Privacy Policy

What we collect

• Your account: the email address you sign up with, and your organisation name.
• Usage counts: how many validations your organisation has run.
• Findings metadata: rule ids, severities and XPath locations. No invoice values are recorded.

Invoice files

Invoice XML, and a PDF/A-3 invoice together with the XML embedded in it, is processed in memory for the duration of the request. It is never stored, never logged and never transmitted to anyone.

That processing runs on Vercel's servers in Frankfurt (region fra1), and the file is discarded when the check ends.

Controller and processor

You remain the controller of your invoice data. Mutabiq acts as a processor of it: the invoice file itself is processed only for the duration of the request and is never stored. The findings metadata of each check, and any label you type for a check, are stored on your behalf, with Mutabiq as their processor, for the period stated under Retention.

Sub-processors and where data is stored

• Supabase — database and authentication, in Frankfurt.
• Vercel — hosting.
• Paddle — payments.
• Cloudflare — DNS and email routing.
• Resend — sign-in emails.

Account data is therefore stored in the European Union.

We will update this page and email organisation owners at least 30 days before adding or replacing a sub-processor, except where a change is needed urgently for security, in which case we notify as soon as practicable.

The site uses Vercel Analytics. It receives page views, and four events: an account was created, an account ran its first validation, somebody asked to upgrade a plan, and a payment completed. Those events carry only the plan and the language of the page. It sets no cookies of its own, and query strings are stripped. As with any request to any website, it also receives the IP address the request comes from and the user agent the request carries. Vercel keeps that analytics data for 12 months, the reporting window of the plan this site is on, and its documentation says it may hold the data for longer than that window.

Retention

We keep your account and usage counts for as long as your account exists. Findings metadata, with the record of the check it came from, is kept for 12 months from the day of the check and then deleted automatically. When an account is deleted, that data is deleted within 30 days.

If you type a label for a check (such as a client name, a branch or a reference), it is stored with that check's findings metadata and is visible to every member of your organisation. It stays with the organisation's history, including if the person who typed it later leaves, and is deleted with it after the same 12 months. Mutabiq processes it on your behalf. It is never taken from the invoice or its file name. Do not type personal data you do not need.

You can delete your account yourself, from the Members page when you are signed in. Any organisation in which you were the only member is deleted with it. An organisation that still has other members keeps its own usage counts and findings metadata.

Contact

For privacy matters, write to privacy@hayatiq.ai. For anything else, write to support@hayatiq.ai.