This policy describes what data is processed when you visit this website and when you use the InvoiceWerk app — in plain language, in line with Art. 13 GDPR. In case of dispute, the German version prevails.
1. Controller
Responsible for data processing on this website and in the app: Yusuf Kasapoglu, Leinsamenweg 74, 50933 Cologne, Germany, email: invoices@invoicewerk.de.
No data protection officer has been appointed, as there is no legal obligation to do so.
2. This website
Things are refreshingly simple here: this website uses no cookies, no tracking, no analytics, no external fonts, no embedded maps, no social plugins and no CDN. That is why it needs no cookie banner.
Local storage (localStorage)
The only local storage is two entries in your browser’s localStorage: your language choice (German/English) and your colour mode (light/dark/system). Both never leave your device, allow no personal profiling and are only set when you use the switches — which makes them technically necessary or explicitly requested by you (§25 (2) TDDDG).
Server log files
When the site is requested, the web server automatically writes log files: IP address, time of access, requested file, referrer and user agent. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in stable, secure operation). Log files are rotated daily and deleted automatically after 14 days at the latest.
Hosting
The site runs on a server operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, located in Germany. Domain, DNS and the mailbox service are provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. A data processing agreement under Art. 28 GDPR is in place with both providers.
The connection to this website is TLS-encrypted.
3. The app
The InvoiceWerk app processes real business data — briefly and honestly, this is what that covers:
- Account: email address and password. The password is stored solely as an Argon2 hash, never in clear text. Verification codes and sign-in tokens are likewise kept only as hashes.
- Company profile: company name, owner, address, phone, email, tax number, the tax office in charge, small-business flag, and IBAN and BIC.
- Customer data: name, street, postcode, city and email address of the contacts you create for your invoices.
- Invoices: line items, quantities, units, tax rates, amounts, invoice and service dates, and the PDF files generated from them.
- Sending log: recipient address, time, delivery status and the delivery provider’s response for every invoice sent.
- Tax adviser: the email address you store for the bulk export — only if you use that feature.
The app stores no IP addresses. To limit sign-in and verification attempts, the requesting device’s address is held briefly in memory; it is neither written to the database nor logged permanently.
Processing takes place on a server in Germany. The sole purpose is providing the service (Art. 6 (1) (b) GDPR). For sending invoice and account emails, Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, acts as a processor under Art. 28 GDPR.
Invoice data is retained in line with commercial and tax law retention periods. There is no sharing for advertising purposes, no selling of data and no profiling.
4. Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent at any time with effect for the future.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.
5. Contact for privacy requests
For anything concerning your data: invoices@invoicewerk.de. We reply without undue delay, at the latest within one month.