Last updated: October 30, 2026
1. Controller
The controller for this website, account management, billing, product, support, security, and marketing processing is Sine Aspera Ad Astra GmbH, Sternstr. 11, 80538 Munich, Germany, represented by its managing director Felix Graeber. Commercial register: Amtsgericht München, HRB 313338
Email: contact@invoice-converter.com. No Data Protection Officer has been appointed because the statutory appointment requirements are not currently met.
2. What We Process
Website and security data: IP address, request metadata, timestamps, user agent, referrer, cookie consent state, rate-limit events, security events, error logs, and correlation IDs. Legal basis: Art. 6(1)(f) GDPR.
Account and billing data: email address, authentication identifiers, plan, subscription status, API-credit balance, Stripe customer and invoice references, language preferences, and service communications. Legal basis: Art. 6(1)(b), Art. 6(1)(c), and Art. 6(1)(f) GDPR.
Invoice conversion data: uploaded documents, extracted invoice fields, supplier and customer names, addresses, tax IDs, VAT IDs, IBAN/BIC, line items, amounts, generated XML/PDF artifacts, validation proofs, hashes, diagnostics, support/debug bundles, and conversion quality-assurance evidence where needed to provide the requested workflow and to assure the quality of conversion results.
Chrome extension data: when you connect the extension, it stores the OAuth session and current conversion state in Chrome extension storage. It uploads only the invoice file that you select and only after you start a conversion. It does not read web-page content, browsing history, open tabs, or unrelated local files. Google user data received through the extension is used only to provide and secure the user-facing conversion workflow. This use complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or transfer it for credit, lending, or unrelated purposes.
External API data: tenant IDs, API key IDs, API key prefixes, idempotency keys, request hashes, endpoint, method, status, correlation IDs, usage and audit events, rate-limit denials, credit-ledger events, filenames where supplied, format/profile/jurisdiction hints, and technical metadata needed for authentication, billing, security, troubleshooting, and idempotent retries. Plaintext API keys are not intentionally stored after creation.
ChatGPT plugin data: when you connect Invoice Converter to ChatGPT, we process OAuth identifiers, account entitlement and acquisition source, task IDs, requested output format, timestamps, validation error and warning counts, artifact status and size, and the entitlement type used. At your request, OpenAI transmits the selected invoice file to our MCP server for conversion. Plugin analytics exclude invoice content, filenames, customer names, and invoice values.
Analytics and session replay: only after consent, we use product analytics and session replay to understand product usage and improve the Service. We configure analytics to avoid invoice content and do not use invoice content for product analytics.
Google Ads conversion measurement: if you reach our website through a Google ad, its address carries a click ID (gclid) and campaign parameters. Only after you accept cookies do we store the click ID in your browser, for up to 90 days, and attach it to your sign-up and to the Stripe checkout of a purchase. We then send Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, the click ID with the type, time and value of the conversion (for example a started trial or a purchase), so that we can see which ads lead to customers. No Google script runs on our website, and we send no name, email address or invoice content. We do not use the data for personalized advertising or remarketing. Google can transfer data to Google LLC in the USA. How Google uses this data: https://business.safety.google/privacy/ and Google's privacy policy at https://policies.google.com/privacy. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time under "Cookie settings" at the bottom of every page; we then delete the stored copy in your browser. A click ID already attached to a purchase stays in its billing records.
YouTube videos in blog articles: some blog articles show a video. Until you click play, your browser loads nothing from YouTube or Google; the article shows a preview image from our own server. When you click play, your browser loads the player from youtube-nocookie.com, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives at least your IP address, browser information and the address of the article, can store information on your device, and can transfer data to Google LLC in the USA. For Google's own processing of this data, see Google's privacy policy at https://policies.google.com/privacy. Legal basis: your consent by clicking play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). To withdraw it, stop the video and leave or reload the page. A plain link to the video on YouTube is next to the player. With analytics consent, we record that you started the video (article, languages and video ID).
Download reminder (service message): when you are signed in and reach the download step, we keep the finished e-invoice file (for ZUGFeRD and Factur-X, this is your PDF with the embedded XML) for 24 hours after it was saved, store when it was kept and the conversion reference, and send you one service e-mail with a link to the file if you do not download it. The reminder is part of the automated e-mails in your profile; the download step has no separate control. If automated e-mails are off, we keep no file for a reminder. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our interest is to help you finish the download of your own e-invoice before we delete it. You can object at any time: turn off automated e-mails in your profile or use the unsubscribe link in the reminder e-mail. We then send no reminder, and a kept file is deleted no later than 24 hours after it was saved.
Saved review link: if you ask us on the review or download step to keep a result for 7 days, we store the source PDF of that one invoice, the extracted data, your reviewed data and technical file facts (file name, size and processing references). We do not store the finished e-invoice. We send one e-mail with the link to the address you enter, through our e-mail provider Brevo; the e-mail contains no file name and no invoice data. We do not store the address with the saved copy or write it to our logs. To limit the link e-mails to three per address and day, we keep a one-way hash of the address and of your IP address in a counter that is deleted after 2 days. The send form uses Cloudflare Turnstile to block automated requests; Cloudflare receives the technical browser data needed for this check. The link contains a random key, of which we store only a hash. Anyone with the link can open the saved copy, so do not forward it. The copy is deleted 7 days after it was saved, or at once when you choose "Delete now" on the page behind the link. Because we do not store your address, we cannot find the copy without the link: deletion works through the link or by expiry. Saved copies are not used for quality assurance. Legal basis: Art. 6(1)(b) GDPR (a service you request).
Control address and change protocol (Enterprise): if you set a control address, we store that e-mail address, your protocol options and value-free events (for example "control address confirmed" or "change protocol sent") with their times. A confirmation link is stored only as a hash and expires after 48 hours. A requested change (a new control address or new protected bank details), the address its link went to and the link's hash are stored only until the request is confirmed, rejected, replaced by a newer request or expired; after that we keep only its type, status and times. After each confirmed review with changes, we send a protocol e-mail through our e-mail provider to the control address and, if you choose, a copy to your account address. By default it names the changed fields, your account e-mail, the time, the document name and the invoice number. If you turn on values, it also contains the old and new values; we build them only to send the e-mail and keep no copy. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Marketing and automated emails: promotional email is sent only where permitted by law, including consent or an applicable existing-customer exception. Automated emails (reminders, tips, and offers that we send automatically) contain a one-click unsubscribe link. You can also turn them off in your profile. We then store only the time of your opt-out. Service, security, billing, and transactional emails are not marketing and continue.
3. Processing on Behalf of Customers
For business customers, invoice content is usually processed by us as processor on the customer's behalf. The customer remains responsible for the lawfulness of uploaded invoice data, data minimization, source-data accuracy, review, delivery, archiving, and final legal, tax, or accounting decisions. Our Data Processing Agreement governs this processing where Art. 28 GDPR applies.
Customer invoice content is used only to provide, secure, troubleshoot, support, and operate the Service, to assure the quality of conversion results, and to comply with legal obligations. For quality assurance, retained conversion evidence is reviewed in automated audits, which can use the AI subprocessors named below, and by authorized personnel to detect and correct conversion errors. Customer invoice content is not used for model training, reusable datasets, benchmarking, or product analytics unless the customer gives explicit written permission.
Quality evidence opt-out (Enterprise): Enterprise customers can switch quality-assurance evidence off in their profile. From at most one minute after that, we store no new evidence from their conversions for quality assurance: no copies of source files, recognized text, extracted or reviewed invoice data, generated artifacts, or debug bundles. Switching it off also deletes the evidence stored earlier: account links and invoice content in active records at once, related files within one day; blocked backup copies are deleted no later than after 30 days. Processing, downloads, billing, operational logs, and value-free statistics continue. A saved opt-out stays in force after a plan change. Conversions already running when the switch takes effect can still finish under the previous setting.
4. Subprocessors and Transfers
We use subprocessors for hosting, security, AI/OCR processing, authentication, storage, billing, email, analytics, and error telemetry. Depending on the workflow, providers may include Vercel, Koyeb, Cloudflare, Supabase, OpenAI, Microsoft Ireland Operations Limited (Azure OpenAI, primary for API, email and batch conversions, fallback for web conversions, and the only AI provider for Enterprise accounts with EU-only AI processing), Mistral AI, Google Ireland/Google LLC (for sign-in with Google and, with your consent, Google Ads conversion measurement), Stripe, Brevo, PostHog, and Sentry.
Processing is intended to use EU infrastructure where available, but we do not promise Germany-only or EU-only processing. The optional EU-only AI processing of Enterprise accounts covers AI processing only. Third-country transfers may occur, for example through AI providers, security providers, support access, telemetry, or global network infrastructure. Such transfers rely on an adequacy decision (for the USA, the EU-U.S. Data Privacy Framework where the recipient is certified) or otherwise on Standard Contractual Clauses with supplementary safeguards where required.
EU Data Zone note: Microsoft Azure OpenAI
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, processes invoice content and metadata for AI extraction through the Azure OpenAI Service (Azure AI Foundry). It is used first for API, email and batch conversions; web conversions start with OpenAI. If the first provider is unavailable or out of capacity, the other can be used. For Enterprise accounts that switch on EU-only AI processing in their profile, it is the only AI provider: their invoices are not sent to OpenAI, and text recognition runs on Mistral AI (EU/EEA). If the EU processing is unavailable, the conversion fails instead of using another provider.
- Hosting in the EU Data Zone: a dedicated production resource in an EU Azure region is used, exclusively with EU Data Zone deployments. Prompts and responses are processed only within the EU Data Zone, and data stored at rest stays in the Azure geography of that resource. For this processing, Invoice Converter sends no data to Microsoft regions outside the EU Data Zone.
- Scope of the EU Data Zone: according to Microsoft, the EU Data Zone follows the EU Data Boundary. Besides the EU member states, it can also include EFTA countries such as Norway (part of the EEA) and Switzerland (not part of the EEA, but covered by an EU adequacy decision).
- Exceptions documented by Microsoft: Microsoft describes limited transfers out of its EU Data Boundary, for example rare remote access by Microsoft personnel for maintenance or for security operations. Microsoft's Data Protection Addendum, which includes the EU Standard Contractual Clauses, covers such transfers.
- No training: according to Microsoft, prompts and responses are not available to OpenAI or other customers and are not used to train, retrain, or improve the base models.
- Abuse monitoring: Microsoft checks prompts and responses automatically for misuse of its service and can keep them for this purpose in a data store in the Azure geography of the resource. Authorized Microsoft employees can access them only when Microsoft's systems flag them as potentially abusive; for deployments in the EEA, these employees are located in the EEA. Microsoft does not publish a fixed storage period for this purpose. This storage and human review do not take place if Microsoft has approved modified abuse monitoring for the resource.
Controllers can object for material data protection reasons under Section 5 of the Data Processing Agreement by contacting contact@invoice-converter.com.
5. Retention
| Data | Standard retention |
|---|---|
| Terminal processing tasks outside the External API | Usually available for about 10 minutes after completion or failure. |
| Finished e-invoice file and reminder record for the download reminder | 24 hours after the file was saved, then deleted together with the reminder record. Not kept while automated e-mails are off in your profile. |
| Saved review link: source PDF, extracted and reviewed data, file facts | 7 days after saving, or at once through "Delete now" on the page behind the link. The e-mail address is not stored; its hash in the rate-limit counter is deleted after 2 days. |
| Control address, protocol options and their value-free events | Until you delete your account; a removed control address is cleared at once. A requested change and its confirmation link: until the request is confirmed, rejected, replaced or expired (links expire after 48 hours); then only its type, status and times remain. We keep no copy of protocol e-mails. |
| External API tasks and results | 24 hours after the task reaches a terminal state (completed or failed). A failed task with a pending credit release is kept until that release completes. |
| External API idempotency records | 24 hours by default. |
| Generated artifacts, validation proofs, and diagnostics | Temporarily retained where needed for async processing, download, strict validation proof, restart recovery, or troubleshooting. Debug bundles are retained for up to 14 days by default. |
| Conversion quality-assurance evidence | Raw evidence files, such as uploaded source files, recognized text, extracted and reviewed invoice data, and generated artifacts, expire 30 days after capture and are then deleted by periodic cleanup. Case metadata and audit findings are retained for up to 365 days. Not stored for new conversions of Enterprise accounts that switched quality evidence off. If you delete your account or switch quality evidence off, we remove account links and invoice content in active records at once and related files within one day; blocked backup copies are deleted no later than after 30 days. |
| Security, application, and audit logs | Event logs are deleted after 30 days, aggregated error statistics after 365 days. Monthly AI cost totals per account are kept while the account exists and are made anonymous when it is deleted. |
| Backups | Daily database backups at the hosting provider: 7 days. Additional encrypted backups: no more than 30 days. They are then overwritten and are used only for restoration. |
| Conversion problem reports and ratings | Attached files: 30 days, then deleted by periodic cleanup; if you delete your account, within 2 days. Contact e-mail: 12 months after the report, or earlier when you delete your account. On account deletion, the link to your account and any publication consent are also removed. The report text and rating are kept without contact data to improve the conversion. |
| Account, contract, and billing records | For the account or contract term and then as required for statutory, tax, accounting, fraud-prevention, and dispute purposes. |
| Marketing and automated-email preferences | Until unsubscribe, account deletion, or objection, with suppression records retained where needed to respect opt-outs. The automated-email opt-out is kept until you turn automated emails on again or delete your account. |
We do not operate a permanent central archive of uploaded customer invoice documents. Longer retention for our own purposes of legal defense, security, or billing applies only to data we lawfully process as controller; for personal data processed on behalf of customers, Section 9 of the DPA applies.
6. Your Rights
Subject to statutory requirements, you may request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You may also lodge a complaint with a data protection authority, for example the Bavarian State Office for Data Protection Supervision.
7. Security and Incidents
We use HTTPS, access controls, role-based administration, least-privilege access, logging, tenant separation, secret handling, encryption at rest at our hosting providers (according to their statements), encrypted backups, and provider-side infrastructure security controls. The DPA lists the technical and organizational measures. No internet service can be guaranteed completely secure.
After becoming aware of a personal-data breach, we notify the competent authority and affected persons as required by law; as a processor, we inform affected customers without undue delay in accordance with the DPA. Any timing targets are operational targets, not service credits or contractual penalties unless expressly agreed in writing.
8. Contact
Sine Aspera Ad Astra GmbH
Sternstr. 11, 80538 Munich, Germany
Email: contact@invoice-converter.com