Document Render jobs

Where enabled, supported HTML or JSON report input is encrypted for a private PDF-rendering job and is retained only until that job completes, fails, is cancelled or reaches its 90-second deadline. A current documents:render key from the same workspace is required to read a job or download its output. The resulting PDF is encrypted with tenant- and job-bound context, available for one hour from creation and can be removed earlier. It becomes inaccessible at expiry before bounded physical cleanup; cleanup runs every 30 seconds and does not promise physical erasure at exactly 90 seconds or one hour.

The encrypted idempotency receipt remains for 24 hours and financial/request metadata follows the stated accounting retention. Input, output and PDF content are excluded from application logs, Analytics and request tracing. Encrypted backups follow the standard backup expiry schedule and active-file deletion does not instantly erase a retained backup copy. The account-closure and restored-deletion rules above apply. Downloaded PDFs remain under your control.

Contact requests

When you use the contact form, we process your name, email address, selected topic and message to handle your request. The encrypted delivery queue keeps undelivered content for at most 24 hours and erases it after delivery or expiry. Delivery metadata lasts up to seven days. The delivered correspondence is held in our support mailbox for handling and documenting the request; you may use the contact form to ask about removal. Backup retention follows the policy above. Your email address is not verified by submitting the form, so account and data requests still require ownership verification. Do not include passwords, keys, invoices or confidential customer data. The contact page excludes Analytics and request tracing. Google reCAPTCHA runs on submission for abuse detection as described in our cookie policy.

UPDATED 23 SEPTEMBER 2026

Privacy policy.

ApiVect is operated by KPdesign, CVR 41134194, Bavnehøjen 5, 4690 Haslev, Denmark. Contact Contact and support about your information. This policy describes account, security and website processing. Customer-submitted validation data is covered by the data processing agreement.

Account information

We use email, business/project name, password hashes, verification records and your accepted terms version to create and operate your account and fulfill the service agreement. Free registration does not subscribe you to marketing. Email confirmation links expire after one hour; unused registration records are removed within two days. Recovery links expire after 30 minutes. Authenticator seeds are encrypted; recovery codes are stored as hashes and can be used once.

Saved check reports

Manual check results normally expire after 24 hours. If you choose Save report, an encrypted copy, including any company details returned by VIES, remains available to your workspace for up to 30 days. You can remove the saved copy in Reports. This does not erase your downloaded files or the original 24-hour replay result. Up to 100 saved reports are allowed per workspace. Invoice XML is never included. Expired or removed copies disappear from active storage; encrypted backup retention is described in the data processing agreement.

Business billing

For subscriptions, we collect the legal business name, invoice address, VAT number and the account owner's business declaration. We check VAT registration with EU VIES and share billing details with Stripe for subscriptions, tax calculation and invoices. Business details and verification evidence are encrypted in our database. Accounting records and supporting billing evidence are retained for the legally required accounting period, separately from the 90-day operational audit. Contact us to correct billing information. Issued invoices remain part of the accounting record.

Invoice and usage processing

Invoice XML is processed in memory and is not archived or included in application logs. Sanitized results are encrypted for 24-hour idempotent retries. Cleanup runs every 30 seconds. Account-linked usage records track quotas, successful operations and billing states. API keys are displayed only when created and verified through keyed hashes. Technical validation is not a legal or tax determination.

External lookups

VAT country and number are sent to EU VIES. When VIES supplies a business name and address with a valid result, they are returned to the requesting customer. Cached lookup results are encrypted, including these fields; names and addresses are not written to logs. Positive results may be cached for 60 minutes and negative results for five minutes. Domain names and supplied selectors are queried through Cloudflare's public DNS-over-HTTPS resolver. Certificate and MTA-STS checks connect to the requested domain's public HTTPS service. These requests are needed to perform the checks you choose.

Security and retention

We process security and operational metadata for our legitimate interests in protecting accounts, preventing abuse and keeping the service reliable. Audit events expire after 90 days. Application logs are size-rotated. Web access logs record client IP, method, path, status and time, excluding query strings and bodies. Metrics exclude customer identifiers. Stored traces last 24 hours, with URLs, client addresses and user agents removed. Authentication admission counters use keyed hashes and expire within two hours.

Email, backups and providers

Transactional email content is encrypted in the queue and erased on delivery or expiry; delivery metadata lasts seven days. Contabo provides host infrastructure. Daily backups are encrypted, retained as seven daily, four weekly and six monthly snapshots, and copied to the operator's Google Drive storage. Backup retention can delay complete erasure by up to seven months. See the provider list and processing terms.

Google services and cookies

Essential session and antiforgery cookies protect account access. Google reCAPTCHA validates protected forms to prevent abuse. Optional Google Analytics loads only after consent on public information pages; it is excluded from account forms and dashboards. It measures public page visits, create-account link clicks and plan-selection clicks (product category only), without account identifiers or completed purchase tracking; referring addresses are reduced to their origin. Analytics event and user-data retention is set to two months without resetting on new activity. Aggregated reports may have different retention. Google services may process data outside the EEA according to their applicable terms and transfer safeguards. You can refuse or withdraw Analytics through cookie preferences. Refusal does not prevent API access.

Your choices and rights

You can request access, correction, export, deletion or restriction of your personal information, object to processing based on legitimate interests, and withdraw consent where it is the basis. Email us from your verified address; we verify identity and respond within the applicable statutory period, normally one month. Account closure requests trigger deletion or anonymization of active data within 30 days, subject to legal retention obligations. You may complain to the Danish Data Protection Agency, Datatilsynet. We do not sell personal data or make automated decisions with legal or similarly significant effects about you.

Manual website checks

Manual checks use the same validation engines. Uploaded and pasted XML is processed in memory and is not retained. Results are encrypted for replay for up to 24 hours; request identifiers, workspace/user references, keyed input fingerprints, tool and allowance usage are retained for up to 90 days. VAT and domain values can occur in the encrypted result. Manual pages do not use Analytics or request tracing. Hashed attempt limits, account verification and MFA help prevent abuse.

Advanced VAT lists

Where enabled, VAT list checks use the same VAT API allowance. After explicit confirmation, normalized list inputs, customer references and VIES results are encrypted and retained for up to seven days. The preview is encrypted, bound to the account and expires after 15 minutes. Removing a list erases its active inputs and results; a short-lived idempotency record prevents accidental reruns. Existing financial request replay remains encrypted for up to 24 hours, and usage metadata follows its usual retention. An already-running check may finish after cancellation. Lists and results have no Analytics or request tracing. Backup expiry follows the schedule above.

Saved VAT inputs and monthly checks

Where enabled, a separate explicit Save input instruction retains encrypted VAT numbers, customer references and a list label for up to 365 days from the original save. Company-result details are not copied into the saved input. Repeated saving of the same source batch does not extend this deadline. The workspace can delete its saved input sooner. Monthly checks are off by default and require a separate explicit instruction to consume the included VAT allowance. Each resulting batch retains its own inputs and results for seven days and financial replay for up to 24 hours. Removing the saved input stops future starts; a job already starting or running may finish and has separate cancellation/removal controls. Technical schedule metadata expires with the saved list. Expired inputs are unavailable immediately, before bounded cleanup. The backup and account-closure rules above also apply to saved inputs.

VAT completion webhooks

Where enabled for VAT Platform, a workspace owner can explicitly authorize signed completion events to a DNS-verified HTTPS endpoint. Events contain batch identifiers, status and counts, without VAT numbers, customer references, company names or addresses. Endpoint URLs and signing keys are encrypted and retained until removal or account closure; unverified setup expires after 24 hours. Encrypted events and delivery metadata last at most seven days and can be removed sooner with the batch or endpoint. Removing an endpoint also removes its key and delivery history. A transmission already in progress can finish. Backup retention follows the policy above.

Opt-in Domain Watch

Where enabled, domain setup and recurring checks require explicit instructions and domain ownership proof. Domain names, labels, selectors and expected comparison baselines are encrypted and retained for at most 365 days from setup; unverified setup expires after 24 hours. Latest observations and incident history expire within the displayed plan limit, never more than 180 days. Removing the domain removes its active configuration, history, recipients and delivery records. Each verified workspace member chooses personally whether to receive alerts at their account email. Emails contain a private sign-in link and technical event reference, without domain names or DNS evidence. Delivery metadata is available for at most seven days; pending alerts expire after 24 hours. Opt-out, maintenance and access loss suppress queued alerts, but a transmission already in progress can finish. Ownership checks and public DNS/TLS observations use the existing resolver and hosting arrangements. Backup expiry and account-closure rules above also apply.

Invoice Tools outputs

Where enabled, you instruct ApiVect to map supported invoice data and create the requested structured output or passive PDF reading copy. Uploaded/pasted source JSON and XML are processed in memory and are not retained as source documents. After the website's explicit confirmation, or an authorized scoped API call, the generated output is stored with tenant-bound authenticated encryption for one hour from the original operation start. It can contain the original document's business and personal data. Only the workspace's current authorized members or matching scoped API keys can download it. You can remove the active output earlier; retries and downloads do not extend its deadline or recreate it.

The small encrypted validation/usage receipt follows the existing 24-hour retry retention, with request metadata kept for up to 90 days. Cleanup is bounded and runs every 30 seconds; output becomes unreadable at expiry even before physical cleanup. Invoice content is excluded from application logs, Analytics and request tracing. Encrypted backup copies follow the existing backup expiry schedule above and are not erased immediately by active-file deletion. The account-closure and restored-deletion rules above apply. Downloaded copies are under your control.

Opt-in Website Audit

Where enabled, authorized customers retain the exact website URL, label, ownership proof and technical settings with tenant-bound encryption for up to 365 days. Unverified setup expires after 24 hours. After explicit scan authorization, discovered URLs, page titles, descriptions, headings, indexing directives and findings are encrypted for the displayed plan limit of up to 30, 90 or 180 days, capped by the consent and parent site expiry. Raw HTML is processed in memory and never stored. Do not scan pages containing confidential query parameters or information you have no lawful basis to process.

Monthly schedules require separate usage/retention consent and last only while their site setup remains. Their technical records identify the authorizing account or key and the last start outcome. Removing a site erases its active configuration, schedules and retained scans; removing a scan erases its active payloads. Retention deadlines immediately block reads before bounded physical cleanup. Usage receipts and non-content financial metadata follow the existing replay and accounting retention. No website URLs or page contents are sent to Analytics or included in request tracing. Ownership DNS queries use the configured resolver; HTTPS probes contact only the verified public host, using bounded metadata requests and no logged-in browser. Encrypted backups and restored-deletion controls follow the retention policy above. Downloaded reports remain under your control.