Re. privacy, it may be a good idea to disallow invoice URLs in robots.txt, using a common pattern or subdirectory.