: the messages you send us by email or through the chat widget.

4. Your mailboxes

Gennai only reads your mailbox: it never sends, deletes, moves or modifies email. For Gmail and Microsoft accounts this is enforced by the read-only permission we request; for IMAP mailboxes, where passwords do not allow narrower permissions, it is how our software is built.

Gennai analyzes the email that arrives in your inbox, including its attachments and any invoice document it links to, to identify invoices and receipts. When we find one we keep it, together with the data extracted from it. Email that is not an invoice or a receipt is discarded after the analysis: we do not store its content. Of every email we evaluate we keep limited technical records, so that the same message is not processed twice and so that we can investigate problems you report; section 14 says for how long.

The analysis is automated and uses an AI service (section 9). Nobody at Gennai reads your email as part of it (section 10).

You can disconnect a mailbox at any time, which stops the scanning immediately and deletes its credentials. Settings also lets you choose what each mailbox captures.

5. Google user data

Gennai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request the following Google permissions, and use them only as described:

• Gmail, read-only (gmail.readonly): to find invoices and receipts in your mailbox exactly as described in section 4. We never send, delete or modify email.
• Google Drive, files created by Gennai (drive.file): to create folders in your Drive and upload copies of your invoices there, if you enable Drive backup. Gennai cannot see or touch files it did not create. Files already in your Drive are not deleted when you disconnect or delete your account.
• Basic profile (email address): to identify the connected account.

We use Google user data only to provide the features described here. We do not use it for advertising, we do not sell it, and we do not share it with third parties except to provide the service (section 11). You can revoke Gennai's access at any time from your dashboard or from Google's account permissions.

Gennai does not use any user data, including data obtained through Google Workspace APIs, to develop, improve, or train generalized AI and/or ML models.

6. Microsoft user data (Outlook, OneDrive)

When you connect a Microsoft account we request read access to your mailbox, to identify invoices as described in section 4, and, only if you enable OneDrive backup, permission to create and manage the files Gennai places in its own folder in your OneDrive. Some connections made earlier hold a broader file permission, which we use only for that folder. We do not send, delete or modify your email, and we do not access files outside the Gennai folder. You can revoke access from your dashboard or from Microsoft's app access page; when you delete your Gennai account we delete the stored credentials, and we recommend that you also remove Gennai there.

7. QuickBooks Online data

When you connect QuickBooks Online, Gennai accesses your QuickBooks data solely to export invoices as Bills:

• Company information: company name, country and currency preferences, to configure the integration.
• Vendors: we read your vendor list and create vendor records for new suppliers.
• Bills: we create Bill records for the invoices you export and attach the original PDF.
• Accounts and tax codes: we read your chart of accounts and tax codes to book each Bill correctly.
• Currencies and exchange rates: for multi-currency companies, to record foreign-currency Bills accurately.

We do not read your customers, sales invoices, payments, banking data or reports; we do not modify or delete records we did not create; we do not use QuickBooks data for advertising or analytics; and we do not sell or share it. Your QuickBooks credentials are stored encrypted. QuickBooks notifies us when Bills or Vendors we created there are changed or deleted, so that your Gennai records stay accurate. You can disconnect QuickBooks from your Gennai dashboard or from the QuickBooks App Store; disconnecting revokes Gennai's access immediately.

8. Xero and Holded data

When you connect Xero or Holded, we use their APIs solely to export invoice data from Gennai into your accounting system: creating purchase records (bills and credit notes), reading and creating supplier contacts, reading your chart of accounts and tax rates, and attaching the PDF. We do not access financial reports, bank feeds, payroll or any data beyond what invoice export requires. Access credentials are stored encrypted. Disconnecting from your dashboard revokes Gennai's access with the provider.

9. Artificial intelligence

Gennai uses AI to identify invoices and receipts and to read what they contain (supplier, amounts, dates, line items, payment details). For this purpose, documents and message content are sent to an enterprise document-processing AI service, under contract terms that prohibit the provider from using your data to train or improve its models. Gennai does not use your data to train or improve generalized AI or machine-learning models. AI results can be wrong: you can review and correct any extracted value in your dashboard, and you should check the data before relying on it for accounting or payments.

10. Who at Gennai can see your data

Your emails and documents are processed by automated systems. Members of our team do not read them, except in three cases: when you ask us to look into a specific document, mailbox or export; when it is necessary for security, such as investigating a bug, a security incident or suspected abuse; or when the law requires it. In each of those cases we look only at what is needed to resolve that specific issue, and we delete any working copy afterwards. We do not read your documents to improve the product.

11. Who we share data with

We do not sell your personal data. We share it only with the service providers described below, with the people you invite to your organization, with the services you connect yourself, and when the law requires it.

We rely on specialist providers for IT infrastructure and hosting, payments, communications and customer support, security and monitoring, AI document processing (section 9), and website analytics and advertising measurement (section 15, subject to your cookie choices). They act on our instructions and only for those purposes. Some of them are established in the United States or process data outside the European Union; section 12 explains the safeguards that apply. If you need the current list of the providers we use, for example to complete a vendor assessment, write to privacy@gennai.io and we will send it.

The services you connect. When you connect a mailbox, a storage service, an accounting platform or a messaging channel (Google, Microsoft, Xero, Intuit, Holded, Slack, Telegram, WhatsApp), data flows to that provider because you asked for it, and their own terms and privacy policies apply.

People you invite. Team members and external accountants you add to your organization can see its invoices and data according to the role you give them. Public share links you create expire automatically and give read-only access to the documents you choose.

12. Where your data is stored and international transfers

Gennai runs in the European Union, and that is where your invoices and your account data are stored. Some of the providers described above process data in the United States, and AI document processing may take place in data centers outside the European Union. Gennai itself is established in the United Arab Emirates and our team administers the service from there. Where personal data protected by EU, UK or other data protection law is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or on the provider's certification under the EU-US Data Privacy Framework. You can ask us for details of these safeguards at privacy@gennai.io.

13. Security

• All data is encrypted in transit and at rest.
• Mailbox and integration credentials are encrypted before being stored, and are erased when you disconnect.
• Gennai never sees your Google or Microsoft password.
• Access to your data is limited to the people you authorize in your organization.
• Gennai has completed the Cloud Application Security Assessment (CASA) of the App Defense Alliance, which Google requires for applications that access Gmail, and repeats it every year.

14. How long we keep data, and how to delete it

Three actions have different effects:

• Cancelling a paid plan moves your organization to the Free plan at the end of the billing period. Nothing is deleted.
• Disconnecting a mailbox or integration stops scanning or exporting immediately, revokes Gennai's access where the provider allows it, and deletes the stored credentials and scan history. Invoices already captured stay in your account until you delete them.
• Deleting your account (Settings) permanently erases your organization: invoices, documents, extracted data, bank data, connections and credentials, team and accountant access, and your user. We cancel any active subscription and revoke Gennai's access at Google, Xero and QuickBooks. Deletion is immediate and cannot be undone. Copies you chose to keep in your own Google Drive or OneDrive are not deleted.

You can also delete individual invoices at any time, and download a copy of your data (Settings, Privacy and data). To request deletion of specific data, write to privacy@gennai.io; we answer within 30 days.

15. Cookies, analytics and advertising

If you are in the European Union, the European Economic Area or the United Kingdom, or if we cannot determine your country, analytics and marketing tools stay off until you accept them in the cookie banner. Everywhere else (for example the United States, Australia, Canada or New Zealand) they load by default. In every case you can change your choice at any time with Cookie Settings in the footer.

We do not sell personal data. If your local law gives you a right to opt out of the sharing of data for advertising, switching off the Marketing category in Cookie Settings exercises that right.

Emails from us. We send service emails about your account (welcome, set-up tips, credit alerts, billing). To stop receiving non-essential emails, write to support@gennai.io.

16. Why we process your data (legal bases)

17. Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, receive it in a portable format, object to or restrict certain processing, and withdraw consent at any time. You can exercise most of these yourself in Settings (download your data, disconnect mailboxes and integrations, delete invoices, delete your account) or by writing to privacy@gennai.io. We answer within 30 days and may ask you to confirm your identity.

If you are not satisfied with our answer, you can complain to a data protection authority: in the United Arab Emirates, the UAE Data Office; in the European Union, the authority of your country; in the United Kingdom, the Information Commissioner's Office (ICO); in Australia, the Office of the Australian Information Commissioner (OAIC).

If your personal data appears in a document that one of our customers processed with Gennai (for example, you are a supplier), please contact that customer first; they control that data, and we will help them respond.

18. Children

Gennai is a business service intended for users aged 18 or over. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

19. WhatsApp Business Platform

If you use the WhatsApp submission feature, you first register and verify your phone number in your Gennai account, so that only authorized numbers can submit documents to your organization. We process the PDFs and images you send exactly like any other upload, keep message metadata only as long as needed to process and confirm your request, and reply only with confirmations and errors. Our use of WhatsApp complies with the WhatsApp Business Policy: we do not send marketing messages through WhatsApp, we do not share WhatsApp data with third parties for their own purposes, and you can remove your number from your account at any time.

20. Changes to this policy

When we change this policy we update the date at the top and add the change to the list below. If the change is significant we also tell registered users by email.

• August 28, 2026: simplified throughout; narrowed and clarified when our team can access your data (section 10); the categories of service providers we use are described in section 11 and the current list is available on request.
• August 25, 2026: expanded to cover every channel through which invoices reach Gennai, bank data, cookies, retention periods, legal bases and your rights. Minimum age set to 18.
• April 13, 2026: link to the Chrome Extension Privacy Policy.
• March 4, 2026: QuickBooks Online section.
• January 11, 2026: WhatsApp sections.
• November 29, 2025: first version.

21. Contact

Data and privacy: privacy@gennai.io
Support: support@gennai.io
Company: NUVIO LAB - FZCO, Dubai, United Arab Emirates