Terms & Conditions

1. Operator and Contract Structure

The Service is operated by Sine Aspera Ad Astra GmbH, Sternstr. 11, 80538 Munich, Germany, represented by its managing director Felix Graeber. Commercial register: Amtsgericht München, HRB 313338

These Terms govern use of Invoice-Converter.com, the web application, paid plans, prepaid conversion credits, External API access, and related support unless a written order form expressly states otherwise. Customer purchase orders, procurement terms, MSAs, DPAs, security addenda, or other customer paper apply only if we expressly agree to them in text form. Performing the Service or accepting a payment alone does not constitute such agreement.

Enterprise and production API access are self-service features of an active Enterprise subscription. They do not require separate approval or account-feature provisioning. The standard Terms and Data Processing Agreement apply; a separate order form is required only for custom terms agreed by both parties.

Individually agreed terms take precedence. Otherwise, the Data Processing Agreement, including its annexes, takes precedence for data protection matters, and an order form concluded by both parties takes precedence for all other matters; these Terms and the agreed service documentation, in particular the API documentation, apply thereafter. Mandatory data protection law and applicable Standard Contractual Clauses remain unaffected.

Changes to these Terms for existing contracts require express agreement. Silence or mere continued use does not constitute consent. Without such agreement, the previously agreed version continues to apply.

2. Service Scope

Invoice Converter provides invoice extraction, conversion, validation assistance, and workflow support for structured e-invoicing formats such as XRechnung, ZUGFeRD, Factur-X, UBL, CII, EN 16931, and related profiles. The Service is not legal, tax, accounting, or archiving advice.

You are responsible for source-data accuracy, professional review, tax and accounting decisions, buyer requirements, Peppol or portal delivery, ERP import, statutory deadlines, and final use of generated artifacts. Validation proofs and diagnostics are technical evidence produced by the documented pipeline; they are not a guarantee of legal compliance, authority acceptance, buyer acceptance, routing acceptance, or ERP acceptance.

Paid business use may include production workflows, but you must maintain reasonable backup and fallback processes for invoice creation, review, correction, delivery, archiving, deadlines, and buyer or authority acceptance. The Service must not be your sole process for time-critical invoicing obligations.

3. Accounts, Plans, and Payment

Paid features may require subscriptions, prepaid credits, Enterprise billing, or another agreed payment model. You must provide accurate billing information and pay all fees when due. We may suspend paid features for payment default, chargebacks, fraud risk, or misuse in accordance with Section 10.

The public money-back guarantee applies only where its own conditions are met. It does not automatically apply to Enterprise order forms, prepaid API credits, API validation failures, source-document insufficiency, unsupported buyer requirements, or downstream rejection by buyers, authorities, networks, or ERP systems.

For External API usage, one API credit or billable unit is consumed when a conversion request is accepted for processing. If the request cannot be accepted after a credit was reserved, the credit is refunded according to the API credit ledger. Validation failures after acceptance do not automatically create a refund right; statutory rights in the event of defective performance remain unaffected.

4. External API Terms

External API access is included with an active Enterprise subscription and does not need separate account approval. Access may be limited, paused, or withdrawn under these Terms. API keys are confidential server-side credentials. You must not embed them in browser applications, mobile applications, public repositories, client-side code, logs, screenshots, support tickets, or any location where unauthorized parties may access them.

You are responsible for activity under your API keys unless you are not responsible for an unauthorized use, in particular because it resulted from our breach. You must rotate or revoke keys that may be compromised. We may throttle, reject requests, rotate or revoke keys, suspend tenants, or block traffic where necessary for security, abuse prevention, legal or compliance risk, non-payment, excessive load, platform stability, subprocessor protection, or protection of other customers; Section 10 applies to suspensions.

API access is for your internal business purposes only. You may not resell, sublicense, white-label, expose, proxy, or operate the API as part of a public third-party-facing product, service bureau, or shared service unless expressly agreed in a separate partner agreement.

Affiliated companies of the customer within the meaning of Sections 15 et seq. of the German Stock Corporation Act (AktG) that are named in an order form may use the Service for their internal business purposes within the shared quota; this is not a shared service. The customer remains the sole contracting party and is responsible for their use in accordance with the contract and for any required data processing engagements and authorizations.

Additive API changes may be made at any time. Other technical changes are permitted where they are objectively justified, reasonable for you, and preserve the agreed core service. We announce planned breaking changes by email with reasonable advance notice, and to Enterprise customers at least 30 calendar days in advance. Where urgent security reasons or mandatory law require an earlier change, we inform you as early as possible. We do not promise indefinite legacy support.

5. Availability and Support

We provide the Service using commercially reasonable efforts. Business-hours support may be available for paid B2B and Enterprise/API customers, but no uptime, response-time, processing-time, delivery-time, validation-availability, or support SLA applies unless expressly agreed in a separate written order form.

Support targets, onboarding statements, or documentation estimates are non-binding unless expressly stated as binding in a written order form. No contractual penalties, liquidated damages, or automatic service credits apply unless separately agreed in writing. Statutory rights in the event of defective performance remain unaffected.

6. Customer Data and Permitted Use

You retain ownership of uploaded invoices and other customer content. You grant us the limited rights necessary to provide, secure, troubleshoot, support, and improve the Service for you, to assure the quality of conversion results, and to comply with legal obligations. For quality assurance, we retain conversion evidence for a limited period and review it in automated audits and by authorized personnel to detect and correct conversion errors, as described in the Privacy Policy and the Data Processing Agreement. Customer invoice content is not used for model training, reusable datasets, benchmarking, or product analytics unless you give explicit written permission.

You must not upload special-category personal data, criminal-offence data, payment-card data, identity documents, passwords, secrets, HR records, healthcare records, or unrelated sensitive datasets unless strictly necessary and expressly agreed in writing. If such data appears incidentally in invoice content, you remain responsible for ensuring that the upload is lawful, necessary, and minimized.

You must not use the Service as an autonomous decision system or as the sole basis for legal, tax, accounting, creditworthiness, insurance, employment, healthcare, public benefit, sanctions, fraud, or other high-risk regulated decisions.

7. Privacy and Data Processing

Our Privacy Policy explains controller-side processing such as account, billing, product, analytics, support, and security processing. Where we process invoice content on behalf of a business customer, our Data Processing Agreement applies.

Data retention follows the standard retention model described in the Privacy Policy and DPA. We do not provide customer-specific retention schedules, data residency commitments, or custom deletion workflows unless expressly agreed in writing.

8. Security Testing and Audit Requests

You may not conduct production penetration tests, vulnerability scans, load tests, social engineering, destructive testing, source-code access attempts, infrastructure access attempts, or similar security testing without prior written approval.

For Enterprise/API customers, we provide remote evidence on request, such as our DPA, subprocessor list, TOMs, retention summary, incident process, and reasonable written security questionnaire responses. Control rights, including inspections, under Section 7 of the DPA remain unaffected; they do not cover security testing without our approval. Beyond those rights, on-site audits, source-code access, infrastructure access, secrets, credentials, or access to other tenants are not included unless separately agreed in writing.

9. Liability

Toward business customers, we are liable without limitation for intent and gross negligence, for injury to life, body, or health, for fraudulent concealment of a defect, to the extent of any guarantee we have given, and under mandatory statutory provisions, in particular the German Product Liability Act.

Otherwise, for slight negligence we are liable only for breach of essential contractual obligations. Essential obligations are those whose fulfillment makes the proper performance of the contract possible in the first place and on whose compliance the customer may regularly rely. In that case, liability is limited to the damage that was foreseeable and typical for this type of contract at the time the contract was concluded. Liability for slight negligence is otherwise excluded.

These provisions also apply in favor of our legal representatives, employees, and vicarious agents. The defense of contributory fault (Section 254 of the German Civil Code) remains unaffected, in particular where damage results from missing review, fallback, archiving, delivery, or deadline processes under Section 2. Mandatory claims under the GDPR and mandatory consumer rights remain unaffected.

10. Termination, Suspension, and Switching

You may terminate your account by contacting contact@invoice-converter.com; cancellation options of your plan, such as cancellation at the end of the billing period, remain unaffected. Each party's right to terminate for good cause under the statutory requirements remains unaffected.

A suspension requires an objective reason, such as payment default, chargebacks, fraud risk, misuse, a material breach of these Terms, a security threat, or an unreasonable operational load, and is limited to what is necessary. Where reasonable, we announce a suspension in advance in text form, state the reason, and give you an opportunity to remedy it; for payment default, the remedy period is ten calendar days. We suspend without prior notice only where necessary to avert a specific security threat, unlawful use, or significant damage to us, our subprocessors, or other customers, and we then inform you without undue delay. We lift a suspension as soon as its reason ceases to exist.

Switching and data export (EU Data Act): you may request, with a notice period of no more than two months in text form, that your exportable data be transferred to another provider or to your own IT infrastructure, or that it be deleted. Exportable data are all existing input and output data, including metadata, the account, settings, permission, and usage data of your account, and digital assets you have an independent right to use, including data of these categories generated during the switch. Excluded are our software, models, prompts, and internal security logs, insofar as their disclosure would affect intellectual property rights, trade secrets, or the security of the Service; customer-related usage metadata remain exportable, and exclusions must neither hinder nor delay the switch. Export is available through the API and the download functions and, on request, in a common machine-readable format such as JSON or CSV; the API documentation describes the data formats used.

The switch takes place without undue delay and no later than 30 calendar days after the end of the notice period; you may extend this transitional period once by a period you consider more appropriate for your purposes. If this period is technically not feasible, we explain this within 14 working days of your switching request and state an alternative transitional period of no more than seven months. During the transition, we continue the agreed services, support your exit strategy with all relevant information, inform you of known risks to continuity, and maintain a high level of security, also during the transfer and the subsequent retrieval period. We provide the exportable data in an export package that remains available for retrieval for at least 30 calendar days after the end of the transitional period and is then deleted completely once the switch has been completed successfully; this period takes precedence over the standard deletion periods. The contract ends upon successful completion of the switch or, where deletion was requested, at the end of the notice period; we confirm the termination to you. We do not charge switching fees. Annex 1 and Sections 5 and 6 of the DPA describe where the IT infrastructure used is located and the safeguards for third-country transfers and access.

11. Governing Law and Contact

German law applies, excluding conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. For merchants and business customers, the courts at our registered seat have jurisdiction where legally permissible. Mandatory consumer jurisdiction rules remain unaffected.

Contact: contact@invoice-converter.com. Provider details are available in the Imprint.