Last updated: November 12, 2026
1. Controller
The controller for this website, account management, billing, product, support, security, and marketing processing is Sine Aspera Ad Astra GmbH, Sternstr. 11, 80538 Munich, Germany, represented by its managing director Felix Graeber. Commercial register: Amtsgericht München, HRB 313338
Email: contact@invoice-converter.com. No Data Protection Officer has been appointed because the statutory appointment requirements are not currently met.
2. What We Process
Website and security data: IP address, request metadata, timestamps, user agent, referrer, cookie consent state, rate-limit events, security events, error logs, and correlation IDs. Legal basis: Art. 6(1)(f) GDPR.
Account and billing data: email address, authentication identifiers, plan, subscription status, API-credit balance, Stripe customer and invoice references, language preferences, and service communications. Legal basis: Art. 6(1)(b), Art. 6(1)(c), and Art. 6(1)(f) GDPR.
Invoice conversion data: uploaded documents, extracted invoice fields, supplier and customer names, addresses, tax IDs, VAT IDs, IBAN/BIC, line items, amounts, generated XML/PDF artifacts, validation proofs, hashes, diagnostics, support/debug bundles, and conversion quality-assurance evidence where needed to provide the requested workflow and to assure the quality of conversion results.
Resume copy in your browser: when you convert an invoice in the web app, your browser keeps the uploaded file, the extracted data and your review in its storage on your device. With this copy you can continue after a reload. The copy expires 24 hours after your last activity in that conversion. Our website deletes an expired copy the next time you open it, and deletes the copy at once when you sign out or someone signs in with another account. Legal basis: § 25(2) No. 2 TDDDG (strictly necessary storage) and Art. 6(1)(b) GDPR.
Chrome extension data: when you connect the extension, it stores the OAuth session and current conversion state in Chrome extension storage. It uploads only the invoice file that you select and only after you start a conversion. It does not read web-page content, browsing history, open tabs, or unrelated local files. Google user data received through the extension is used only to provide and secure the user-facing conversion workflow. This use complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or transfer it for credit, lending, or unrelated purposes.
External API data: tenant IDs, API key IDs, API key prefixes, idempotency keys, request hashes, endpoint, method, status, correlation IDs, usage and audit events, rate-limit denials, credit-ledger events, filenames where supplied, format/profile/jurisdiction hints, and technical metadata needed for authentication, billing, security, troubleshooting, and idempotent retries. Plaintext API keys are not intentionally stored after creation.
Email Import (Enterprise): when you send invoices to your Email Import address, our e-mail provider Brevo receives the message and passes it to us. For each message we store the sender, the recipients, the subject, the headers, the results of the spam and sender checks, the attachment details, the status and the body. The body can contain your instructions for the conversion. We convert the attached PDFs and send the e-invoices and validation reports back by e-mail. Legal basis: Art. 6(1)(b) GDPR (performance of the contract). Section 3 applies to the invoice content.
Invoice activity (Enterprise): for each invoice that you confirm in the review, we keep a history in your account: the file name, each confirmed review version, which fields were changed and how (added, removed or updated), failed validations, exports and download starts, each with its time. The history holds no field values. While your account has the Enterprise plan, you can delete the history of an invoice in your profile. After a downgrade, our support deletes it on request. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Connected assistant data: When you connect ChatGPT, Claude or Google, we process OAuth identifiers, account entitlement, acquisition source, task IDs, output format, timestamps, validation counts, artifact status and size, and the entitlement used. At your request, invoice data and results are shared with the selected assistant provider. You provide the PDF through that provider or our upload page. Connector analytics exclude invoice content, filenames, customer names and invoice values.
Mobile apps
E-Invoice Converter (E-Rechnung Konverter) is provided by Sine Aspera Ad Astra GmbH. Reading a selected invoice on the device does not upload it. Scans remain on the device until you start an online conversion. Files saved on your device remain under your control.
When you request an online conversion or create a structured invoice, the app sends the required invoice data to our service. The invoice-processing rules in Section 3 apply. Supabase processes account e-mail and authentication identifiers; session credentials use the operating system’s secure storage. Store purchases use transaction references and purchase history for verification and credit allocation. The app does not receive your payment-card details. Legal basis: Art. 6(1)(b) GDPR.
Sentry receives scrubbed error types, stack traces and technical diagnostics for reliability. Our app excludes invoice text, account identity and free-text error messages from these reports. Native crash reporting, hang reporting and automatic performance tracing are disabled. Legal basis: Art. 6(1)(f) GDPR (service reliability and security).
Optional usage analytics use PostHog’s EU endpoint only after your analytics consent. These data include app interactions and a persistent installation identifier. You can withdraw consent in the app’s privacy settings; this stops collection and clears queued analytics events. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
The Android scanner uses Google Play services ML Kit. Google documents collection of device/app information, installation or device identifiers, latency, configuration, input/output sizes and feature/error events. This SDK processing is separate from optional PostHog analytics. You can select an existing PDF instead of using the scanner.
Analytics and session replay: only after consent, we use product analytics and session replay to understand product usage and improve the Service. We configure analytics to avoid invoice content and do not use invoice content for product analytics. The analytics data also include your device model where your browser reports it (Chromium-based browsers on Android) and, for page-speed measurements (web vitals), the page element that loaded or responded slowest, described by its position in the page structure (CSS selector) without its text, the address of its image or file, and timing details. If you reach our website through a Meta ad (Facebook or Instagram), we remove Meta's click identifier (the fbclid parameter of the address or the _fbc cookie) and Meta's browser identifier (the _fbp cookie) from our analytics. Other ad click IDs in page addresses are masked in our analytics unless you have consented to ad conversion measurement (see below).
Counting visits from YouTube: if you open our website through a link from one of our YouTube videos (the address contains utm_source=youtube), our server counts this visit. It sends PostHog (EU) the page path, the time and the campaign name from the link, under a random ID that is new for every visit. We send no IP address, no cookie, no browser information and no other identifier, so we cannot link two visits or identify you. Nothing runs or is stored in your browser for this count, and it does not depend on cookie consent. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to know whether our videos bring visitors to the website.
Google Ads conversion measurement: if you reach our website through a Google ad, its address carries a click ID (gclid) and campaign parameters. Only after you accept cookies do we store the click ID in your browser, for up to 90 days, and attach it to your sign-up and to the Stripe checkout of a purchase. We then send Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, the click ID with the type, time and value of the conversion (for example a started trial or a purchase), so that we can see which ads lead to customers. No Google script runs on our website, and we send no name, email address or invoice content. We do not use the data for personalized advertising or remarketing. Google can transfer data to Google LLC in the USA. How Google uses this data: https://business.safety.google/privacy/ and Google's privacy policy at https://policies.google.com/privacy. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time under "Cookie settings" at the bottom of every page; we then delete the stored copy in your browser. A click ID already attached to a purchase stays in its billing records. To record your consent, we store a consent receipt on our server: a hash of a random token from your browser, the notice version and the times of consent and withdrawal. The receipt holds no click ID.
YouTube videos in blog articles: some blog articles show a video. Until you click play, your browser loads nothing from YouTube or Google; the article shows a preview image from our own server. When you click play, your browser loads the player from youtube-nocookie.com, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives at least your IP address, browser information and the address of the article, can store information on your device, and can transfer data to Google LLC in the USA. For Google's own processing of this data, see Google's privacy policy at https://policies.google.com/privacy. Legal basis: your consent by clicking play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). To withdraw it, stop the video and leave or reload the page. A plain link to the video on YouTube is next to the player. With analytics consent, we record that you started the video (article, languages and video ID).
Download reminder (service message): when you are signed in and reach the download step, we keep the finished e-invoice file (for ZUGFeRD and Factur-X, this is your PDF with the embedded XML) for 24 hours after it was saved, store when it was kept and the conversion reference, and send you one service e-mail with a link to the file if you do not download it. The reminder is part of the automated e-mails in your profile; the download step has no separate control. If automated e-mails are off, we keep no file for a reminder. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our interest is to help you finish the download of your own e-invoice before we delete it. You can object at any time: turn off automated e-mails in your profile or use the unsubscribe link in the reminder e-mail. We then send no reminder, and a kept file is deleted no later than 24 hours after it was saved.
Review reminder (service message): when you are signed in and leave the review step of a conversion before you reach the download step, we send you one service e-mail about 3 hours later with a link back to the converter, where you can continue in the same browser. For this we store the conversion reference, the converter page and when you started the review, but no invoice data and no file; we delete this record 24 hours after it was created. We send no review reminder once you reach the download step. The reminder is part of the automated e-mails in your profile; if they are off, we store nothing for it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our interest is to help you finish the conversion of your own invoice. You can object at any time: turn off automated e-mails in your profile or use the unsubscribe link in the reminder e-mail.
Saved review link: if you ask us on the review or download step to keep a result for 7 days, we store the source PDF of that one invoice, the extracted data, your reviewed data and technical file facts (file name, size and processing references). We do not store the finished e-invoice. We send one e-mail with the link to the address you enter, through our e-mail provider Brevo; the e-mail contains no file name and no invoice data. We do not store the address with the saved copy or write it to our logs. To limit the link e-mails to three per address and day, we keep a one-way hash of the address and of your IP address in a counter that is deleted after 2 days. The send form uses Cloudflare Turnstile to block automated requests; Cloudflare receives the technical browser data needed for this check. The link contains a random key, of which we store only a hash. Anyone with the link can open the saved copy, so do not forward it. The copy is deleted 7 days after it was saved, or at once when you choose "Delete now" on the page behind the link. Because we do not store your address, we cannot find the copy without the link: deletion works through the link or by expiry. Saved copies are not used for quality assurance. Legal basis: Art. 6(1)(b) GDPR (a service you request).
Control address and change protocol (Enterprise): if you set a control address, we store that e-mail address, your protocol options and value-free events (for example "control address confirmed" or "change protocol sent") with their times. A confirmation link is stored only as a hash and expires after 48 hours. A requested change (a new control address or new protected bank details), the address its link went to and the link's hash are stored only until the request is confirmed, rejected, replaced by a newer request or expired; after that we keep only its type, status and times. After each confirmed review with changes, we send a protocol e-mail through our e-mail provider to the control address and, if you choose, a copy to your account address. By default it names the changed fields, your account e-mail, the time, the document name and the invoice number. If you turn on values, it also contains the old and new values; we build them only to send the e-mail and keep no copy. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Marketing and automated emails: promotional email is sent only where permitted by law, including consent or an applicable existing-customer exception. Automated emails (reminders, tips, and offers that we send automatically) contain a one-click unsubscribe link. You can also turn them off in your profile. We then store only the time of your opt-out. Service, security, billing, and transactional emails are not marketing and continue.
3. Processing on Behalf of Customers
For business customers, invoice content is usually processed by us as processor on the customer's behalf. The customer remains responsible for the lawfulness of uploaded invoice data, data minimization, source-data accuracy, review, delivery, archiving, and final legal, tax, or accounting decisions. Our Data Processing Agreement governs this processing where Art. 28 GDPR applies.
Customer invoice content is used only to provide, secure, troubleshoot, support, and operate the Service, to assure the quality of conversion results, and to comply with legal obligations. For quality assurance, retained conversion evidence is reviewed in automated audits, which can use the AI subprocessors named below, and by authorized personnel to detect and correct conversion errors. Customer invoice content is not used for model training, reusable datasets, benchmarking, or product analytics unless the customer gives explicit written permission.
Quality evidence opt-out (Enterprise): Enterprise customers can switch quality-assurance evidence off in their profile. From at most one minute after that, we store no new evidence from their conversions for quality assurance: no copies of source files, recognized text, extracted or reviewed invoice data, generated artifacts, or debug bundles. Switching it off also deletes the evidence stored earlier: account links and invoice content in active records at once, related files within one day; blocked backup copies are deleted no later than after 30 days. Processing, downloads, billing, operational logs, and value-free statistics continue. A saved opt-out stays in force after a plan change. Conversions already running when the switch takes effect can still finish under the previous setting.
4. Subprocessors and Transfers
We use subprocessors for hosting, security, AI/OCR processing, authentication, storage, billing, email, analytics, and error telemetry. Depending on the workflow, providers may include Vercel, Koyeb, Cloudflare, Supabase, OpenAI, Microsoft Ireland Operations Limited (Azure OpenAI, primary for API, email and batch conversions, fallback for web conversions, and the only AI provider for Enterprise accounts with EU-only AI processing), Mistral AI, Google Ireland/Google LLC (for sign-in with Google and, with your consent, Google Ads conversion measurement), Stripe, Brevo, PostHog, and Sentry.
Processing is intended to use EU infrastructure where available, but we do not promise Germany-only or EU-only processing. The optional EU-only AI processing of Enterprise accounts covers AI processing only. Third-country transfers may occur, for example through AI providers, security providers, support access, telemetry, or global network infrastructure. Such transfers rely on an adequacy decision (for the USA, the EU-U.S. Data Privacy Framework where the recipient is certified) or otherwise on Standard Contractual Clauses with supplementary safeguards where required.
EU Data Zone note: Microsoft Azure OpenAI
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, processes invoice content and metadata for AI extraction through the Azure OpenAI Service (Azure AI Foundry). It is used first for API, email and batch conversions; web conversions start with OpenAI. If the first provider is unavailable or out of capacity, the other can be used. For Enterprise accounts that switch on EU-only AI processing in their profile, it is the only AI provider: their invoices are not sent to OpenAI, and text recognition runs on Mistral AI (EU/EEA). If the EU processing is unavailable, the conversion fails instead of using another provider.
- Hosting in the EU Data Zone: a dedicated production resource in an EU Azure region is used, exclusively with EU Data Zone deployments. Prompts and responses are processed only within the EU Data Zone, and data stored at rest stays in the Azure geography of that resource. For this processing, Invoice Converter sends no data to Microsoft regions outside the EU Data Zone.
- Scope of the EU Data Zone: according to Microsoft, the EU Data Zone follows the EU Data Boundary. Besides the EU member states, it can also include EFTA countries such as Norway (part of the EEA) and Switzerland (not part of the EEA, but covered by an EU adequacy decision).
- Exceptions documented by Microsoft: Microsoft describes limited transfers out of its EU Data Boundary, for example rare remote access by Microsoft personnel for maintenance or for security operations. Microsoft's Data Protection Addendum, which includes the EU Standard Contractual Clauses, covers such transfers.
- No training: according to Microsoft, prompts and responses are not available to OpenAI or other customers and are not used to train, retrain, or improve the base models.
- Abuse monitoring: Microsoft checks prompts and responses automatically for misuse of its service and can keep them for this purpose in a data store in the Azure geography of the resource. Authorized Microsoft employees can access them only when Microsoft's systems flag them as potentially abusive; for deployments in the EEA, these employees are located in the EEA. Microsoft does not publish a fixed storage period for this purpose. This storage and human review do not take place if Microsoft has approved modified abuse monitoring for the resource.
Controllers can object for material data protection reasons under Section 5 of the Data Processing Agreement by contacting contact@invoice-converter.com.
5. Retention
| Data | Standard retention |
|---|---|
| Conversion tasks and their files outside the External API | Single-file uploads in the web app and uploads from the Chrome extension: 24 hours after the task ends (completed or failed). Multi-file uploads that the web app sends in one request, Email Import and connected assistants: 10 minutes after the task ends. If the web app uploads the files of a multi-file upload one by one, for example because they are too large for one request, we keep each file for 24 hours. |
| Resume copy in your browser: uploaded file, extracted and reviewed data | Expires 24 hours after your last activity in that conversion; our website deletes it the next time you open it. Deleted at once when you sign out or someone signs in with another account. |
| Finished e-invoice file and reminder record for the download reminder | 24 hours after the file was saved, then deleted together with the reminder record. Not kept while automated e-mails are off in your profile. |
| Review reminder record: conversion reference, converter page and time (no invoice data) | 24 hours after it was created, then deleted. Not stored while automated e-mails are off in your profile. |
| Bulk run: uploaded PDFs, converted files, review data of not converted invoices | 7 days after the run ended, or at once through "Delete files now" in your profile. The run list and the manifest stay with your account until you delete it; they hold file names, checksums, status and error codes, but no invoice content. Deleting your account deletes them at once and the remaining files within 2 days. |
| Saved review link: source PDF, extracted and reviewed data, file facts | 7 days after saving, or at once through "Delete now" on the page behind the link. The e-mail address is not stored; its hash in the rate-limit counter is deleted after 2 days. |
| Email Import (Enterprise): message body, message record, reply files | Message body: 30 days after receipt. Message record (sender, recipients, subject, headers, attachment details and status): no automatic expiry while your account exists; deleted with your account. A message that cannot be assigned to an account: 30 days after receipt. E-invoices and validation reports of the reply: 24 hours, so that a failed reply can be sent again. |
| Invoice activity (Enterprise) | No automatic expiry while your account exists. With the Enterprise plan, you can delete the history of an invoice in your profile; after a downgrade, our support deletes it on request. Deleting the history of one invoice leaves a marker with the task reference and the time for 30 days. Deleting your account deletes all history and these markers. |
| Control address, protocol options and their value-free events | Until you delete your account; a removed control address is cleared at once. A requested change and its confirmation link: until the request is confirmed, rejected, replaced or expired (links expire after 48 hours); then only its type, status and times remain. We keep no copy of protocol e-mails. |
| External API tasks and results | 24 hours after the task reaches a terminal state (completed or failed). A failed task with a pending credit release is kept until that release completes. |
| External API idempotency records | 24 hours by default. |
| Generated artifacts, validation proofs, and diagnostics | Temporarily retained where needed for async processing, download, strict validation proof, restart recovery, or troubleshooting. Debug bundles are retained for up to 14 days by default. |
| Invoice fingerprints | Keyed hashes (HMAC) of the seller identifier, invoice number, issue date, payable amount and currency, without a link to an account: 180 days after the invoice data was last extracted. We use them to recognize an invoice that was already converted. |
| Conversion quality-assurance evidence | Raw evidence files, such as uploaded source files, recognized text, extracted and reviewed invoice data, and generated artifacts, expire 30 days after capture and are then deleted by periodic cleanup. Case metadata and audit findings are retained for up to 365 days. Not stored for new conversions of Enterprise accounts that switched quality evidence off. If you delete your account or switch quality evidence off, we remove account links and invoice content in active records at once and related files within one day; blocked backup copies are deleted no later than after 30 days. |
| Security, application, and audit logs | Event logs are deleted after 30 days, aggregated error statistics after 365 days. Monthly AI cost totals per account are kept while the account exists and are made anonymous when it is deleted. |
| Backups | Daily database backups at the hosting provider: 7 days. Additional encrypted backups: no more than 30 days. They are then overwritten and are used only for restoration. |
| Conversion problem reports and ratings | Attached files: 30 days, then deleted by periodic cleanup; if you delete your account, within 2 days. Contact e-mail: 12 months after the report, or earlier when you delete your account. On account deletion, the link to your account and any publication consent are also removed. The report text and rating are kept without contact data to improve the conversion. |
| Advertising click ID and consent receipt (Google Ads conversion measurement) | Click ID in your browser: up to 90 days after you arrived through the ad, and deleted when you withdraw consent. Click ID of a purchase: kept with the hash of your consent receipt in the Stripe checkout and subscription records, as part of the billing records. Click ID in the analytics events of your sign-up, checkout and purchase: kept with these events in our product analytics (PostHog). Click ID sent to Google with a conversion: Google's retention rules apply. Consent receipt (a hash of a random browser token, the notice version and the times of consent and withdrawal, without a click ID): no automatic expiry. |
| Product analytics and session replays (PostHog) | Analytics events, including the ad click IDs attached to them: up to 7 years after the event. Session replays: 30 days after recording. |
| Account, contract, and billing records | For the account or contract term and then as required for statutory, tax, accounting, fraud-prevention, and dispute purposes. |
| Marketing and automated-email preferences | Until unsubscribe, account deletion, or objection, with suppression records retained where needed to respect opt-outs. The automated-email opt-out is kept until you turn automated emails on again or delete your account. |
We do not operate a permanent central archive of uploaded customer invoice documents. Longer retention for our own purposes of legal defense, security, or billing applies only to data we lawfully process as controller; for personal data processed on behalf of customers, Section 9 of the DPA applies.
6. Your Rights
Subject to statutory requirements, you may request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You may also lodge a complaint with a data protection authority, for example the Bavarian State Office for Data Protection Supervision.
Account and data deletion
To request deletion of your E-Invoice Converter account and associated personal data, contact us from your account e-mail address. No app installation is required. Do not send your password or invoice files. In the app, the profile also provides “Delete account”; unresolved subscriptions or unavailable billing verification can prevent that action.
The in-app action closes account access, revokes API keys, deletes invoice activity and consented QA evidence, and removes account links from other product records. It removes saved seller details and irreversibly anonymises the login identity. If the authentication service is unavailable, this cleanup is queued for automatic retry. A technical account identifier and required payment, tax and store-transaction records remain for statutory accounting duties (generally 8–10 years where applicable) or necessary refund and dispute processing. Device files are not removed by a server-side account action.
7. Security and Incidents
We use HTTPS, access controls, role-based administration, least-privilege access, logging, tenant separation, secret handling, encryption at rest at our hosting providers (according to their statements), encrypted backups, and provider-side infrastructure security controls. The DPA lists the technical and organizational measures. No internet service can be guaranteed completely secure.
After becoming aware of a personal-data breach, we notify the competent authority and affected persons as required by law; as a processor, we inform affected customers without undue delay in accordance with the DPA. Any timing targets are operational targets, not service credits or contractual penalties unless expressly agreed in writing.
8. Contact
Sine Aspera Ad Astra GmbH
Sternstr. 11, 80538 Munich, Germany
Email: contact@invoice-converter.com