DUNLIO / TERMS
Terms of Service
These Terms of Service govern the use of Dunlio (dunlio.com), an online service for creating invoices and sending invoices and payment reminders to your clients. Dunlio is provided by GRIIKEN, the trade name of Ujjwal Solanki EI (entrepreneur individuel), registered in France under SIREN 991 497 173 (“we”, “us”). Contact: contact@griiken.com. Full details are in the legal notice. Annex 1, the data processing agreement, is part of these Terms.
1. Scope and acceptance
These Terms apply to every Dunlio account and to all plans, free or paid. You accept them when you create an account by ticking the box on the sign-up form, or when Dunlio asks you to accept a new version. We record the version, the date and time and the way you accepted. Electronic records of acceptance are proof of the agreement (Art. 1366 of the French Civil Code).
Your own general terms or purchasing conditions do not apply, even if you refer to them.
2. For businesses only
Dunlio is offered only to businesses: freelancers, sole traders, companies, associations and other organisations that use it for their trade, business, craft or profession. It is not offered to consumers. By accepting these Terms you confirm that you act for business purposes. If you accept them for an organisation, you confirm that you may bind it; “you” then means that organisation.
3. The service
Dunlio lets you create and manage invoices and clients, produce invoice PDFs, send invoices and payment reminders by email, schedule automatic and recurring reminders, draft invoices from a sentence (Describe invoice) and view reports. The current features and plan limits are shown in the app and on the pricing page.
We develop Dunlio continuously and may change, add or remove features. We will not remove a core feature of a paid plan during a period you have already paid for without telling you in advance and, if the change is a material disadvantage for you, refunding the unused part of that period.
Dunlio does not:
- collect payments for you or connect to your bank (an optional payment link opens a service you choose);
- give legal, tax or accounting advice: templates, guides, late-fee calculations and suggested wording are general information that you must check for your situation;
- act as a certified e-invoicing platform (such as a French “plateforme agréée”) or as an archiving system that meets legal retention duties. Keep your own copies of the invoices you issue for as long as the law requires.
4. Your account
Give accurate information, confirm your email address and keep it up to date. Keep your password secret and do not share your sign-in. You are responsible for everything done through your account. Tell us at once at contact@griiken.com if you think someone else has used it.
You may not open several accounts to get around limits, a hold or a suspension.
5. Plans, prices and payment
The Free plan costs nothing. Paid plans are monthly subscriptions at the prices shown in the app when you subscribe. They are paid in advance by card through our payment provider Stripe and renew every month until you cancel. An invoice for each payment is available in the billing portal.
We are not registered for VAT: VAT is not charged (“TVA non applicable, art. 293 B du CGI”). If we become liable for VAT, we will tell you in advance and VAT will be added from that date, as required by law. Other taxes that apply to you, such as withholding taxes, are your responsibility.
If a payment fails, Stripe tries again. If it still cannot be collected, we may move your account to the Free plan after telling you by email; your data is kept. Amounts not paid when due bear late-payment penalties at three times the French legal interest rate, plus the fixed compensation of €40 for recovery costs (Art. L441-10 and D441-5 of the French Commercial Code). No discount is given for early payment.
We may change prices. We will tell you by email at least 30 days in advance; the new price applies from the first billing period that starts after that notice. If you do not agree, cancel before then.
6. Changing or cancelling a plan
You can change or cancel your plan at any time in the billing portal (Plans → Manage billing). A cancellation takes effect at the end of the period already paid; until then you keep the paid features. Periods already paid are not refunded, unless the law requires it or these Terms say otherwise. An upgrade takes effect at once, and Stripe calculates the price difference for the current period.
After a downgrade, features and limits of the new plan apply. Your invoices, clients and templates are kept.
7. Emails to your clients and how we screen them
Emails to your clients are sent from Dunlio’s sending address on your behalf, show your business name and send replies to your account email. You are the sender of these emails and responsible for them. Before you can email clients, your account must be approved for sending, and we may limit how many emails or recipients an account can send to.
You may only email your own clients about real invoices and amounts that are actually owed, with a lawful basis for contacting them, and in line with the law on invoicing, debt collection, data protection and unsolicited email.
To protect recipients and the shared sending address, every email is checked automatically for fraud and abuse before it leaves, or for established accounts right after it was sent. The check combines rules (for example look-alike brand names and link shorteners) with facts about the account’s history and, for most emails, an AI review. An email with signs of fraud is held and not sent. If the signs are strong, sending for the whole account is paused. You receive a case number by email and in the app and can cancel a held email yourself. A person takes the final decision on held emails and paused accounts.
We may refuse to send an email if we have reasonable grounds to believe that it is unlawful, fraudulent or breaks these Terms.
8. Acceptable use
You must not use Dunlio to:
- send phishing or try to obtain passwords, card data, bank details or payments by deception;
- impersonate another business, brand, marketplace, bank, authority or person, including by look-alike names, logos or web addresses;
- issue fake invoices, or demand money that is not owed or not owed to you;
- include misleading links, links that hide their destination (such as URL shorteners) or malware;
- send marketing, newsletters or other unsolicited email: Dunlio is for invoices and reminders only;
- harass, threaten or pressure people unlawfully, or use collection practices the law forbids;
- publish or send content that is illegal or infringes the rights of others, including intellectual property and privacy;
- get around limits, holds, suspensions or the screening, for example with new accounts or altered wording;
- probe, scan or load-test Dunlio, copy it, reverse-engineer it or access it by automated means without our written permission (reporting a security issue in good faith to contact@griiken.com is welcome);
- resell or rent Dunlio to others without our written permission;
- use Dunlio if you or your organisation are subject to EU or French sanctions.
9. Holds, suspensions and how to contest them
If we find or reasonably suspect a breach of section 7 or 8, we may, in proportion to its seriousness: hold an email, lower your sending limits, pause sending to clients, suspend the account or end the contract. We use the automated checks described in section 7 together with human review. A pause triggered automatically to stop likely fraud is reviewed by a person as soon as possible.
We tell you about each measure by email and in the app, with the reasons: what we did, the facts and rules it is based on, whether automated means were used and how you can contest it. We may leave out details where the law forbids telling you or where telling you would help someone get around fraud prevention.
To contest a decision, write to contact@griiken.com and quote the case number. A person who did not take the first decision where possible reviews it, and we reply within a reasonable time. Your right to go to court is not affected.
If an account repeatedly or seriously breaks these Terms, we end the contract. Where the law requires or allows it, we report suspected crimes to the authorities and may warn people who received a fraudulent email.
10. Reporting abuse and illegal content
Anyone, including people who received an email sent through Dunlio, can report fraud, abuse or content they consider illegal. Write to contact@griiken.com with the subject “Abuse report” and include, where possible: why you think it is illegal or abusive; the email itself or the sender, the date and the invoice number; your name and email address; and a statement that your report is accurate and made in good faith. You do not need to give your name if the report concerns child sexual abuse material.
We confirm receipt, look at every report carefully and without undue delay, and tell you what we decided. More on the Help page.
Single point of contact for users and for authorities under the EU Digital Services Act (Art. 11 and 12): contact@griiken.com, in English, French or German.
11. Your content and personal data
You keep all rights to the content you put into Dunlio: invoices, clients, products, templates, logo and messages. You give us a non-exclusive, worldwide, royalty-free licence to host, copy, process, display and transmit that content as far as needed to provide, secure and support the service. We do not sell your content, use it for advertising or use it to train AI models. You are responsible for its accuracy and lawfulness and for having the rights to use it.
When we process personal data of your clients and other people on your behalf, we do so as your processor under the data processing agreement in Annex 1. For your account, billing, security, abuse and fraud prevention (including the email screening), usage statistics and our legal duties, we act as controller, as explained on the Data and privacy page.
12. AI features
Describe invoice turns a sentence into a draft invoice with the help of an AI model from Anthropic. Drafts can be wrong or incomplete: check them before you issue them. You remain responsible for every invoice and email you send. The AI is also used in the screening described in section 7. Inputs are not used to train AI models.
13. Availability and support
We aim to keep Dunlio available at all times but do not guarantee uninterrupted operation. Maintenance, updates, security measures and failures of providers or networks can cause interruptions; we schedule planned work for quiet hours where we can. We do not guarantee that recipients’ email systems accept every email or that clients pay.
Support is by email at contact@griiken.com. We aim to reply within two business days.
14. Our rights
Dunlio’s software, design, texts, templates and brand belong to us or our licensors. While your contract runs, we grant you a non-exclusive, non-transferable right to use Dunlio for your business under these Terms. You may use the invoice and email templates in the documents you create with Dunlio. If you send us feedback or ideas, we may use them without obligation to you.
15. Liability
We provide Dunlio with reasonable care and skill (obligation de moyens). Our liability is unlimited for death or personal injury, fraud, gross negligence and wilful misconduct, and wherever the law does not allow it to be limited.
Otherwise: we are not liable for indirect loss, such as lost profit, lost revenue, lost clients, lost business opportunities or damage to reputation. Our total liability for all claims arising in any 12-month period is limited to the amount you paid us in the 12 months before the event that caused the damage, and to at least €100. Data loss is limited to the effort of restoring it from the backups described on the Data and privacy page.
You indemnify us against claims by third parties, and the reasonable costs of defending them, that arise from your content, the emails you send or your breach of section 8.
16. Duration and ending the contract
The contract starts when you create your account and runs until it is ended. You can end it at any time by deleting your account in Settings → Account and security; deleting the account also cancels a paid plan. We can end it with 30 days’ notice by email, or at once if you seriously break these Terms (in particular section 8), if the law requires it, or if your account stays unconfirmed for more than 90 days.
Export your data before the end (Settings → Account and security → Export my data). After the end, we delete your data as described on the Data and privacy page. If we end the contract with notice and without fault on your side, we refund the unused part of a period already paid.
17. Changes to these Terms
We may change these Terms for valid reasons, such as new laws or court decisions, new or changed features, security or abuse prevention. We will tell you about changes by email and in the app at least 30 days before they apply, and ask you to accept the new version. If you do not accept it, you may end the contract before the changes apply; a paid period already started is then refunded for the unused part. Changes required by law or needed urgently to fight fraud may apply sooner.
18. General provisions
Each party keeps confidential the non-public information it receives from the other. Neither party is liable for failures caused by force majeure (Art. 1218 of the French Civil Code). You may not transfer the contract without our consent; we may transfer it to a successor of the business after telling you. If a clause is invalid, the rest stays in force. Not enforcing a right is not a waiver. Notices are sent by email: to your account email, and to us at contact@griiken.com.
These Terms are written in English. The German and French versions are translations for convenience; if they differ, the English version prevails.
19. Applicable law and courts
French law applies, excluding the UN Convention on Contracts for the International Sale of Goods. Before going to court, the parties will try to settle a dispute by email within 30 days. As far as the law allows, the courts of Créteil, France, have exclusive jurisdiction; we may also bring a claim at your registered office.
Annex 1
Annex 1: Data processing agreement (Art. 28 GDPR)
This agreement applies whenever we process personal data on your behalf while providing Dunlio. It is part of the Terms and is accepted with them; under Art. 28(9) GDPR this electronic form is sufficient, so no separate signature is needed. If you need a copy for your records, export this page as a PDF or ask us at contact@griiken.com.
1. Roles
You are the controller (or a processor acting for your own client), and we are your processor. Our own processing as controller is described in clause 6 and is not covered by this agreement.
2. Subject matter, nature, purpose and duration
We store and process your workspace data to provide Dunlio: keeping clients, products and invoices, producing PDFs, sending invoices and reminders by email, tracking delivery, preparing invoice drafts when you ask for them, and support. The processing lasts as long as the Terms and until the data is deleted under clause 14.
3. Data subjects and types of data
- Data subjects: your clients and their contact persons, your own staff and users, and other people named in your invoices and emails.
- Types of data: names and business names, email and postal addresses, VAT and registration numbers, invoice data (items, amounts, dates, payment status, notes), bank details and payment links you add, email content, delivery and bounce information.
- Do not enter special categories of personal data (Art. 9 GDPR) or data about criminal convictions; Dunlio is not designed for them.
4. Instructions
We process the data only on your documented instructions: these Terms, your settings and the actions you take in the app are your instructions, and you can give further instructions by email. We process data otherwise only where EU or French law requires it, and then tell you first unless that law forbids it. We tell you if we think an instruction breaks data protection law.
5. Confidentiality
Everyone who can access the data on our side is bound to confidentiality. Access is limited to what support, security and abuse prevention need.
6. Our own purposes
To protect recipients and the shared sending address, we screen emails for fraud before or right after they are sent, review requests for sending access and keep minimal records of bounces, complaints and review cases. We also keep account-level usage statistics (never invoice or email content), billing records and the records the law requires. For these purposes we are an independent controller on the basis of our legitimate interest or legal duties (Art. 6(1)(c) and (f) GDPR), as described on the Data and privacy page.
7. Security
We take the technical and organisational measures listed in Appendix B (Art. 32 GDPR) and update them as technology and risks change, without lowering the level of protection.
8. Sub-processors
You authorise the sub-processors listed in Appendix A. We will tell you at least 30 days in advance, by email or in the app, before adding or replacing one. You may object on reasonable data protection grounds within that period; if we cannot find a solution together, you may end the contract and we refund prepaid fees for the remaining period. We impose the same data protection obligations on each sub-processor by contract and remain responsible for them.
9. Transfers outside the EEA
Data is transferred outside the European Economic Area only with safeguards under Chapter V GDPR: an adequacy decision (such as the EU-US Data Privacy Framework for certified companies) or the EU Standard Contractual Clauses (Commission Decision 2021/914). Appendix A shows the safeguard for each sub-processor.
10. Requests from data subjects
The app lets you view, correct, export and delete the data in your workspace. If a data subject contacts us about data we process for you, we forward the request to you without undue delay and help you answer it.
11. Further assistance
Taking into account the nature of the processing and the information available to us, we help you meet your duties under Art. 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).
12. Personal data breaches
We tell you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information required by Art. 33(3) GDPR as far as it is available, and we take the measures needed to limit its effects.
13. Information and audits
We give you the information needed to show compliance with Art. 28 GDPR, including this agreement, Appendix B and the certifications and reports our sub-processors publish. You or an independent auditor bound to confidentiality may audit us once a year, or after a breach or at a supervisory authority’s request, with 30 days’ notice, during business hours, at your cost and without access to other customers’ data.
14. Deletion and return
You can export your data at any time. When you delete data or your account, it is removed from the live system at once and from backups by their rotation within 8 days, unless EU or French law requires us to keep it. Data we keep as controller under clause 6 follows the retention periods on the Data and privacy page.
15. Liability and precedence
Liability follows Art. 82 GDPR and, as far as that allows, section 15 of the Terms. For the processing of personal data on your behalf, this agreement prevails over the rest of the Terms.
Appendix A: Sub-processors
| Sub-processor | Service | Location and safeguard |
|---|---|---|
| Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland | Hosting, database and backups (Cloud Run, Cloud SQL) | EU (Belgium, region europe-west1). Google Cloud Data Processing Addendum, with Standard Contractual Clauses for any access from outside the EEA. |
| Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA | Sending invoices, reminders and account emails; delivery events | Processing in Resend’s EU region; US company: EU-US Data Privacy Framework and Standard Contractual Clauses (Resend DPA). |
| Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland | Describe invoice drafts at your request; AI part of the fraud screening (as our own processing, clause 6) | Requests may be processed in the USA, Europe, Asia or Australia; data stored in the USA. Standard Contractual Clauses (Anthropic DPA). Not used for model training. |
Appendix B: Technical and organisational measures
- Hosting in Google Cloud data centres in the EU (region europe-west1, Belgium); Google’s infrastructure is certified to ISO/IEC 27001 and audited under SOC 2.
- Encryption in transit (HTTPS/TLS only, HSTS) and at rest (database and backups encrypted by Google Cloud).
- Access only after sign-in; passwords stored with salted, iterated one-way hashing; session cookies are secure and HttpOnly; CSRF protection; throttling of sign-in, sign-up and recovery attempts; confirmation and reset links expire and work once.
- Every request checks that the data belongs to the signed-in account, so workspaces are kept apart.
- Operator access is limited to the business owner, through individual accounts with the least privileges needed; each time an admin opens an account, this is logged.
- Keys and passwords for providers are kept in Google Secret Manager and never sent to the browser.
- Automated encrypted backups every day, kept for 7 days in the same EU region; managed infrastructure that restarts failed parts automatically.
- Data minimisation towards the AI provider: bank details are removed and only the domain of a recipient’s email address is sent.
- Fraud screening, sending limits and blocking of recipients who bounced or complained, to protect recipients.
- Strict content security policy, input validation and escaping of all user content in emails and PDFs.
- Automated tests before every release, regular dependency updates, logging and alerts, and a documented procedure for personal data breaches (clause 12).