Last updated: October 14, 2026
1. Controller
The controller for this website, account management, billing, product, support, security, and marketing processing is Sine Aspera Ad Astra GmbH, Sternstr. 11, 80538 Munich, Germany, represented by its managing director Felix Graeber. Commercial register: Amtsgericht München, HRB 313338
Email: contact@invoice-converter.com. No Data Protection Officer has been appointed because the statutory appointment requirements are not currently met.
2. What We Process
Website and security data: IP address, request metadata, timestamps, user agent, referrer, cookie consent state, rate-limit events, security events, error logs, and correlation IDs. Legal basis: Art. 6(1)(f) GDPR.
Account and billing data: email address, authentication identifiers, plan, subscription status, API-credit balance, Stripe customer and invoice references, language preferences, and service communications. Legal basis: Art. 6(1)(b), Art. 6(1)(c), and Art. 6(1)(f) GDPR.
Invoice conversion data: uploaded documents, extracted invoice fields, supplier and customer names, addresses, tax IDs, VAT IDs, IBAN/BIC, line items, amounts, generated XML/PDF artifacts, validation proofs, hashes, diagnostics, support/debug bundles, and conversion quality-assurance evidence where needed to provide the requested workflow and to assure the quality of conversion results.
Chrome extension data: when you connect the extension, it stores the OAuth session and current conversion state in Chrome extension storage. It uploads only the invoice file that you select and only after you start a conversion. It does not read web-page content, browsing history, open tabs, or unrelated local files. Google user data received through the extension is used only to provide and secure the user-facing conversion workflow. This use complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or transfer it for credit, lending, or unrelated purposes.
External API data: tenant IDs, API key IDs, API key prefixes, idempotency keys, request hashes, endpoint, method, status, correlation IDs, usage and audit events, rate-limit denials, credit-ledger events, filenames where supplied, format/profile/jurisdiction hints, and technical metadata needed for authentication, billing, security, troubleshooting, and idempotent retries. Plaintext API keys are not intentionally stored after creation.
ChatGPT plugin data: when you connect Invoice Converter to ChatGPT, we process OAuth identifiers, account entitlement and acquisition source, task IDs, requested output format, timestamps, validation error and warning counts, artifact status and size, and the entitlement type used. At your request, OpenAI transmits the selected invoice file to our MCP server for conversion. Plugin analytics exclude invoice content, filenames, customer names, and invoice values.
Analytics and session replay: only after consent, we use product analytics and session replay to understand product usage and improve the Service. We configure analytics to avoid invoice content and do not use invoice content for product analytics.
YouTube videos in blog articles: some blog articles show a video. Until you click play, your browser loads nothing from YouTube or Google; the article shows a preview image from our own server. When you click play, your browser loads the player from youtube-nocookie.com, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives at least your IP address, browser information and the address of the article, can store information on your device, and can transfer data to Google LLC in the USA. For Google's own processing of this data, see Google's privacy policy at https://policies.google.com/privacy. Legal basis: your consent by clicking play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). To withdraw it, stop the video and leave or reload the page. A plain link to the video on YouTube is next to the player. With analytics consent, we record that you started the video (article, languages and video ID).
Download reminder (service message): when you are signed in and reach the download step, we keep the finished e-invoice file (for ZUGFeRD and Factur-X, this is your PDF with the embedded XML) for 24 hours after it was saved, store when it was kept and the conversion reference, and send you one service e-mail with a link to the file if you do not download it. The reminder is part of the automated e-mails in your profile; the download step has no separate control. If automated e-mails are off, we keep no file for a reminder. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our interest is to help you finish the download of your own e-invoice before we delete it. You can object at any time: turn off automated e-mails in your profile or use the unsubscribe link in the reminder e-mail. We then send no reminder, and a kept file is deleted no later than 24 hours after it was saved.
Control address and change protocol (Enterprise): if you set a control address, we store that e-mail address, your protocol options and value-free events (for example "control address confirmed" or "change protocol sent") with their times. A confirmation link is stored only as a hash and expires after 48 hours. A requested change (a new control address or new protected bank details), the address its link went to and the link's hash are stored only until the request is confirmed, rejected, replaced by a newer request or expired; after that we keep only its type, status and times. After each confirmed review with changes, we send a protocol e-mail through our e-mail provider to the control address and, if you choose, a copy to your account address. By default it names the changed fields, your account e-mail, the time, the document name and the invoice number. If you turn on values, it also contains the old and new values; we build them only to send the e-mail and keep no copy. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Marketing and automated emails: promotional email is sent only where permitted by law, including consent or an applicable existing-customer exception. Automated emails (reminders, tips, and offers that we send automatically) contain a one-click unsubscribe link. You can also turn them off in your profile. We then store only the time of your opt-out. Service, security, billing, and transactional emails are not marketing and continue.
3. Processing on Behalf of Customers
For business customers, invoice content is usually processed by us as processor on the customer's behalf. The customer remains responsible for the lawfulness of uploaded invoice data, data minimization, source-data accuracy, review, delivery, archiving, and final legal, tax, or accounting decisions. Our Data Processing Agreement governs this processing where Art. 28 GDPR applies.
Customer invoice content is used only to provide, secure, troubleshoot, support, and operate the Service, to assure the quality of conversion results, and to comply with legal obligations. For quality assurance, retained conversion evidence is reviewed in automated audits, which can use the AI subprocessors named below, and by authorized personnel to detect and correct conversion errors. Customer invoice content is not used for model training, reusable datasets, benchmarking, or product analytics unless the customer gives explicit written permission.
Quality evidence opt-out (Enterprise): Enterprise customers can switch quality-assurance evidence off in their profile. From at most one minute after that, we store no new evidence from their conversions for quality assurance: no copies of source files, recognized text, extracted or reviewed invoice data, generated artifacts, or debug bundles. Switching it off also deletes the evidence stored earlier, at the latest within one day. Processing, downloads, billing, operational logs, and value-free statistics continue. A saved opt-out stays in force after a plan change. Conversions already running when the switch takes effect can still finish under the previous setting.
4. Subprocessors and Transfers
We use subprocessors for hosting, security, AI/OCR processing, authentication, storage, billing, email, analytics, and error telemetry. Depending on the workflow, providers may include Vercel, Koyeb, Cloudflare, Supabase, OpenAI, Mistral AI, Google Ireland/Google LLC (only for sign-in with Google), Stripe, Brevo, PostHog, and Sentry.
Processing is intended to use EU infrastructure where available, but we do not promise Germany-only or EU-only processing. Third-country transfers may occur, for example through AI providers, security providers, support access, telemetry, or global network infrastructure. Where required, we rely on Standard Contractual Clauses and additional safeguards.
5. Retention
| Data | Standard retention |
|---|---|
| Terminal processing tasks outside the External API | Usually available for about 10 minutes after completion or failure. |
| Finished e-invoice file and reminder record for the download reminder | 24 hours after the file was saved, then deleted together with the reminder record. Not kept while automated e-mails are off in your profile. |
| Control address, protocol options and their value-free events | Until you delete your account; a removed control address is cleared at once. A requested change and its confirmation link: until the request is confirmed, rejected, replaced or expired (links expire after 48 hours); then only its type, status and times remain. We keep no copy of protocol e-mails. |
| External API tasks and results | 24 hours after the task reaches a terminal state (completed or failed). A failed task with a pending credit release is kept until that release completes. |
| External API idempotency records | 24 hours by default. |
| Generated artifacts, validation proofs, and diagnostics | Temporarily retained where needed for async processing, download, strict validation proof, restart recovery, or troubleshooting. Debug bundles are retained for up to 14 days by default. |
| Conversion quality-assurance evidence | Raw evidence files, such as uploaded source files, recognized text, extracted and reviewed invoice data, and generated artifacts, expire 30 days after capture and are then deleted by periodic cleanup. Case metadata and audit findings are retained for up to 365 days. Not stored for new conversions of Enterprise accounts that switched quality evidence off. If you delete your account or switch quality evidence off, we delete this evidence within one day. |
| Security, application, and audit logs | Event logs are retained according to the deployed log-retention setting, currently expected to be 30 days unless changed. Aggregate logs may be retained longer, currently up to 365 days by default. |
| Conversion problem reports and ratings | Attached files: 30 days, then deleted by periodic cleanup; if you delete your account, within 2 days. Contact e-mail: 12 months after the report, or earlier when you delete your account. On account deletion, the link to your account and any publication consent are also removed. The report text and rating are kept without contact data to improve the conversion. |
| Account, contract, and billing records | For the account or contract term and then as required for statutory, tax, accounting, fraud-prevention, and dispute purposes. |
| Marketing and automated-email preferences | Until unsubscribe, account deletion, or objection, with suppression records retained where needed to respect opt-outs. The automated-email opt-out is kept until you turn automated emails on again or delete your account. |
We do not operate a permanent central archive of uploaded customer invoice documents. Some records may be retained longer where required by law, to establish or defend legal claims, to investigate abuse or security events, or to maintain billing and audit integrity.
6. Your Rights
Subject to statutory requirements, you may request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You may also lodge a complaint with a data protection authority, for example the Bavarian State Office for Data Protection Supervision.
7. Security and Incidents
We use HTTPS, access controls, role-based administration, least-privilege access, logging, tenant separation, secret handling, and provider-side infrastructure security controls. No internet service can be guaranteed completely secure.
We notify affected customers and authorities as required by law after confirming a relevant personal-data breach. Any timing targets are operational targets, not service credits or contractual penalties unless expressly agreed in writing.
8. Contact
Sine Aspera Ad Astra GmbH
Sternstr. 11, 80538 Munich, Germany
Email: contact@invoice-converter.com