Last updated: October 2026
At Xuvilo, we respect your privacy and are committed to protecting your data. This policy explains what information we collect, how we use it, and your rights regarding it.
We collect two main types of information:
Important: Without an account, the documents you create in the free tools (invoices, quotations, receipts) are processed in your browser and are not sent to our servers. When you sign in, the documents you have already generated, downloaded or shared in this browser while signed out are moved into your account, and from then on every document you generate, download or share is saved there.
The editors keep an unfinished document in your browser so that a reload can restore it. Signing out of your account removes these drafts from that browser.
We do not sell your personal data, and we do not share it with advertisers other than as described below for Google AdSense.
We use cookies and similar technologies to remember your preferences (like language and currency), keep you signed in, analyze usage, and serve relevant advertising. You can control cookies through your browser settings, though disabling them may affect some site features.
Xuvilo uses Google AdSense to fund our free services. The ads may appear on the site's editorial and informational pages: the home page, the blog and its author pages, the calculators, the guides, the country and other landing pages, and the Pricing, About, Contact, FAQ and How it works pages.
Third-party vendors, including Google, may use cookies to serve ads based on a user's prior visits to Xuvilo or other websites. These cookies enable Google and its partners to serve ads that are more relevant to your interests.
Additionally, some third-party advertisers may use cookies or web beacons to measure and personalize the effectiveness of their advertising.
To understand how Google uses the data it collects from sites that use its advertising services, see Google's Business Data Responsibility site.
We do not use a Google-certified consent management platform (CMP), and our consent banner does not produce an IAB TCF consent string. Google requires a certified CMP before it will serve personalised ads to users in the EEA and the UK (since 16 January 2024) and in Switzerland (since 31 July 2024). For visitors in those regions Google therefore cannot show personalised ads, whichever choice they make in our banner — accepting does not unlock them.
Google describes what such traffic may receive instead as either non-personalised ads or limited ads. These are two different modes, not one: non-personalised ads are targeted on the context of the page rather than your past behaviour, but still use cookies for frequency capping and aggregated reporting; limited ads do not use personal data for personalisation and use local storage only for invalid-traffic detection. Google says only that this traffic “may be eligible” for those “where supported” — so we cannot tell you which you would see, or promise that you would see an advertisement at all.
You can opt out of personalized advertising from Google at any time by visiting Google Ads Settings. You can also visit www.aboutads.info/choices to opt out of personalized ads from participating ad networks.
We may use analytics tools (such as Google Analytics) to understand how the site is used and to improve the user experience. These tools collect generally aggregated, non-personal data (such as most-visited pages, session duration, device, country).
Our pages also load Cloudflare Web Analytics (a small script from static.cloudflareinsights.com) to count visits and measure how fast pages load. It sends Cloudflare the page address, the page you came from, your browser and device type and performance timings, and Cloudflare sees your IP address as any server does. Cloudflare states that this tool does not use cookies or local storage to track you.
The sign-in, sign-up, password-reset and contact forms may show a security check from Cloudflare Turnstile, which confirms that a person, not an automated program, is sending the form. It runs in your browser and may use technical information about your browser and device, including your IP address, to make that decision only. Cloudflare's privacy policy applies to that information.
The infrastructure that hosts this site sets a technical cookie named GAESA on every response, including before you make a choice in our cookie banner. Xuvilo's own code does not set it; it is part of how the hosting platform delivers the site, and we do not use it for analytics or advertising.
We follow reasonable security practices to protect your data from unauthorized access, alteration, or disclosure. Account data is stored securely on protected servers. However, no method of transmission or storage over the internet is 100% secure.
If you turn on two-step sign-in, we keep the secret key your authenticator app uses, encrypted, and a scrambled (hashed) form of your backup codes from which the codes cannot be recovered. Both are deleted when you turn the feature off or delete your account.
“Log out” ends your session on the device you are using only. To end your sessions on your other devices, use “Sign out of other devices” in Settings, or change your password.
We keep account data for as long as the account is active. Saved documents are kept until they are deleted or you close your account, except what you added to workspaces other people own, which stays with that workspace (see “What is kept, and why” below). Anonymised analytics may be kept for longer for trend analysis.
To exercise any of these rights, email us at [email protected].
You can delete your account yourself at any time from Settings → Danger Zone, after entering your password.
Deleting your account removes it from our servers permanently and at once. It cannot be undone.
If our file storage fails while your account is being deleted, the account is not deleted: it stays usable and you can simply try again. Files already removed by then stay removed.
Xuvilo does not target children under 13 and does not knowingly collect data from them. If you believe a child has provided us with data, please contact us and we will delete it.
Our site may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We recommend reviewing the privacy policy of every site you visit.
We may update this Privacy Policy from time to time. We will post changes on this page with the updated date. Your continued use of the site after an update means you accept the revised policy.
For privacy questions, email us at [email protected].
