Privacy Policy

Last updated: 15 June 2026

The short version

The free generator and validator remain entirely client-side. When you use those browser tools, no invoice data, names, amounts or VAT numbers are transmitted to our servers or anyone else's. You can verify this in your browser's network tab.

The invite-only REST API has a different and explicit boundary: invoice data is encrypted in transit, processed transiently in the API Worker's memory, returned to the caller, and never retained, cached, logged or sent onward.

What is processed, and where

• Invoice data entered in the browser tools — processed locally in your browser only. If you tick "remember my business details", they are stored in your browser's localStorage on your device. You can clear this at any time via the checkbox or your browser settings. We never receive it.
• Invoice data sent to the REST API — transmitted over HTTPS and available in plaintext to the API process only while it validates the request and generates the response. It is not written to a database, object store, cache, analytics service or application log. The API sends no invoice data to downstream services.
• API operational measurements — pseudonymous API-key ID, route, requested profile, response status and latency bucket. We do not include request or response bodies, generated XML, authorization headers, names, addresses, VAT numbers, invoice numbers, amounts, raw IP addresses or user agents.
• Server logs — our hosting provider serves static files (HTML, CSS, JavaScript) and, like virtually all web hosts, may briefly process technical data (IP address, user agent) to deliver requests and protect against abuse. API Worker invocation and application-log persistence are disabled. We do not use infrastructure data to identify users.
• Email — if you email us (e.g. API early access), we process your email address and message to respond. We don't add you to lists without asking.

Cookies and analytics

We set no cookies and run no advertising or cross-site tracking scripts. To understand how many people use Fakturate, we use Cloudflare Web Analytics, a cookieless service that collects aggregate statistics only — page views, referrers and page-load performance. It does not use cookies, does not fingerprint or store personal data, and does not track you across sites. Cloudflare already serves the site itself, so this adds no new third party. Invoice contents are never sent to Cloudflare or included in API operational measurements.

Your rights (GDPR)

For the browser tools, there is normally no personal data held by Fakturate to access, correct or delete. For API-key administration, operational measurements or email correspondence, contact hello@fakturate.com and we will respond in accordance with the GDPR. You also have the right to lodge a complaint with your local data protection authority.

Controller

See the imprint for the operator's identity and contact details.