Privacy Policy

Last updated: November 2, 2026

1. Who We Are

InvoiceStack is an individual project operating at invoicestack.app. For the purposes of the GDPR, the Data Controller is the individual operating this website, reachable at the contact below.

For privacy questions: legal@invoicestack.app

A Data Protection Officer (DPO) has not been appointed as we do not meet the criteria under GDPR Art. 37.

2. What We Collect

2.1 Through the Extension

• License key: purchased via Lemon Squeezy, transmitted to validate your usage.
• Airbnb invoice HTML & booking codes: sent to our API (api.invoicestack.app) for PDF generation.
• These are processed transiently and deleted immediately after the download response is sent. PDFs exist only in memory during generation and are never persisted.
• Error reports: if a download or document generation fails, the extension sends a technical error report to our API so we can diagnose and fix the problem. See section 2.3 for what a report contains.

2.2 Through Our Website

• Nothing by default. No accounts, no comments, no user registration.
• Support form: if you write to us, we receive your name, email address, the extension your message is about and the message itself. We use them only to answer you and keep them for as long as needed to handle your request. Legal basis: your request (GDPR Art. 6.1.b).
• If you sign up for product updates (future), we collect only your email address with explicit consent.

2.3 Through Our Server (api.invoicestack.app)

• PDF files: Generated and deleted after download. Never stored.
• License records: your license key, plan and remaining credits, and the purchase email address we receive from Lemon Squeezy. The email is used to identify your license for support requests, to enforce free-trial limits and, occasionally, to ask how the extension is working for you, whether you need help or whether you would leave a review (legal basis: legitimate interest, GDPR Art. 6.1.f). You can ask us at any time not to write to you again. No other personal data is tied to the license.
• Abuse prevention: we record the IP addresses from which a license key is used, to enforce fair-use limits and prevent license sharing. Blocked attempts are logged with a truncated license reference. Legal basis: legitimate interest (GDPR Art. 6.1.f).
• Error reports: when a download fails, the extension sends the error message, the order or reservation reference, the extension name and version, and the names of the data fields that were missing on the page. A report never includes your name, address, payment details, your license key, or the content of your documents. Reports are used solely to diagnose and fix problems, only the most recent reports are retained (at most 1,000), and they are never shared with third parties. Legal basis: legitimate interest (GDPR Art. 6.1.f).
• Server logs (Apache): IP address, timestamp, requested URL. Retained for 14 days for security and abuse prevention. Legal basis: legitimate interest (GDPR Art. 6.1.f).

2.4 Through Payments (Lemon Squeezy)

• We do not receive or store your payment details.
• Lemon Squeezy processes all payments as our merchant of record.
• See Lemon Squeezy Privacy Policy.

2.5 Analytics

• Our website counts page views and clicks on some buttons with Umami, a statistics tool we run on our own server in the EU.
• It sets no cookies, does not store IP addresses and shows us only aggregate figures (see Cookie Policy).
• No statistics data is shared with third parties. Legal basis: legitimate interest (GDPR Art. 6.1.f).

3. B2B Outreach

We may contact businesses using publicly available professional email addresses (e.g., company websites, LinkedIn) to introduce our service. We only contact addresses associated with business entities, not private individuals.

• Legal basis: Legitimate interest (GDPR Art. 6.1.f).
• Every email includes an unsubscribe link.
• Opted-out addresses are never re-contacted.
• We do not purchase email lists.

4. How We Use Your Data

• Validate your license key
• Generate invoice PDFs
• Track remaining credits on your license
• Diagnose and fix download failures reported by the extensions (error reports)
• Optional: send product updates (only with your consent)
• Protect our server and licenses against abuse (log analysis, fair-use limits)

5. Data Sharing

• Lemon Squeezy: payment processing and license validation.
• No other third parties. We do not sell, rent, or trade your data.

6. Your Rights (GDPR)

As an EU resident, you have the right to:

• Access: request a copy of any personal data we hold.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data.
• Restriction: limit how we process your data.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, where processing is consent-based.
• Complaint: lodge a complaint with your local data protection authority.

To exercise any of these rights, contact: legal@invoicestack.app

7. Data Retention

8. Security

All data transmission is encrypted via HTTPS. Our server is hosted on Hetzner (Helsinki, Finland, EU), who acts as a sub-processor under GDPR. We follow reasonable security practices to protect your data.

9. Children’s Privacy

Our service is not directed to individuals under 16. We do not knowingly collect data from children.

10. Changes to This Policy

Updates will be posted on this page. Significant changes will be communicated via email if you are subscribed to product updates.