Privacy policy (draft)

1. Who is the controller

The controller of personal data is [DANE PODMIOTU], [ADRES SIEDZIBY], NIP [NIP], REGON [REGON], [KRS lub CEIDG] [NUMER].

Contact for personal data matters: [E-MAIL DO SPRAW DANYCH].

Data protection officer: [IOD, JEŚLI WYZNACZONY].

2. Scope of this policy

This policy applies to the website [DOMENA] and to the invoice converter, including the free version (beta) and the planned paid conversion pack.

The service does not require an account. We do not collect the first name, last name or email address of people who use the free version.

3. What data we process and why

3.1 Invoices you send for conversion.

You send a PDF file or a photo of an invoice. We intend to read and process the file in the server's memory, and to return the resulting XML file to your browser. This way of working will be confirmed by a test before the converter launches.

• Purpose: carrying out the conversion, at your request.

• Legal basis: Article 6(1)(b) GDPR (performance of the service).

• Scope: the data contained in the invoice, including the seller's and buyer's data (for example name, surname, address, NIP, bank account number). It may also include data of third parties who are buyers or business contacts of your company.

• Storage: we intend not to save the invoice file or the resulting XML to a database, to storage or to application logs, and to remove them from memory after the conversion is complete. We will test this before the converter launches.

• AI processing: parts of the invoice content are sent to the AI model provider (section 5).

• Before you download the XML, you will check the fields on the planned "Review and correct" screen. The scope of responsibility for the data meeting legal requirements will be set out in the terms after legal review.

If you send data of third parties (for example buyers), you act as the controller of that data in your business. You are responsible for informing those persons to the extent required by the GDPR. When we process that data in our service, we act on your instructions, as a processor.

3.2 Free version (beta): conversion limit.

To limit abuse and keep the service available to everyone, we apply a limit on free conversions (currently 3 a month per browser).

For this purpose we process:

• a token identifier stored in a cookie with the HttpOnly flag in your browser, kept only as a keyed hash,

• a keyed cryptographic hash of the IP address, truncated to a network prefix (/24 for IPv4, /64 for IPv6),

• the conversion counter for the current month.

• Purpose: protection against abuse and enforcement of the free conversion limit.

• Legal basis: the controller's legitimate interest (Article 6(1)(f) GDPR) in preventing abuse.

• Retention period: data in this section is deleted at the end of the current calendar month.

• Effect: the limit may be reached by all users sharing one network prefix, and conversions may be paused for a time if the total cost of the service exceeds a threshold.

The cryptographic hash is not stored in readable form. The key is not stored in the database.

3.3 Turnstile verification.

We plan to use Cloudflare Turnstile, which checks whether the user is a human. In the beta, when the converter is not running, Turnstile is not active. Turnstile may process the IP address, browser information and technical signals, and may set its own technical cookies.

• Purpose: protection against bots and abuse.

• Legal basis: the controller's legitimate interest (Article 6(1)(f) GDPR).

3.4 Payments (planned).

The paid pack will be handled by Stripe: the Stripe Checkout payment page and Stripe Tax for VAT handling (Stripe product names).

• Data: email address and billing data entered in Stripe, transaction and subscription identifiers, VAT invoice data if you provide it.

• Purpose: fulfilling the order, accounting, tax obligations.

• Legal basis: Article 6(1)(b) and (c) GDPR.

• Stripe may be a separate controller for some of the data.

3.5 Contact.

If you send us an email, we process its content and your sender address in order to reply.

• Legal basis: Article 6(1)(f) GDPR (replying to an enquiry), or Article 6(1)(b) if it concerns a contract.

• Retention period: [OKRES PRZECHOWYWANIA].

3.6 Technical logs.

The hosting provider (Cloudflare) keeps technical logs, which may contain IP addresses and request data, for the period set out in its terms.

3.7 Waitlist for the converter launch.

[To be confirmed]

If you join the waitlist, you give your email address so that we can tell you when the converter launches. Joining the waitlist is voluntary and is not a condition of using the free version.

• Purpose: informing you when the converter launches.

• Legal basis: consent (Article 6(1)(a) GDPR), given by ticking the consent box in the form.

• Scope: email address, form language (Polish or English), the version of the consent text, the date and time of consent, and a label for the source of the sign-up (the website). We do not collect the IP address or browser and device information for this record.

• Recipient: the data is stored in the Cloudflare D1 database (section 4).

• Retention period: until we tell you that the converter has launched or until you withdraw consent, [OKRES PRZECHOWYWANIA NA LIŚCIE OCZEKUJĄCYCH].

• Withdrawing consent: you can withdraw consent at any time by writing to [E-MAIL DO SPRAW DANYCH]. Withdrawal does not affect the lawfulness of processing carried out before it.

• No profiling: we do not profile people on the list and do not use the email address for other purposes or for automated decision-making.

4. Recipients and processors

We intend to enter into a data processing agreement (DPA) under Article 28 GDPR with each entity that processes data on our behalf, before it processes any user data. [To be confirmed]

Entity — Role — Purpose — Location — Notes

Cloudflare, Inc. — Hosting, server functions (Workers), D1 database, web application firewall (WAF), Turnstile (planned), (later) email sending — Hosting and security — USA and EU (depending on the service)

Anthropic, PBC — AI model provider for reading the invoice — Reading the invoice fields — USA

Stripe, Inc. (and Stripe Payments Europe, if applicable) — Payments and VAT — Payments (planned) — USA / Ireland

We do not sell data. We do not share data for marketing purposes.

5. Transfers outside the EEA

Some providers are based in, or process data in, the USA. Transfers will take place on the basis of standard contractual clauses (SCC) approved by the European Commission, or an adequacy decision, for example the EU-US Data Privacy Framework, a mechanism recognised by the European Commission for US companies that are certified. We can provide a copy of the safeguards on request. [To be confirmed]

6. Retention periods (summary)

Data — Period

Invoice file and resulting XML — We intend not to save them and to remove them from memory after conversion. We will test this before the converter launches.

Token hash and IP prefix (free version) — Until the end of the current calendar month.

Conversion counter — Until the end of the current calendar month.

Payment and invoice data (planned) — [OKRES PRZECHOWYWANIA]

Email address on the waitlist — Until we tell you the converter has launched or you withdraw consent.

Correspondence — [OKRES]

7. Your rights

You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interest, withdraw consent (where consent is the basis), and lodge a complaint with a supervisory authority.

We describe the details and how to exercise these rights on the "Data subject rights" page. We reply within one month of receiving a request. If needed, this period can be extended by a further two months, and we will inform you of this.

Right to complain: you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), [ADRES UODO].

8. Automated decision-making

We do not make decisions that produce legal effects concerning you, or that similarly and significantly affect you, based solely on automated processing. The AI model proposes the values of the invoice fields, and a person (you) approves each field before the XML file is downloaded.

9. Cookies

Details are in the separate document: the Cookie policy.

10. Security

We apply technical and organisational measures: encrypted transmission (HTTPS) and restricted access. Once the converter launches, we intend to also pseudonymise identifiers and not store invoice content; we will test this before launch.

11. Changes to this policy

We will inform you of significant changes on this site. The date of the last update is at the top of the document.

12. Contact

[E-MAIL DO SPRAW DANYCH], [ADRES SIEDZIBY].