Privacy Policy

What we collect

• Your account: the email address you sign up with, and your organisation name.
• Usage counts: how many validations your organisation has run.
• Findings metadata: rule ids, severities and XPath locations. No invoice values are recorded.

Invoice files

Invoice XML is processed in memory for the duration of the request. It is never stored, never logged and never transmitted to anyone.

Controller and processor

You remain the controller of your invoice data. Mutabiq acts as a processor of it, and only for the duration of the request.

Sub-processors and where data is stored

• Supabase — database and authentication, in Frankfurt.
• Vercel — hosting.
• Paddle — payments.
• Cloudflare — DNS and email routing.
• Resend — sign-in emails.

Account data is therefore stored in the European Union.

The site uses Vercel Analytics. It receives page views, and four events: an account was created, an account ran its first validation, somebody asked to upgrade a plan, and a payment completed. Those events carry only the plan and the language of the page. It sets no cookies of its own, and query strings are stripped. As with any request to any website, it also receives the IP address the request comes from and the user agent the request carries.

Retention

We keep your account, usage counts and findings metadata for as long as your account exists. When an account is deleted, that data is deleted within 30 days.

Contact

For privacy matters, write to privacy@hayatiq.ai. For anything else, write to support@hayatiq.ai.