Privacy Policy
Last updated: April 2026
1. Controller
Data controller within the meaning of the GDPR:
2. What data we collect
- •Email address — entered by you for the IMAP connection or provided via OAuth.
- •Email password / App password — IMAP only. Processed in memory only, never stored.
- •OAuth access tokens — temporary, cookie-based, expire after 1 hour.
- •Email content — subjects, headers, and attachments of emails identified as invoices.
- •IP address — in server logs, standard web hosting.
- •Language preference — stored in localStorage, browser-side only.
3. How we use your data
- •To connect to your email server and scan for invoices.
- •To generate a downloadable ZIP file of your invoices.
- •To process payments via Stripe.
What we do NOT do:
✗ Use your data for marketing, analytics, or profiling
✗ Sell or share your data with third parties
4. Data processing and storage
Email credentials
Processed in server memory ONLY during the active scan session. Never written to disk, database, or logs. Immediately deleted from memory after the scan completes.
OAuth tokens
Stored in encrypted httpOnly cookies. Expire after 1 hour. Not stored server-side.
Extracted invoices
Temporarily stored on the server for download. Automatically deleted within 2 hours or 5 minutes after download, whichever comes first.
No persistent database
No persistent database. No user accounts. No tracking.
5. Third-party services
6. Your rights (GDPR Art. 15–21)
- •Right of access (Art. 15 GDPR)
- •Right to rectification (Art. 16 GDPR)
- •Right to erasure — data is auto-deleted, but you can request immediate deletion (Art. 17 GDPR)
- •Right to restriction of processing (Art. 18 GDPR)
- •Right to data portability (Art. 20 GDPR)
- •Right to object (Art. 21 GDPR)
- •Right to withdraw consent at any time
- •Right to lodge a complaint with a supervisory authority
To exercise your rights, please contact: gennaro.frenken@gmail.com
7. Cookies
We use only strictly necessary cookies:
No tracking cookies, no third-party cookies. Language preference is stored in localStorage (not a cookie).
8. Data retention
Email credentials
0 seconds (memory only during scan)
OAuth tokens
Max 1 hour
Extracted files
Max 2 hours, deleted after download
Server logs
30 days (standard hosting)
Payment records
As required by law (Stripe handles this)
9. Security
- •All connections encrypted via TLS/HTTPS
- •IMAP connections use SSL/TLS (port 993)
- •OAuth tokens signed with HMAC-SHA256
- •No persistent storage of sensitive data
10. Changes to this policy
We may update this privacy policy from time to time. Last updated: April 2026.
11. Contact
For privacy-related questions, please contact:
Gennaro Frenken