Privacy policy

1. Controller

2. Summary

• Invoice files you open in the tools (viewing, validation, PDF export) are processed only locally in your browser. They are not transmitted to me or to third parties.
• There are no tracking cookies and no advertising or profiling services.
• Fonts, validation rules and program files are loaded from xrechnio.de itself – without connections to Google Fonts or other third parties.
• Creating an account is optional.

3. Invoice files in the tools

When you open an XML or PDF file, your browser reads it, displays it, validates it with the KoSIT rules and creates a PDF on request. For this, your browser loads program files and validation rules from xrechnio.de; the invoice file itself is not transmitted. A Content Security Policy technically only allows the page to connect to xrechnio.de. You can verify this in the network tab of your browser’s developer tools. No legal basis under the GDPR is needed for this local processing because I do not receive any data.

4. Hosting and server log files

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server functions run in Frankfurt am Main (EU); static files are delivered via a global content delivery network.

When you visit the site, Vercel processes technically necessary connection data: IP address, date and time, requested URL, referrer, browser and operating system details, and status codes. The purpose is delivering the website and keeping it secure, for example defending against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, working service). The logs are stored only briefly and then deleted.

Vercel processes the data as a processor under its data processing addendum (Art. 28 GDPR). Transfers to the USA are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework and on standard contractual clauses (Art. 46(2)(c) GDPR).

5. Audience measurement with Vercel Web Analytics

To see which pages are used, I use Vercel Web Analytics. The service sets no cookies and stores nothing on your device. It records the page visited, the referrer, the country and the browser, operating system and device type. You are not tracked across other websites; visits are distinguished by a hash that is discarded after 24 hours. I only see aggregated statistics. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement to improve the service). You can object by using a statistics-blocking extension or by writing to me.

6. Contact by email or contact form

When you write to me, I process your details (for example name, email address and message) to answer your request. The contact form opens your email app; your message reaches me as an email and is not stored by this website. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract, otherwise Art. 6(1)(f) GDPR. I delete the data once the request is settled and no statutory retention obligations apply.

7. User account

You can create an account to save invoices and organise them in folders. For this I process your email address and – if you sign in with Google, Microsoft or Apple – the basic data transmitted by that provider (name, email address, identifier). Account data and saved invoices are stored at Supabase Inc. (USA) with servers in Frankfurt am Main (EU). Supabase is a processor (Art. 28 GDPR); any transfers to the USA are covered by standard contractual clauses.

The legal basis is Art. 6(1)(b) GDPR (providing the account). You can delete your account at any time; I then delete your data unless statutory obligations prevent this. If saved invoices contain personal data of third parties, such as your customers, I process it only on your behalf.

When you sign in via a third party you are redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), Microsoft (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) or Apple (Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), whose privacy policies apply.

8. Cookies and local storage

Without signing in, xrechnio sets no cookies. After signing in, technically necessary cookies store your session. If you dismiss the language hint or enable “Remember sender and payment details on this device” in the invoice generator, this is stored in your browser’s local storage – not on my server. You can switch it off at any time. This is strictly necessary for functions you request (§ 25(2) no. 2 TDDDG), so no consent is required.

9. External links

Links to other websites, such as GitHub or Buy Me a Coffee, are only loaded when you click them. The privacy policy of the respective provider then applies.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21). Write to kontakt@xrechnio.de.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is:

11. Security

All connections are encrypted (TLS). Strict security headers prevent third-party scripts from being loaded. There is no automated decision-making or profiling (Art. 22 GDPR).

12. Changes

I update this policy when the service or the law changes. The version published here applies.