To be completed before launch: insert the controller’s legal name and registered address, the hosting provider’s identity, and the list of processors actually used (payment provider, email provider, analytics) in the placeholders marked [ ].
Last updated: 2 September 2026
1. Controller
The controller of the personal data described here is [Company legal name], [registered address], contact privacy@invoiceproforma.com. This policy covers the website invoiceproforma.com and the application at app.invoiceproforma.com.
2. What we collect and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data: name, email, password hash, company details | Create and operate your account | Performance of the contract | Duration of the account, then 12 months |
| Document data: buyers, products, prices, HS codes, bank details you enter | Generate and store your documents | Performance of the contract | Duration of the account, then deleted on request or after 12 months |
| Billing data: subscription status, invoices, payment reference | Take payment and meet accounting obligations | Contract and legal obligation | As required by accounting law, typically 6 to 10 years |
| Technical logs: IP address, browser, timestamps, error traces | Security, abuse prevention, debugging | Legitimate interest in a secure service | Up to 12 months |
| Support correspondence | Answer your questions | Legitimate interest / contract | 3 years after the last exchange |
| Website usage measurement | Understand which guides are useful | Consent where required; otherwise legitimate interest with anonymised measurement | Up to 14 months |
We do not sell personal data, we do not use it for advertising profiling, and we do not use the content of the documents you create for any purpose other than providing the Service to you.
3. Cookies
The public website uses strictly necessary cookies for security and session handling, which do not require consent. The application sets an authentication cookie when you log in. Any measurement or analytics cookie that is not strictly necessary is set only after you consent, and consent can be withdrawn at any time. Your browser also lets you refuse or delete cookies, although the application will not function without its session cookie.
4. Who processes data for us
- Hosting: [hosting provider and country of the servers].
- Payment processing: [payment provider]. Card details are entered on the provider’s systems; we receive only a payment reference and the subscription status.
- Transactional email: [email provider], to send account and billing messages.
- Audience measurement: [analytics provider, if used], configured to minimise the data collected.
Each processor is bound by a written agreement limiting them to processing on our instructions. Where a transfer outside your region takes place, it is covered by an adequacy decision or by standard contractual clauses.
5. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, withdraw consent, and receive your data in a portable format. Write to privacy@invoiceproforma.com; we answer within one month. You may also complain to your national data protection authority. Note that a request to delete your account does not remove records we must keep for accounting or fraud-prevention purposes.
6. Security
Traffic is encrypted in transit, passwords are stored hashed and salted, access to production systems is restricted and logged, and backups are taken regularly. No system is perfectly secure; if a breach affects your data and presents a risk to you, we will notify you and the competent authority as required by law.
7. Data about third parties in your documents
Your documents contain information about your buyers, consignees and contacts. In relation to that data you are the controller and we act as processor on your behalf: we store and display it so you can produce your documents, and we do not use it for our own purposes. You are responsible for having a lawful basis to enter it and for informing those people where required.
8. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.
9. Changes
We will update this policy when our processing changes and will note the date of the latest revision at the top. Material changes will be announced by email or in the application.
See also our terms of service and legal notice.