Last updated: October 8, 2026
1. Controller
The controller for this website, account management, billing, product, support, security, and marketing processing is Sine Aspera Ad Astra GmbH, Sternstr. 11, 80538 Munich, Germany, represented by its managing director Felix Graeber. Commercial register: Amtsgericht München, HRB 313338
Email: contact@invoice-converter.com. No Data Protection Officer has been appointed because the statutory appointment requirements are not currently met.
2. What We Process
Website and security data: IP address, request metadata, timestamps, user agent, referrer, cookie consent state, rate-limit events, security events, error logs, and correlation IDs. Legal basis: Art. 6(1)(f) GDPR.
Account and billing data: email address, authentication identifiers, plan, subscription status, API-credit balance, Stripe customer and invoice references, language preferences, and service communications. Legal basis: Art. 6(1)(b), Art. 6(1)(c), and Art. 6(1)(f) GDPR.
Invoice conversion data: uploaded documents, extracted invoice fields, supplier and customer names, addresses, tax IDs, VAT IDs, IBAN/BIC, line items, amounts, generated XML/PDF artifacts, validation proofs, hashes, diagnostics, support/debug bundles, and conversion quality-assurance evidence where needed to provide the requested workflow and to assure the quality of conversion results.
Chrome extension data: when you connect the extension, it stores the OAuth session and current conversion state in Chrome extension storage. It uploads only the invoice file that you select and only after you start a conversion. It does not read web-page content, browsing history, open tabs, or unrelated local files. Google user data received through the extension is used only to provide and secure the user-facing conversion workflow. This use complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data, use it for advertising, or transfer it for credit, lending, or unrelated purposes.
External API data: tenant IDs, API key IDs, API key prefixes, idempotency keys, request hashes, endpoint, method, status, correlation IDs, usage and audit events, rate-limit denials, credit-ledger events, filenames where supplied, format/profile/jurisdiction hints, and technical metadata needed for authentication, billing, security, troubleshooting, and idempotent retries. Plaintext API keys are not intentionally stored after creation.
ChatGPT plugin data: when you connect Invoice Converter to ChatGPT, we process OAuth identifiers, account entitlement and acquisition source, task IDs, requested output format, timestamps, validation error and warning counts, artifact status and size, and the entitlement type used. At your request, OpenAI transmits the selected invoice file to our MCP server for conversion. Plugin analytics exclude invoice content, filenames, customer names, and invoice values.
Analytics and session replay: only after consent, we use product analytics and session replay to understand product usage and improve the Service. We configure analytics to avoid invoice content and do not use invoice content for product analytics.
Download reminder (service message): when you are signed in, the download step shows the box "Remind me by e-mail if I forget to download". The box is ticked by default. While it stays ticked, we keep the finished e-invoice file (for ZUGFeRD and Factur-X, this is your PDF with the embedded XML) for 24 hours after it was saved, store when it was kept and the conversion reference, and send you one service e-mail with a link to the file if you do not download it. A file saved without the ticked box gets no reminder. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our interest is to help you finish the download of your own e-invoice before we delete it. You can object at any time: untick the box (we then delete a file that you have not paid for and send no reminder), use the unsubscribe link in the reminder e-mail, or turn off automated e-mails in your profile.
Control address and change protocol (Enterprise): if you set a control address, we store that e-mail address, your protocol options and value-free events (for example "control address confirmed" or "change protocol sent") with their times. A confirmation link is stored only as a hash and expires after 48 hours. A requested change (a new control address or new protected bank details), the address its link went to and the link's hash are stored only until the request is confirmed, rejected, replaced by a newer request or expired; after that we keep only its type, status and times. After each confirmed review with changes, we send a protocol e-mail through our e-mail provider to the control address and, if you choose, a copy to your account address. By default it names the changed fields, your account e-mail, the time, the document name and the invoice number. If you turn on values, it also contains the old and new values; we build them only to send the e-mail and keep no copy. Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Marketing and automated emails: promotional email is sent only where permitted by law, including consent or an applicable existing-customer exception. Automated emails (reminders, tips, and offers that we send automatically) contain a one-click unsubscribe link. You can also turn them off in your profile. We then store only the time of your opt-out. Service, security, billing, and transactional emails are not marketing and continue.
3. Processing on Behalf of Customers
For business customers, invoice content is usually processed by us as processor on the customer's behalf. The customer remains responsible for the lawfulness of uploaded invoice data, data minimization, source-data accuracy, review, delivery, archiving, and final legal, tax, or accounting decisions. Our Data Processing Agreement governs this processing where Art. 28 GDPR applies.
Customer invoice content is used only to provide, secure, troubleshoot, support, and operate the Service, to assure the quality of conversion results, and to comply with legal obligations. For quality assurance, retained conversion evidence is reviewed in automated audits, which can use the AI subprocessors named below, and by authorized personnel to detect and correct conversion errors. Customer invoice content is not used for model training, reusable datasets, benchmarking, or product analytics unless the customer gives explicit written permission.
4. Subprocessors and Transfers
We use subprocessors for hosting, security, AI/OCR processing, authentication, storage, billing, email, analytics, and error telemetry. Depending on the workflow, providers may include Vercel, Koyeb, Cloudflare, Supabase, OpenAI, Mistral AI, Google Ireland/Google LLC (only for sign-in with Google), Stripe, Brevo, PostHog, and Sentry.
Processing is intended to use EU infrastructure where available, but we do not promise Germany-only or EU-only processing. Third-country transfers may occur, for example through AI providers, security providers, support access, telemetry, or global network infrastructure. Where required, we rely on Standard Contractual Clauses and additional safeguards.
5. Retention
| Data | Standard retention |
|---|---|
| Terminal processing tasks outside the External API | Usually available for about 10 minutes after completion or failure. |
| Finished e-invoice file and reminder record for the download reminder | While the reminder box stays ticked: 24 hours after the file was saved, then deleted together with the reminder record. Deleted earlier when you untick the box before paying for the file. |
| Control address, protocol options and their value-free events | Until you delete your account; a removed control address is cleared at once. A requested change and its confirmation link: until the request is confirmed, rejected, replaced or expired (links expire after 48 hours); then only its type, status and times remain. We keep no copy of protocol e-mails. |
| External API tasks and results | 24 hours after the task reaches a terminal state (completed or failed). A failed task with a pending credit release is kept until that release completes. |
| External API idempotency records | 24 hours by default. |
| Generated artifacts, validation proofs, and diagnostics | Temporarily retained where needed for async processing, download, strict validation proof, restart recovery, or troubleshooting. Debug bundles are retained for up to 14 days by default. |
| Conversion quality-assurance evidence | Raw evidence files, such as uploaded source files, recognized text, extracted and reviewed invoice data, and generated artifacts, expire 30 days after capture and are then deleted by periodic cleanup. Case metadata and audit findings are retained for up to 365 days. |
| Security, application, and audit logs | Event logs are retained according to the deployed log-retention setting, currently expected to be 30 days unless changed. Aggregate logs may be retained longer, currently up to 365 days by default. |
| Conversion problem reports and ratings | Attached files: 30 days, then deleted by periodic cleanup; if you delete your account, within 2 days. Contact e-mail: 12 months after the report, or earlier when you delete your account. On account deletion, the link to your account and any publication consent are also removed. The report text and rating are kept without contact data to improve the conversion. |
| Account, contract, and billing records | For the account or contract term and then as required for statutory, tax, accounting, fraud-prevention, and dispute purposes. |
| Marketing and automated-email preferences | Until unsubscribe, account deletion, or objection, with suppression records retained where needed to respect opt-outs. The automated-email opt-out is kept until you turn automated emails on again or delete your account. |
We do not operate a permanent central archive of uploaded customer invoice documents. Some records may be retained longer where required by law, to establish or defend legal claims, to investigate abuse or security events, or to maintain billing and audit integrity.
6. Your Rights
Subject to statutory requirements, you may request access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You may also lodge a complaint with a data protection authority, for example the Bavarian State Office for Data Protection Supervision.
7. Security and Incidents
We use HTTPS, access controls, role-based administration, least-privilege access, logging, tenant separation, secret handling, and provider-side infrastructure security controls. No internet service can be guaranteed completely secure.
We notify affected customers and authorities as required by law after confirming a relevant personal-data breach. Any timing targets are operational targets, not service credits or contractual penalties unless expressly agreed in writing.
8. Contact
Sine Aspera Ad Astra GmbH
Sternstr. 11, 80538 Munich, Germany
Email: contact@invoice-converter.com