Your data,
in plain sight.

What the product saves.

Your account workspace is private to the signed-in account. The app saves the information needed for sign-in, invoices, and follow-ups.

Account

Email, password hash, verification state, and time-limited confirmation or recovery records. Session cookies support signing in and keeping the account session open.

Workspace

Business and sender names, Reply-to address, timezone, reminder settings, templates, and the invoice details you enter, including client names, contact emails, balances, due dates, statuses, and optional payment links.

Delivery activity

Approved recipient and message content, sending attempts, provider references, delivery states, timestamps, and failure or hold details. Queued message content is saved so an approved send can be processed consistently.

Sample demo

The sample workspace and your demo changes use browser local storage. The demo does not send email. Reset demo workspace replaces that local sample data.

Account email limits

Keyed hashes of account email recipients and aggregate daily counts record verification and password recovery sending attempts. These counters do not contain raw recipient email addresses or message content.

Dunlio uses essential session cookies for account access and browser local storage for the sample demo. No third-party web analytics trackers are installed in Dunlio.

What that information is used for.

Account details support sign-in, email ownership confirmation, and password recovery. Workspace details support saving invoices, rendering your templates, scheduling approved follow-ups, and showing activity.

Delivery and recipient records help process the sending queue, prevent repeated sends, report outcomes, and honor bounce or spam restrictions.

You choose the client contact information and message text. Add contacts you are authorized to use and send legitimate invoice follow-ups. Check the recipient, balance, and content before approving a message.

When information leaves the workspace.

Resend processes email recipient addresses, sender and Reply-to details, message content, and sending metadata to deliver account messages and invoice follow-ups. Its delivery responses and signed events update Dunlio activity.

The configured sending address is reminders@dunlio.com. Replies to invoice reminders go to the confirmed account email saved in workspace settings. Resend processes Dunlio email in its European region.

Dunlio runs on Google Cloud Run in the Google Cloud europe-west1 region in Belgium, within the European Union. Account and workspace records are stored in a Cloud SQL PostgreSQL database in the same region, and automated database backups stay in that region. Google Cloud provides the hosting and storage; Resend separately processes the email data described above.

An optional payment link opens the external destination you supply; that service handles its own payment and data collection. Dunlio does not collect invoice payments or connect to your bank.

How account access is protected.

Passwords are stored as hashes. The Resend API key stays on the server and is not provided to the browser. Account workspace access requires signing in.

Email confirmation links expire after 24 hours and work once. Password reset links expire after one hour and work once. Changing or resetting a password requires signing in again.

Use a unique password, protect access to your email mailbox, and keep confirmation and recovery links private. Account deletion and password changes require your current password in Account and security.

Take a copy. Remove your account.

In Settings → Account and security, Export my data downloads a JSON copy of account, workspace, and delivery information. The export excludes password hashes, private confirmation or reset tokens, session credentials, and provider API keys. You can also export your invoice list as CSV.

Delete account requires your current password and the typed confirmation DELETE. It removes the live account, workspace, invoices, templates, and personal delivery, verification, and recovery records, and cancels queued reminders. Copies in earlier encrypted backups expire through the retention process below. Emails already accepted for sending cannot be recalled.

Download a copy first if you need one. Account deletion does not delete messages already received by recipients or automatically remove records held by an external email provider.

What can remain after deletion.

Account and delivery records remain in the application until the account is deleted. You can remove invoices and templates from your workspace; delivery history can remain after an invoice is removed. Minimal recipient records of bounces, spam complaints, or sending restrictions may remain across account deletion. These minimal holds include the recipient email address and the restriction reason so future sending continues to honor them.

Account-email recipient attempt counters use independent keyed hashes. These counters and aggregate daily counts become eligible for cleanup 32 days after their UTC date. They can remain after account deletion until that cleanup, without raw recipient addresses or message content in the counters.

Cloud SQL takes an automated, encrypted backup of the database every day and keeps the seven most recent copies in the same EU region. Older copies are removed by that rotation and are not deleted at an exact minute.

An earlier backup can still contain records deleted from the live application. Restoring a backup therefore requires the operator to honor subsequent account deletions before using the restored data. This page does not claim that backup copies are erased immediately when an account is deleted. Resend and message recipients handle their own copies according to their separate practices.

This explanation describes Invoice Follow-ups and the current account workspace. Other products in the collection are planned; their data handling will need to be explained when they become available.