Privacy Policy
1. Personal Data Controller
The controller of personal data in the Invoicing Service is Individual Entrepreneur Orest Mykolaiovych Kostiuk (ФОП Костюк Орест Миколайович). For privacy questions and the exercise of data rights, contact kostiuk.orest.m@gmail.com. The Service is available at invoice.bitbrothers.dev.
The Ukrainian version of this Policy is legally controlling. The English version is its translation.
2. Account and Issuer Profile Data
• Account data: e-mail address, technical account identifier, selected interface language, and data needed for authentication. A password is stored as a cryptographic hash, not as plain text.
• Issuer profile data, if provided by the User: business or personal name, address, e-mail, phone number, tax identifier, bank details, payment terms, Invoice header and footer text, currency, tax rate, and PDF settings.
The account has no separate natural-person name field; a name may be entered by the User as issuer information.
3. Customer and Invoice Data and the Parties' Roles
The User may enter personal data of the User's own customers and counterparties: personal or business names, addresses, e-mail addresses, tax identifiers, notes, and customer-specific issuer details, contacts, tax identifiers, and bank details intended for Invoices to that Customer.
Invoice data may include its number, dates, status, currency, tax rate, line-item descriptions, quantities, prices, totals, notes, and other information entered by the User. Free-text content is determined by the User and may therefore include additional personal data.
For personal data of the User's own Customers, the User acts as the data controller: the User determines the purpose, lawful basis, data set, recipients, and retention period. The Provider processes that data on the User's behalf and instructions only to provide the Service. The User is responsible for informing Customers, having a lawful basis, and handling their requests; the Provider supplies reasonable technical assistance.
4. Uploaded Files and Technical Data
The User may upload a company logo or a separate issuer logo for a particular Customer. The file, filename, type, size, and technical metadata are stored through the Service's file storage.
During operation, technical logs may contain request time, IP address, user agent, route, a technical session identifier, background-job status, and error and e-mail-delivery information. Sensitive parameters, including passwords, tokens, and e-mail fields, are configured to be filtered in application logs.
5. Purposes and Legal Bases
Data is processed to: create and protect accounts; save settings; maintain Customers; create, display, localize, and generate PDF Invoices; send Invoices by e-mail; show statuses; operate, secure, and diagnose the Service; respond to requests; perform the agreement; and comply with law.
Depending on the operation, processing is based on performance of the agreement or steps before entering into it, legitimate interests in Service security and support, consent where required, or compliance with a legal obligation. The Service does not sell personal data or use it for third-party behavioral advertising.
6. Cookies and Local Preferences
The Service uses technically necessary signed cookies for sessions, authentication, sign-in protection, and saving the selected interface language. The authentication and language cookies are HttpOnly and SameSite=Lax. The Service does not use third-party advertising or analytics cookies.
The light or dark theme preference is stored locally in the browser through localStorage rather than in a cookie.
7. Subprocessors and Processing Locations
• Hetzner Online GmbH (Germany, EU) — hosting for the Invoicing application, PostgreSQL databases, and file storage in the current production deployment.
• The SMTP relay configured by the Provider in the production environment — delivery of Invoice e-mails. Delivery transmits sender and recipient addresses, subject, message body, and the attached PDF. The specific SMTP provider is not hard-coded in the Service.
Core data for the current deployment is stored on Hetzner infrastructure in Germany. Each subprocessor receives only data needed for its technical function.
8. Retention
Account, Customer, Invoice, setting, and uploaded-logo data is retained while the account is active or while needed to provide the Service. The User determines how long to retain Invoices in the active account in light of the User's own legal, tax, and accounting obligations.
After a substantiated deletion request, data is deleted or anonymized in the ordinary technical cycle except for information that must be retained to comply with law, meet the Provider's accounting or tax duties, protect rights or security, or handle a request already submitted. Technical logs are kept for the period needed for diagnosis and security and are overwritten in the ordinary operational cycle.
9. Data Subject Rights
A User or another person whose data is processed may request access to and a copy of data, its correction, updating or deletion, restriction of or objection to processing where applicable, and may withdraw consent without affecting the lawfulness of earlier processing.
To exercise these rights, write to kostiuk.orest.m@gmail.com, describe the request, and provide information sufficient to locate the relevant account, Customer, or Invoice. We may ask the requester to verify identity and authority. Requests are handled on business days within 10 business days or within another period if required by law.
If a request concerns Customer data entered by a User, the data subject should generally contact that User first as the controller of the data. The Provider will cooperate with the User to give effect to a verified request.
10. Security
The Service uses access separation between accounts, password hashing, HTTPS in production, signed HttpOnly cookies with SameSite protection, filtering of sensitive log parameters, and authorization checks for Customer and Invoice access. Users are responsible for protecting their passwords and devices. No method of transmission or storage guarantees absolute security.
11. Changes to this Policy
The current version of this Policy is published on this page. Changes apply after the updated version is published; if required by law or the nature of a change, an additional notice will be provided or consent requested.