Last updated: 13 October 2026. Controller: FOP Pukhalskyi Vladyslav (sole proprietor), Lili Karastoianovoi St. 14, apt. 6, 13301 Berdychiv, Zhytomyr region, Ukraine · e-mail: support@einvoicechecker.com. This policy follows the GDPR (Regulation (EU) 2016/679).
1. Invoice files you upload
Files sent to the website or the API are parsed in the server's memory to produce the result (format detection, readable view, validation report, JSON, PDF). They are discarded as soon as the response is sent. We do not write them to disk, do not keep copies, do not use them for training or analytics. The only trace is a request log line with the endpoint, response time, size and status; no invoice content, names or amounts are logged. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in operating it (Art. 6(1)(f)).
Rendered PDFs are generated in memory and streamed to you; nothing is retained.
2. API keys and accounts
When you request an API key we store: your email address, a SHA-256 hash of the key (we cannot recover the key itself), the plan, creation and last-use timestamps, and a counter of requests per day and per month. For paid plans we also store the Paddle customer and subscription identifiers, the subscription status, next billing date and any scheduled change, received from Paddle via webhooks. We keep this for as long as the key exists and up to 12 months after revocation for accounting and abuse prevention. Legal basis: contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).
3. Payments
Payments are handled by Paddle.com Market Ltd (and Paddle.com Inc. for US customers) as merchant of record. Paddle collects your payment details, billing address and tax ID, issues the invoice and handles VAT. We never see your card number. Paddle's privacy policy: paddle.com/legal/privacy. We pass your email and your API key number to Paddle at checkout so the payment can be linked to your key.
4. Support messages
Messages sent through the contact page are stored with your name (if given), email, the message text, the page you sent it from and your IP address (for abuse prevention), and are visible to the operator. A private conversation link is created for you. We delete closed conversations after 24 months. Legal basis: legitimate interest in answering you (Art. 6(1)(f)).
5. Website visits, cookies
The public pages use Google Tag Manager (Google Ireland Ltd) to load analytics tags that measure visits and page usage; Google may set cookies and process your IP address and browser data for this purpose. You can block these tags with a browser extension or by refusing cookies in your browser. The admin area uses a login cookie that is strictly necessary. Fonts are served from our own server; no font requests go to Google. The site is delivered through Cloudflare (Cloudflare, Inc.), which processes IP addresses and request metadata to protect and cache the site; Cloudflare acts as our processor under its data processing addendum. On the API page, Paddle.js is loaded from paddle.com to open the checkout; Paddle may set cookies required for fraud prevention only when you open a checkout.
6. Server location and processors
The application runs on a server in the European Union. Processors: Cloudflare (CDN, DDoS protection), Paddle (payments), Google (fonts). We do not sell or share personal data for advertising.
7. Your rights
You can ask for access, rectification, erasure, restriction, portability and object to processing (Art. 15 to 21 GDPR), and complain to a supervisory authority. To exercise them, write to the operator address above or use the contact page with topic "Privacy". To delete an API key and its data, revoke it via the contact page; usage counters needed for accounting are kept in aggregated form only.
8. Changes
We update this page when the service changes and note the date at the top.