Privacy policy

This policy explains what personal data E-Invoice Map processes, why, and what your rights are under the GDPR ^[1].

Who is responsible

The controller is Mohamed (Mo) Farag, Carrer de Floridablanca 68, Local 9F, 08015 Barcelona, Spain. Contact: [email protected]. Details are in the legal notice.

What we process, and why

Data	Purpose	Legal basis	Kept for
Page statistics: counted from our web server log by our self-hosted GoatCounter, with no script in your browser: the page, the referring site, the browser type and the country	knowing which pages are useful	legitimate interest	aggregated counts; nothing is stored on your device, no profile of you. The log lines used for counting are kept 14 days, like the server log. If your browser sends Global Privacy Control or Do Not Track, the visit isn't counted
Lookup requests: the number you type is sent to the Peppol network (see below) and the answer is cached under a scrambled key. We keep no log of the numbers people look up	answering the lookup and caching	legitimate interest	the cached answer 24 hours
Rate limiting: a short-lived counter keyed on a hash of your IP address	the daily limits (20 lookups, 200 rows in a bulk check), abuse protection	legitimate interest	24 hours
Privacy requests: what you send through the form below, including your email	handling your request	legal obligation	your email and message 90 days after we close the request; then only the type, dates and a scrambled form of the identifier, blocked (nobody uses it), for up to 3 years as proof of how we answered
Reports and corrections ("Report a problem" at the bottom of each page): the page, your message, an optional source link and, only if you give it, your email	checking and fixing the site, and replying to you (a copy of each report is emailed to our mailbox at [email protected])	legitimate interest	12 months; your email is erased 90 days after we close the report
Notices of illegal content (the same form, "Illegal content"): the page, your explanation, your name and email	handling the notice under the Digital Services Act and telling you our decision	legal obligation	12 months; your name and email are erased 90 days after our decision
Clicks on provider links ("Visit" links to a provider's website): which provider, the country page, the page and the spot on it, the language and the day. No IP address, no cookie, nothing about you	knowing which pages help people choose, and reporting clicks to affiliate networks and to providers with a Featured listing	legitimate interest	daily totals, kept as statistics
Web server log: your IP address, the time, the page asked for (without query strings, so not the numbers you look up), the answer code and your browser type. Clicks on provider links are logged without the IP address	security, and finding and fixing errors	legitimate interest	14 days
Peppol participant data (sole traders included), from the public Peppol Directory and the Peppol network, not from you: the identifier, its scheme and country, its access-point provider and the dates we saw it	the lookup, daily counts and aggregated market shares	legitimate interest, see our assessment; Spanish law presumes it for sole traders' business data (LOPDGDD art. 19) [3]	while listed in the Directory and 12 months after it disappears; the result of each monthly check of a sample of identifiers 24 months; the counts and shares we publish contain no identifier

We never store names, email addresses or phone numbers of companies or people from the Peppol Directory or from official lists. We never sell data and never build profiles of visitors.

The e-invoice viewer

Files you open in the viewer are processed only in your browser. They are never uploaded, stored or seen by us.

The Peppol network and company registers

• Peppol network. To answer a lookup, our server asks the public Peppol network: a DNS query, then the company's own provider (its SMP server), exactly as a sender's e-invoicing software does. The provider sees the number and our server's address, not yours.
• Company-name search (Norway and France): if you type a company name and press "Search the register", your browser asks the official register directly (Brønnøysundregistrene in Norway, the Annuaire des Entreprises in France). We never see the name; the register sees it, with your IP address, under its own privacy notice.

Service providers

• Hosting: a server operated by Hetzner Online GmbH in Germany.
• Cloudflare, Inc. (USA): network delivery and security, the Turnstile bot check on the lookup and request forms, and forwarding of emails sent to [email protected]. Cloudflare processes technical connection data (your IP address, browser signals) on our behalf.
• Lettermint (Netherlands, EU servers): sends the emails you ask for (confirmation links and, if you have an account, login links and alerts). It receives your email address and the text of that email, does not track opens or clicks, and keeps delivery logs for 28 days.
• Google (Gmail): the mailbox behind [email protected]. Emails you send us, and our replies, are stored there. For that mailbox Google acts under its own privacy policy.

Transfers outside the EU. Cloudflare, Inc. and Google transfer data to the United States under the EU–US Data Privacy Framework, an adequacy decision of the European Commission ^[4]. If that framework stops applying, the European Commission's standard contractual clauses apply. You can ask us for a copy of the safeguards.

Your rights

You can ask for access, correction, erasure and restriction, and you can object to processing based on legitimate interest, including the display of lookup results for an identifier that relates to you as a sole trader: we then stop showing it and stop storing it, and keep only a scrambled form of the identifier so it isn't added again. You can withdraw a consent at any time (early access). We make no decisions about you by automated means. Requests are free; if we have real doubt who you are, we may ask for proof. We answer within 7 days and at the latest within one month (three months for a complex request; we tell you within the first month). You can also complain to the Spanish data protection authority (AEPD) ^[2].

Accounts: if you create an account or buy a plan, the privacy notice for accounts explains what we store about you, and the data processing terms cover the lists you add.

Early access to sending: if you join the early-access list for sending e-invoices, the sign-up page explains what we store (your email, company, country, tax ID and your answers) and when we delete it: unconfirmed sign-ups after 24 hours, everything else 12 months after sign-up or when the test ends.

Service enquiries: if you send an enquiry through the Integration help page, we store your name, work email, company, country and message. Purpose: to answer you and prepare a quote. Legal basis: steps taken at your request before a contract, GDPR art. 6(1)(b). We keep them 12 months after you send the enquiry, and longer only if a contract follows. We never use them for marketing, never share them and never show them to anyone else. A copy of each enquiry is emailed to our mailbox at [email protected]. We don't take work from companies established in Spain, so enquiries from Spain are refused and not stored.

Claiming a profile: if you claim a provider's profile, the claim page explains what we store: the domain you verified, how you verified it (an email at that domain or a DNS record), the times, and what you send in (corrections, a description, a logo). We don't store your name or your email address: the one verification email goes to the address you type, and nothing is kept. Your browser tab keeps a short-lived token (2 hours) so a reload doesn't lose your work. What you send is published only after a person has reviewed it. Claims that lead nowhere are deleted after 90 days, rejected submissions after 12 months; a claim whose corrections were published stays for as long as they show.

Links marked “Ad”: when you click one, you go through the affiliate network that runs the provider's partner programme (such as Awin, Daisycon, Impact, PartnerStack or Affilae) to the provider's website. The network and the provider may then set their own cookies on their own websites to recognise that you came from us, so we are paid if you sign up. Those cookies are theirs and fall under their privacy notices, linked from their websites. We only tell the network which of our pages, and which spot on it, the link was on: never anything about you.

Email me this page: if you ask us to email you a link to a page, we use your address only to send that one email and keep nothing: no address, no list. We count how many such emails go out per day, and a short-lived counter (a salted hash of your address, gone after an hour) stops abuse.

What your browser stores for this site, and why no consent banner is needed, is on the cookies page.