Short version: your invoices are read in memory, checked, and thrown away. They are never written to disk, never logged, and never sent anywhere.
<
It is held in memory for the length of the request, validated, and discarded when the response is sent. It is not written to disk, not written to any log, and not transmitted to any third party. There is no account and no upload history, so there is nothing to retrieve or delete afterwards.
Your IP address is held in memory only, for at most one minute, so that the service can count requests per address and refuse abusive traffic. It is never written to disk and never associated with anything you validated. This is a legitimate-interest processing under Article 6(1)(f) GDPR, limited to what abuse prevention requires.
On a single server in Nuremberg, Germany, operated by netcup GmbH — inside the EU. No data is transferred outside the EU.
GDPR gives you rights of access, rectification, erasure, restriction, portability and
objection. In practice there is nothing here to exercise them against: no personal data about
you is stored. If you believe otherwise, write to <
If this ever stops being accurate, this page changes first.