Who is responsible

Rayquest Ventures LLC, at the address shown above, operates FakturFokus. We are the controller for account administration, website operation, support, security and our own business records. Contact us using the privacy address above or the workspace's Support section.

When a business customer supplies personal data in invoices, contacts or other workspace records, that customer determines the purpose and lawful basis of its use. We process that content on its instructions under the data processing agreement. If your information appears in someone else's invoice, contact that business about its invoice records; we will assist it with applicable requests.

Data we process and why

We receive information you enter, files you select or upload, messages you send, identity and subscription information from our service providers, and technical data generated when you use the service. We do not obtain customer invoice data from data brokers.

  • Account and service administration: name, email address, account/session identifiers, sign-in times, settings, policy acknowledgement and usage allowances. These let us provide your account and enforce service limits. Where the GDPR applies, the basis is Article 6(1)(b) for a contract with you, or Article 6(1)(f) for administering an organisation's account and communicating with its users.
  • Invoice workspaces: seller/customer details, contacts, products, drafts, uploaded files and reports. Documents may include names, postal addresses, tax identifiers, bank details, invoice items and amounts. We use them to perform the functions you request; processing for business customers follows their instructions.
  • Support: your messages, contact information, request identifiers and attachments you choose to provide. We use them to answer and resolve requests, on Article 6(1)(b) or, for business representatives and general inquiries, Article 6(1)(f).
  • Security and reliability: connection information such as IP addresses, route/status/request identifiers, timing, diagnostic information and access logs. Our legitimate interests under Article 6(1)(f) are protecting accounts, preventing abuse, investigating faults and keeping the service available.
  • Purchases and records: for an existing or separately ordered Paddle purchase, customer, transaction, subscription and entitlement identifiers and purchase details. We use these to provide the purchased service, reconcile payments and meet legal obligations: Article 6(1)(b), Article 6(1)(f) for business administration and Article 6(1)(c) where applicable law requires retention.

Providing an email address and authentication information is necessary for a private account. Without the information needed for a requested operation, we cannot perform that operation. You choose which documents to process and which optional details or support attachments to supply. Do not upload special-category data, criminal-record data or information unnecessary for invoicing.

Browser checks, storage and tracking

The anonymous public validator processes selected files in your browser without uploading their contents. Visiting the website still involves normal network connections and technical connection data. Signed-in workspace processing and private storage are separate: operations that upload or save files use our application and storage providers.

The browser stores your authentication session and appearance preference. Private response caches are held in memory and cleared on account changes or rejected session verification. Fonts and public validator resources are served from this site. We do not use advertising cookies, cross-site advertising or audience analytics. Opening Paddle services may involve Paddle's own cookies and privacy terms.

Service providers and recipients

We disclose data needed to operate the service to these providers:

  • WIIT AG (webtropia), Germany: application hosting and network infrastructure in Germany. Hosting processes connection data and the requests and documents handled by the application. Provider privacy notice.
  • Supabase: authentication, database, private file storage and account-email delivery, including its delivery subprocessors. Our project data is hosted in Frankfurt, Germany. Supabase's contracting entity and international operations are described in its privacy notice and data processing addendum.
  • Zoho Mail: the mailbox for support@fakturfokus.de, used for support, privacy requests and business correspondence. Zoho processes sender/recipient addresses, message contents, attachments and delivery/security metadata. Workspace documents are not automatically forwarded to this mailbox. Provider privacy notice.
  • Namecheap: domain and DNS services, which handle domain-resolution and related technical metadata. DNS does not receive invoice contents from the application. Provider privacy notice.
  • Paddle, when you use its purchase or billing services: payment, tax, purchase and fraud-prevention data. Paddle acts as merchant of record and processes its own transaction data under its privacy notice. We do not store full payment-card details. New paid purchases are currently paused during the free beta.

Authorised personnel may access data needed for support and operations. The operator console exposes account and document metadata, rather than invoice contents or document downloads. If you attach a document to a support request, support can read that attachment. We may also disclose information where legally required, to respond to lawful requests or to establish, exercise or defend legal claims. We do not sell personal data or use invoice contents for advertising.

International processing

Rayquest Ventures LLC is a US company, and account/support administration is performed from the United States. German hosting does not mean that every recipient or support activity is located in the EU. Supabase also describes international operations, including Singapore and the United States, in its data residency and transfers information. Zoho describes processing within its international group, including the United States, EEA and other operating countries, in its linked privacy notice; we do not promise EU-only email processing.

For transfers covered by GDPR Chapter V, an applicable adequacy decision or another lawful transfer mechanism is required. Supabase's published data processing addendum includes standard contractual clauses for the transfers it covers. The data processing agreement sets out our obligations for customer-controlled data and restricted transfers. A German server location alone is not a transfer safeguard. You can request information about the arrangements applicable to your data through the privacy contact above.

Retention and deletion

  • Files and reports: Free files/reports expire seven days after job creation. An existing advanced report can retain its recorded thirty-day period. Downloads stop at expiry and background maintenance removes the stored objects. The report's displayed expiry governs its availability.
  • Saved workspace records: drafts, contacts, products and settings remain until you delete them or close the account. These records do not extend the expiry of uploaded files or reports.
  • Support: closed workspace tickets, messages and attachments are retained for up to 180 days after closure. Account closure removes their content and attachments earlier. Separate email correspondence is kept while handling the inquiry and afterwards only as necessary for an ongoing account matter, a legal obligation or a legal claim. Closing an application account does not automatically erase a separate email thread; contact us about its deletion.
  • Operator access records: account-view events, including operator/account identifiers, are retained for 365 days to investigate access and maintain accountability.
  • Technical logs: application logs are capacity-rotated; older records are overwritten as the bounded log allocation fills. Provider security and infrastructure records follow the relevant provider's retention terms. Records needed for a specific security incident or legal claim may be kept until that matter is resolved.
  • Account and payment records: account closure disables access and queues deletion of workspace content and the authentication account. Minimal transaction, legal-claim, security or deletion records may remain for applicable legal obligations or until the relevant claim/incident period ends. Paddle retains its own transaction records under its policies and legal duties.

Deletion is performed asynchronously and a service outage can delay its completion. A deletion from active storage does not rewrite an already existing recovery copy. Such copies are restricted to recovery and expire under their backup rotation; deletion records must be reapplied before restored data is made available. FakturFokus is temporary working storage, not statutory invoice archiving or a guarantee that a lost file can be recovered. Keep independent originals and export results before expiry.

Your rights and requests

Where the GDPR applies, you may request access, correction, erasure, restriction and data portability, subject to the conditions of those rights. You may object to processing based on legitimate interests on grounds relating to your situation. If we request consent for an optional purpose, you may withdraw it without affecting earlier lawful processing. You may complain to the data-protection authority in the EU/EEA country where you live or work, or where an alleged infringement occurred. Find an authority.

Use the privacy contact above or workspace Support. We may request proportionate proof of identity before disclosing or changing account data. For GDPR requests we respond without undue delay and normally within one month; if a lawful extension is necessary, we explain it within that month. Requests are normally free, subject to the legal rules for manifestly unfounded or excessive requests. Other applicable privacy laws may give you additional rights.

You can also export available files, delete saved records and close your account through Settings. Invoice checks provide technical findings; we do not use them to make automated decisions about individuals with legal or similarly significant effects. We update this notice when processing changes and communicate material changes through the service or an appropriate account communication.