Privacy policy: what data we process and why

This policy explains which personal data OkInvoice processes when you use okinvoice.eu, why, for how long, and which rights you have under the General Data Protection Regulation (GDPR).

The short version: we collect as little as we can, the validator never uploads your files, and by default the site sets no cookies and runs no analytics.

Who is responsible

The controller within the meaning of Art. 4(7) GDPR is:

[OPERATOR NAME]
[ADDRESS]
E-mail: hello@okinvoice.eu

More details are in the imprint. For any privacy question, write to hello@okinvoice.eu or use the contact form.

Hosting and server logs

The site runs on a server of Contabo GmbH, Welfenstraße 22, 81541 München, Germany, in a data centre in the EU. We manage the server with the deployment software Coolify. Contabo processes data on our behalf as a processor (Art. 28 GDPR).

When you open a page, your browser sends technical data that the web server records in log files:

your IP address
the date and time of the request
the URL requested
your browser's user agent (browser and operating system)

We use these logs to keep the site secure and working, for example to detect attacks and to find errors. The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). The logs are kept for up to 14 days and then deleted, unless a specific entry is needed to investigate a security incident.

The e-invoice validator: your files stay on your device

The validator checks XRechnung, ZUGFeRD, Factur-X and Peppol files entirely inside your browser, in a Web Worker. Your invoice file is never uploaded to our server and we never store it. We cannot see its content.

The validator code and the official rule sets are downloaded to your browser like any other part of the page. Those downloads are ordinary page requests and appear in the server logs described above, without any invoice data.

The deadline checker

The deadline checker also runs in your browser. Your answers can appear in the part of the address after the "#" (the URL hash), so that you can bookmark or share a result. Browsers do not send the hash to the server, so your answers do not reach us or our logs.

Contact form and e-mail

If you use the contact form, we receive your name, your e-mail address, the topic you chose and your message. The form sends them to us by e-mail through our own mail server. If you write to hello@okinvoice.eu directly, we receive your e-mail address and whatever your message contains.

We use this data only to answer you. The legal basis is our legitimate interest in replying to enquiries (Art. 6(1)(f) GDPR) or, if your enquiry concerns a contract with us, Art. 6(1)(b) GDPR. We keep messages as long as we need them to deal with your enquiry, at most 12 months, and then delete them, unless a legal duty requires us to keep them longer.

Spam protection with Cloudflare Turnstile

If we enable it, the contact form uses Cloudflare Turnstile, a service of Cloudflare, Inc. (USA), to tell people from bots. Turnstile then processes technical data about your browser and device, including your IP address. The legal basis is our legitimate interest in keeping the form free of spam (Art. 6(1)(f) GDPR). Data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).

Cookies and analytics

By default, okinvoice.eu sets no cookies and stores nothing in your browser. The only exception is the editors' area (/studio), which sets a session cookie for logged-in editors. Details are in our cookie policy.

If we enable analytics

We have prepared Google Analytics 4, loaded through Google Tag Manager with Google Consent Mode v2, but it is not active. If we switch it on, we will update this policy, and the following will apply:

The provider is Google Ireland Limited, Dublin, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
For visitors in the EEA, the United Kingdom and Switzerland, analytics runs only after you agree in a consent dialog. The legal basis is your consent (Art. 6(1)(a) GDPR and, for storing information on your device, the national rules implementing the ePrivacy Directive).
In other regions, analytics would be on by default unless your browser sends a Global Privacy Control signal. You could still switch it off.
You can change or withdraw your choice at any time through the "Cookie settings" link in the footer. Withdrawing consent does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR).
Advertising features stay switched off. The page address sent to Google keeps no query string except campaign tags.

Fonts, ads and links to other sites

All fonts are hosted on our own server, so your browser makes no requests to Google Fonts or other font services. The site shows no ads.

Links to software vendors go through our own redirect pages. How these links work is explained in the affiliate disclosure. Once you arrive on a vendor's site, that vendor's own privacy policy applies.

Who receives your data

We do not sell your data and do not share it for advertising. Data reaches others only as described above: our hosting provider, our mail server and, if enabled, Cloudflare (Turnstile) and Google (analytics). We disclose data to authorities only where the law requires it.

Your rights

Under the GDPR you have the right to:

access the data we hold about you (Art. 15 GDPR)
have incorrect data corrected (Art. 16 GDPR)
have your data erased (Art. 17 GDPR)
have processing restricted (Art. 18 GDPR)
receive your data in a structured, machine-readable format (Art. 20 GDPR)
object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR)
withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)

To use these rights, write to hello@okinvoice.eu. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work or where the alleged infringement took place.

No automated decisions

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

Changes to this policy

We update this policy when the site or the law changes, for example if we enable analytics. The date at the top shows the current version.