Privacy Notice

What data we collect

• Account data — your name and email address when you register via Clerk.
• Company registration data — your company name, VAT/tax number, registered address, and Peppol participant ID, used to populate your invoices correctly. We do not register you on the Peppol network ourselves.
• Invoice data — buyer details, invoice lines, amounts, and references you enter when creating invoices. This data is used only to generate your PDF and UBL XML files; we do not transmit it over the Peppol network.
• Uploaded invoice files (optional) — if you use “Upload an existing invoice to prefill,” the file is sent to our AI provider, Anthropic, to read and extract field values for you to review. The file itself is not retained by us after extraction.
• Payment information — handled entirely by Stripe; we do not store your card details.
• Waitlist email (optional) — if you ask to be told when direct sending over Peppol becomes available, we keep your email address and the page you signed up on.
• Technical data — IP address, browser type, pages visited (anonymous analytics only).

Why we collect it (legal basis)

• Contract performance — to generate compliant UBL/PDF invoices on your behalf for you to send yourself.
• Legal obligation — invoice records may be required for VAT compliance.
• Consent — for the waitlist email: we use it only to send you one message if direct sending goes live, and you can withdraw consent at any time by replying to us.
• Legitimate interest — to operate, secure, and improve the service and to prevent fraud.

Who we share data with

We do not sell your personal data. We share data only with trusted service providers necessary to operate the service:

• Stripe — payment processing and subscription management.
• Anthropic (Claude API) — only if you use the optional invoice-upload prefill feature, to read and extract field values from the file. Inputs are retained by Anthropic for up to 30 days for safety and security monitoring, then permanently deleted. Anthropic does not use API data to train its models.
• Clerk — user authentication and identity management.
• Supabase — database hosting for your account and invoice data.
• Resend — transactional email delivery.
• Vercel — website hosting and serverless compute.

International data transfers

Where personal data is transferred outside the EEA — to Stripe, Clerk, Anthropic (if you use invoice-upload prefill), and Vercel, which operate partly in the United States — the transfer is protected by appropriate safeguards, namely Standard Contractual Clauses and/or the EU–US Data Privacy Framework, under each provider's data-processing terms. Supabase data is hosted in the EU region.

How long we keep your data

• Account and company data: retained for the life of your account, then deleted within 90 days of closure.
• Invoice records: retained for 7 years as required by Irish VAT and accounting law.
• Payment records: kept as legally required (Irish tax law — 7 years).
• Contact messages: deleted within 12 months.
• Waitlist emails: deleted when direct sending launches and you have been notified, or within 12 months if we decide not to build it.

Your rights under GDPR

Cookies

We use only essential cookies required to operate the site (authentication session cookies set by Clerk). We do not use advertising or tracking cookies.

Complaints

If you believe your data has been mishandled, you have the right to lodge a complaint with the Data Protection Commission (Ireland).

Changes to this notice

We may update this notice from time to time. The “last updated” date at the top of this page will reflect any changes. Continued use of the site after changes constitutes acceptance.