Privacy Policy

Last updated: March 2026

InvoiceKit ("we", "our", or "us") is committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and applicable EU privacy law. This policy explains what data we collect, why, and how you can exercise your rights.

1. Data We Collect

• Account data: name, email address, password (hashed).
• Business data: clients, invoices, time entries, and project details you enter.
• Payment data: billing information processed by Stripe (we never store full card numbers).
• Technical data: IP address, browser user-agent, session identifiers.

2. Legal Basis for Processing

We process your data under the following lawful bases:

• Contract performance: to provide the invoicing and time-tracking service.
• Legitimate interests: to improve the service and prevent fraud.
• Legal obligation: VAT records may be required by EU tax law.
• Consent: for optional marketing communications.

3. Data Retention

Invoice and accounting data is retained for 7 years in accordance with EU VAT regulations. Account data is deleted within 30 days of account closure, except where legal retention obligations apply.

4. Third-Party Processors

• Stripe — payment processing (Stripe's privacy policy).
• Hetzner — EU-based hosting (Germany).

5. Your Rights (GDPR)

You have the right to: access your data, correct inaccuracies, request erasure (right to be forgotten), restrict or object to processing, and data portability. Contact us at [email protected] to exercise any of these rights.

6. Cookies

We use only first-party session cookies essential for authentication. We do not use third-party tracking or advertising cookies.

7. Contact

Data controller: InvoiceKit. Email: [email protected].