Privacy policy

Short version: we keep your email address, a hash of your API key, a monthly counter and how you found us. We never keep the invoices you send. There are no cookies.

Last updated 19 October 2026.

Who is responsible

Invoir (invoir.dev and validate.invoir.dev) is operated by Miloš Moravac PR MoravacNET, Vojvode Stepe 275, 11010 Belgrade, Serbia, which is the controller of the data described here. For anything about your data, write to [email protected].

We are established outside the European Union. Because we offer the service to people and companies in the EU, the GDPR applies to how we handle your data, alongside Serbia's data protection law, which mirrors it. Your data is stored and processed in Germany; we access it from Serbia to run the service.

The invoices you send

Files uploaded to the validator page or sent to the API are processed in memory and discarded as soon as the response is sent. They are not written to disk, not kept in backups and their contents and file names are not logged. What is logged per request: time, endpoint, result (valid, invalid, unsupported, error), the detected format, the file size and the processing time.

What we store when you sign up

• Your email address, when you signed up and when you confirmed it.
• A SHA-256 hash of your API key. The key itself is shown to you once and never stored, which is why it can only be regenerated, not recovered.
• Usage counters: how many documents your account validated in each month, and when your key was last used.
• How you found us: the campaign parameters in the link you arrived through (utm_source, utm_medium, utm_campaign, utm_term, utm_content, Google’s gclid) and the address of the page that linked to us. We use this to see which channels bring developers who actually use the API.
• Link tokens: the links in our emails contain random tokens; we store their hashes until they expire.

We use this data to run your account (the free quota, the key page), to keep the service secure and to understand where signups come from. In GDPR terms that is performance of a contract and our legitimate interest in running and improving the service.

Rate limiting and server logs

To protect the service, the IP address of each request is kept in memory for rate limiting and forgotten within minutes. Web server logs with IP addresses, time and path are kept for up to 30 days.

Email

We send only emails you asked for: the confirmation link when you sign up, and links to your key page when you request them. They are sent through Amazon Web Services (Amazon SES) from its Frankfurt region. No newsletters, and no tracking pixels or link tracking in our emails.

Where the data lives

• Hetzner Online GmbH, data centre in Nuremberg, Germany: the servers that run the validator, the API and the account database.
• Cloudflare: DNS, TLS and proxying for all invoir.dev hostnames, and the static pages of invoir.dev. Cloudflare sees the IP addresses of visitors in order to route traffic. We use Cloudflare Web Analytics, which is cookie-free and does not identify visitors.
• Amazon Web Services, Frankfurt: sending our emails.

All of these act as processors on our behalf and are bound by data processing agreements. Nothing is sold or shared with advertisers.

Cookies

None. Neither invoir.dev nor validate.invoir.dev sets cookies or uses local storage, which is why you see no cookie banner.

How long we keep things

Account data stays until you ask us to delete it. Database backups are kept for 14 days. Link tokens are deleted after they expire. Server logs rotate within 30 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, or object to how it is used, by emailing [email protected] from the address you signed up with. Deleting your account revokes your API key immediately. You also have the right to complain to a data protection authority: the one in your EU country, or Serbia's Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

Changes

When this page changes, the date at the top changes with it. If a change affects what we do with your data, we email you first.

Legal notice

Miloš Moravac PR MoravacNET
(registered sole trader; full business name: Miloš Moravac PR veb portali MoravacNET Beograd)
Vojvode Stepe 275, 11010 Belgrade (Voždovac), Serbia
Registration number (matični broj): 64846353
Tax ID (PIB): 110402054
Email: [email protected]
Responsible for content: Miloš Moravac