Privacy Policy

1. Controller

[OPERATOR_NAME], [OPERATOR_ADDRESS], email support@generateinvoice.io, is the controller for personal data processed through GenerateInvoice.

2. What we process

• Account data — name, email, password hash, company details you add to your profile (legal basis: contract performance, Art. 6(1)(b) GDPR).
• Document data — the invoice/receipt/quote content you submit, including your customers' names and addresses. You remain controller for your customers' data; we process it on your behalf (Art. 28 GDPR).
• Billing data — subscription status and payment references processed by Stripe. We never store card numbers.
• Usage data — API request counts, rate-limit counters, and aggregated product analytics. Marketing pages use cookieless, anonymous analytics; identified analytics run only after you sign in (legal basis: legitimate interest, Art. 6(1)(f) GDPR).

3. Processors

We use the following processors under data-processing agreements: Supabase (authentication and database), Vercel (hosting), Cloudflare R2 (document storage), Stripe (payments), Resend (transactional email), Upstash (rate limiting and queues), PostHog EU (analytics, EU-hosted), and Sentry (error monitoring). Where processing occurs outside the EU/EEA, it is safeguarded by EU Standard Contractual Clauses.

4. Retention

Account data is kept while the account exists and deleted within 30 days of account deletion. Generated PDFs are stored with an expiry and removed by scheduled cleanup. Billing records are retained as long as commercial and tax law requires.

5. Cookies

We use strictly necessary cookies for authentication sessions. Marketing pages do not set analytics cookies; analytics there is cookieless and anonymous. No third-party advertising cookies are used.

6. Your rights

You have the right to access, rectify, delete, and receive a copy of your personal data, to restrict or object to processing, and to lodge a complaint with a supervisory authority. Contact support@generateinvoice.io to exercise these rights.