VERSION 2026-09-22

Document Render processing

Where enabled, the controller instructs ApiVect to render supported HTML or JSON report input to a private PDF through the documented documents:render-scoped API. Input is encrypted until completion, failure, cancellation or the 90-second job deadline. The resulting PDF is encrypted and available to the same workspace for one hour from creation; an encrypted replay receipt remains for 24 hours. The PDF becomes unavailable at expiry before bounded 30-second cleanup, while encrypted backup copies follow the agreement's standard retention. Rendering does not use JavaScript, remote assets, OCR or Factur-X processing.

VERSION 2026-09-17

Data processing agreement.

This agreement forms part of the ApiVect business service terms. The registered business is the controller of personal data it submits for validation. KPdesign, CVR 41134194, is its processor for those operations. Account administration and security processing for KPdesign's own purposes are described separately in the privacy policy.

Processing instructions and scope

The controller instructs ApiVect to receive, validate and return invoice, VAT and public domain checks through the documented endpoints, maintain usage records, provide encrypted retry results and operate the necessary security and backup functions. Processing lasts for the account's use of the service and the retention periods below. Data can concern customers, suppliers, sole traders and business contacts, including invoice identifiers, business contact details, VAT identifiers and domain names. Special-category data is not permitted. The controller is responsible for lawful collection, notices and authority to issue these instructions.

Confidentiality and security

ApiVect limits access to authorized personnel subject to confidentiality. Technical measures include TLS, hashed passwords and keyed API-key hashes, mandatory portal MFA, tenant isolation in PostgreSQL, constrained outbound network checks, encrypted retry/mail payloads, secret separation, security logging and encrypted backups. ApiVect will maintain risk-appropriate security measures, investigate incidents and assist the controller with necessary security and impact-assessment information.

Assistance and incidents

ApiVect will notify the controller without undue delay after becoming aware of a personal data breach affecting its data, with known scope, consequences, response measures and contact details, and provide updates as information becomes available. ApiVect assists with requests to access, correct, export or erase data and with the controller's duties under GDPR Articles 32–36. Data-subject requests received directly are referred to the controller where applicable. ApiVect will inform the controller if an instruction appears to infringe data protection law, and will not use customer data for an unrelated purpose.

Providers and onward processing

The controller authorizes the following current infrastructure and lookup arrangements for their stated purpose. ApiVect remains responsible for any engaged subprocessor's contractual processing obligations and must use appropriate written terms and applicable safeguards for restricted transfers.

Google reCAPTCHA and optional Analytics serve account/site protection and measurement described in the privacy policy, rather than invoice validation. Stripe will process billing data only when a paid checkout is enabled and chosen. Before adding or replacing a subprocessor, ApiVect will notify the account owner at least 30 days in advance, allow reasonable data-protection objections, and resolve them or allow affected processing to end. A public list alone is not the notice.

Retention, return and deletion

Invoice XML is processed in memory. Encrypted VIES lookup caches last up to 60 minutes for positive results and five minutes for negative results. Encrypted retry results expire after 24 hours, with cleanup every 30 seconds. An explicit Save report instruction creates a separate encrypted copy of a manual result for at most 30 days, including any returned company details. The workspace can remove that copy earlier. Saved reports never contain uploaded invoice XML. Saving again does not extend the deadline. Queued transactional email is erased after delivery or expiry; delivery metadata remains seven days. Security audit events remain 90 days. On verified account closure, ApiVect will return available customer data on request and delete or anonymize active account-linked data within 30 days, except a documented legal retention obligation. Encrypted backups expire under the seven daily, four weekly and six monthly snapshot schedule, within seven months. If restored, approved deletions must be reapplied before the recovered service resumes customer processing.

Information and audits

ApiVect will provide information needed to demonstrate compliance with this agreement and permit proportionate audits, including inspections by the controller or its mandated auditor, with reasonable arrangements that protect other customers and service security. Such arrangements do not remove statutory audit rights. ApiVect will notify the controller of a binding disclosure requirement unless prohibited by law. Requests and instructions should be sent to Contact and support. This agreement prevails over conflicting service terms on processing personal data.

Advanced VAT lists

Where enabled, VAT list checks use the same VAT API allowance. After explicit confirmation, normalized list inputs, customer references and VIES results are encrypted and retained for up to seven days. The preview is encrypted, bound to the account and expires after 15 minutes. Removing a list erases its active inputs and results; a short-lived idempotency record prevents accidental reruns. Existing financial request replay remains encrypted for up to 24 hours, and usage metadata follows its usual retention. An already-running check may finish after cancellation. Lists and results have no Analytics or request tracing. Backup expiry follows the schedule above.

Saved VAT inputs and monthly checks

Where enabled, a separate explicit Save input instruction retains encrypted VAT numbers, customer references and a list label for up to 365 days from the original save. Company-result details are not copied into the saved input. Repeated saving of the same source batch does not extend this deadline. The workspace can delete its saved input sooner. Monthly checks are off by default and require a separate explicit instruction to consume the included VAT allowance. Each resulting batch retains its own inputs and results for seven days and financial replay for up to 24 hours. Removing the saved input stops future starts; a job already starting or running may finish and has separate cancellation/removal controls. Technical schedule metadata expires with the saved list. Expired inputs are unavailable immediately, before bounded cleanup. The backup and account-closure rules above also apply to saved inputs.

VAT completion webhooks

Where enabled for VAT Platform, a workspace owner can explicitly authorize signed completion events to a DNS-verified HTTPS endpoint. Events contain batch identifiers, status and counts, without VAT numbers, customer references, company names or addresses. Endpoint URLs and signing keys are encrypted and retained until removal or account closure; unverified setup expires after 24 hours. Encrypted events and delivery metadata last at most seven days and can be removed sooner with the batch or endpoint. Removing an endpoint also removes its key and delivery history. A transmission already in progress can finish. Backup retention follows the policy above.

Opt-in Domain Watch

Where enabled, domain setup and recurring checks require explicit instructions and domain ownership proof. Domain names, labels, selectors and expected comparison baselines are encrypted and retained for at most 365 days from setup; unverified setup expires after 24 hours. Latest observations and incident history expire within the displayed plan limit, never more than 180 days. Removing the domain removes its active configuration, history, recipients and delivery records. Each verified workspace member chooses personally whether to receive alerts at their account email. Emails contain a private sign-in link and technical event reference, without domain names or DNS evidence. Delivery metadata is available for at most seven days; pending alerts expire after 24 hours. Opt-out, maintenance and access loss suppress queued alerts, but a transmission already in progress can finish. Ownership checks and public DNS/TLS observations use the existing resolver and hosting arrangements. Backup expiry and account-closure rules above also apply.

Invoice Tools outputs

Where enabled, you instruct ApiVect to map supported invoice data and create the requested structured output or passive PDF reading copy. Uploaded/pasted source JSON and XML are processed in memory and are not retained as source documents. After the website's explicit confirmation, or an authorized scoped API call, the generated output is stored with tenant-bound authenticated encryption for one hour from the original operation start. It can contain the original document's business and personal data. Only the workspace's current authorized members or matching scoped API keys can download it. You can remove the active output earlier; retries and downloads do not extend its deadline or recreate it.

The small encrypted validation/usage receipt follows the existing 24-hour retry retention, with request metadata kept for up to 90 days. Cleanup is bounded and runs every 30 seconds; output becomes unreadable at expiry even before physical cleanup. Invoice content is excluded from application logs, Analytics and request tracing. Encrypted backup copies follow the existing backup expiry schedule above and are not erased immediately by active-file deletion. The account-closure and restored-deletion rules above apply. Downloaded copies are under your control.

Opt-in Website Audit

Where enabled, authorized customers retain the exact website URL, label, ownership proof and technical settings with tenant-bound encryption for up to 365 days. Unverified setup expires after 24 hours. After explicit scan authorization, discovered URLs, page titles, descriptions, headings, indexing directives and findings are encrypted for the displayed plan limit of up to 30, 90 or 180 days, capped by the consent and parent site expiry. Raw HTML is processed in memory and never stored. Do not scan pages containing confidential query parameters or information you have no lawful basis to process.

Monthly schedules require separate usage/retention consent and last only while their site setup remains. Their technical records identify the authorizing account or key and the last start outcome. Removing a site erases its active configuration, schedules and retained scans; removing a scan erases its active payloads. Retention deadlines immediately block reads before bounded physical cleanup. Usage receipts and non-content financial metadata follow the existing replay and accounting retention. No website URLs or page contents are sent to Analytics or included in request tracing. Ownership DNS queries use the configured resolver; HTTPS probes contact only the verified public host, using bounded metadata requests and no logged-in browser. Encrypted backups and restored-deletion controls follow the retention policy above. Downloaded reports remain under your control.