Privacy policy

InvoiceVerify (“we”) provides an online validator and converter for electronic invoices. This policy explains which personal data we process, why, and what your rights are under the GDPR.

Invoices you validate

Invoice files are processed in memory to produce the validation report and are discarded immediately afterwards. We do not store invoice contents, attachments or the generated report. Converters and the invoice generator run entirely in your browser.

Validation metadata

For each validation we store: date and time, source (web, batch, API, email), detected format, invoice number, file name, pass/fail and the number of errors and warnings. We use this to enforce the monthly free allowance and to show your history.

For visitors without an account we set a functional cookie with a random identifier and store a salted hash of it and of the IP address, solely to count the free monthly validations. The hashes cannot be reversed to identify you.

Account data

• Email address and (optionally) name, company and VAT number.
• Subscription status, billing name, billing country, VAT number and the brand and last four digits of your card. Full card numbers are never stored by us.
• API keys are stored only as a one-way hash.
• Client lists you save for the monthly Peppol re-check (Pro): the Belgian company numbers, the names you gave them and their Peppol results, kept until you delete the list or your account. Lists you only check, without saving, are not stored — we only count how many companies were checked.

Legal bases

• Performance of the contract (Art. 6(1)(b) GDPR): providing validations, accounts and subscriptions.
• Legal obligation (Art. 6(1)(c)): keeping billing records for the statutory retention period.
• Legitimate interest (Art. 6(1)(f)): preventing abuse of the free tier and securing the service.

Processors

We use cloud hosting and database providers located in the EU/EEA or bound by the EU Standard Contractual Clauses. VAT number lookups are sent to the European Commission's VIES service. Peppol lookups send the Peppol ID being checked to public DNS resolvers and to the Peppol service provider registry (SMP) that holds that registration.

Retention

Validation metadata is kept for 24 months. Billing records are kept for 7 years as required by Dutch tax law. Account data is deleted within 30 days of an account deletion request.

Your rights

You can delete your account and its data yourself under Dashboard → Settings. You can also request access, correction, deletion, restriction or portability of your data, and object to processing, using the contact details in the imprint.You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).