1. Who we are
InvoiceHub is provided by Impress Bulgaria LLC, EIK 205349335, registered in Sofia, Bulgaria (“we”). For questions about personal data, write to [email protected].
We are the controller of account, company and payment data. For personal data in the documents companies upload — for example the names of counterparties and the people in them — the company concerned is the controller, and we process that data on its behalf and on its instructions.
2. What data we process
- Account. Email address, the identifier from the sign-in service, and the dates of registration and last sign-in. Sign-in goes through Amazon Cognito — we never receive or store your password.
- Company. Name, company number (EIK), VAT number, address, email and phone, the company members and their permissions, and the settings of connected services (Slack, Google Drive).
- Documents. Uploaded files and images and the data read from them: number, dates, amounts and VAT, issuer and recipient with company and VAT numbers, IBAN, payment method and description of services.
- Activity history. Which user (by email) deleted, merged or changed a document or issuer and when, together with the data before the change.
- Payments. The plan and the Stripe customer and subscription identifiers. Card details are entered directly into Stripe and never reach us.
- Technical data. Your IP address is used to limit the number of requests and is not stored in the database. Server logs and error reports contain technical information about requests. For API keys we keep only a hash.
3. Why we use it and on what legal basis
- Providing the service: sign-in, uploading, automatic reading, review, export and integrations — performance of our contract with you (Art. 6(1)(b) GDPR).
- Payments and issuing accounting documents — performance of the contract and a legal obligation (Art. 6(1)(b) and (c)).
- Security, abuse prevention and troubleshooting — our legitimate interest (Art. 6(1)(f)).
- Email: we send only a service notice when a requested document archive is ready. We send no marketing messages.
4. Who we share data with
We use the following providers, which process data on our behalf and only for the stated purpose:
- Amazon Web Services — account sign-in (Amazon Cognito) and sending email (Amazon SES).
- Cloudflare — storage of uploaded files, images and archives (Cloudflare R2).
- AI model providers — OpenAI, Google (Gemini) and OpenRouter, which forwards the request to a chosen model. We send them the image of the document and the reading instructions, to extract its data.
- Stripe — payments and subscriptions.
- Sentry — application error reports.
- Hosting providers — the servers and the database the service runs on.
When checking the VAT number of a counterparty from a document, we send the number to the European Commission's VIES system.
When you connect Slack, Google Drive or an AI assistant (for example Claude or ChatGPT through MCP), we send data to those services on your instruction. They process it under their own terms.
We do not sell personal data or use it for advertising.
5. Where data is processed
We use services hosted in the European Union: data is stored and processed in data centres in the EU.
When a provider based outside the EU (OpenAI, OpenRouter, Stripe or Sentry) processes data outside the EEA, the transfer relies on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on the Commission's standard contractual clauses.
6. How long we keep data
- Documents, images and extracted data — until the company deletes them or for as long as its account exists. The company administrator can delete a document, together with its image, at any time.
- Activity history — for as long as the company exists. It also keeps a copy of deleted documents.
- Temporary upload files — deleted once the document is saved, or after 7 days at the latest.
- Download archives — 7 days.
- Payment data — as long as accounting law requires.
You can request deletion of your account or company at [email protected]. We carry out the request within 30 days, except for data we are required by law to keep.
7. Cookies
We use only necessary cookies and no analytics or advertising cookies:
- invoicehub_session — keeps you signed in; expires after 8 hours or when you sign out.
- invoicehub_lang — remembers your interface language; expires after 1 year.
The home page embeds a video from youtube-nocookie.com. Your browser connects to YouTube, which may process data under its own policy when you play the video.
8. Security
Connections to the service are encrypted. Each company's data is kept separate and is available only to its members, according to their permissions. API keys and access codes are stored as hashes, and links to files are signed and valid only briefly.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Write to us at [email protected]. For data in a company's documents, contact that company — we will assist it.
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.
10. Changes
When we change this policy, we publish the new version on this page with the date it takes effect.