Legal

Privacy Notice

Last updated: June 2026

This Privacy Notice explains how PeppolInvoice.ie (“we”, “us”, “our”) collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. We are the data controller for personal data collected through this website. For data protection queries: hello@peppolinvoice.ie.

What data we collect

  • Account data — your name and email address when you register via Clerk.
  • Company registration data — your company name, VAT/tax number, registered address, and Peppol participant ID, used to populate your invoices correctly. We do not register you on the Peppol network ourselves.
  • Invoice data — buyer details, invoice lines, amounts, and references you enter when creating invoices. This data is used only to generate your PDF and UBL XML files; we do not transmit it over the Peppol network.
  • Payment information — handled entirely by Stripe; we do not store your card details.
  • Technical data — IP address, browser type, pages visited (anonymous analytics only).

Why we collect it (legal basis)

  • Contract performance — to generate compliant UBL/PDF invoices on your behalf for you to send yourself.
  • Legal obligation — invoice records may be required for VAT compliance.
  • Legitimate interest — to operate, secure, and improve the service and to prevent fraud.

Who we share data with

We do not sell your personal data. We share data only with trusted service providers necessary to operate the service:

  • Stripe — payment processing and subscription management.
  • Clerk — user authentication and identity management.
  • Supabase — database hosting for your account and invoice data.
  • Resend — transactional email delivery.
  • Vercel — website hosting and serverless compute.

International data transfers

Where personal data is transferred outside the EEA — to Stripe, Clerk, and Vercel, which operate partly in the United States — the transfer is protected by appropriate safeguards, namely Standard Contractual Clauses and/or the EU–US Data Privacy Framework, under each provider's data-processing terms. Supabase data is hosted in the EU region.

How long we keep your data

  • Account and company data: retained for the life of your account, then deleted within 90 days of closure.
  • Invoice records: retained for 7 years as required by Irish VAT and accounting law.
  • Payment records: kept as legally required (Irish tax law — 7 years).
  • Contact messages: deleted within 12 months.

Your rights under GDPR

You have the right to: access your data · correctinaccurate data · erase your data · object to processing · data portability · withdraw consent at any time.

To exercise any right, email hello@peppolinvoice.ie and we will respond within 30 days.

Cookies

We use only essential cookies required to operate the site (authentication session cookies set by Clerk). We do not use advertising or tracking cookies.

Complaints

If you believe your data has been mishandled, you have the right to lodge a complaint with the Data Protection Commission (Ireland).

Changes to this notice

We may update this notice from time to time. The “last updated” date at the top of this page will reflect any changes. Continued use of the site after changes constitutes acceptance.