Privacy
This page explains which personal data billklar processes, why, and for how long.
Who is responsible
Mustafa Zaydan
Signature Living, N315, Street 11
Jumeirah Village Circle (JVC), Dubai
United Arab Emirates
Email: hello@billklar.com
Invoices you check, create or display
Invoices often contain names, addresses and bank details. Files you upload to the validator or send to the API are processed in memory to produce the report, the invoice or the readable view, and are not stored or used for anything else. Legal basis: Art. 6(1)(b) GDPR (you ask us to process the file).
Limit for free use
To limit free use to 25 documents a day, we count requests per visitor. We do not store your IP address for this: we store a keyed hash of your IP address and the date, and delete it after two days. Legal basis: Art. 6(1)(f) GDPR (fair use and protection against abuse).
Early-access list
If you request early access, we store your email address and what you choose to tell us about your company, your use and your volume, so that we can send you an API key and ask about your needs. We delete it when you ask us to, or 12 months after the last contact. Legal basis: Art. 6(1)(b) GDPR (steps before a contract, at your request).
API customers
For each API key we store the customer name, a contact email, the plan, a hash of the key and the number of documents per month. Legal basis: Art. 6(1)(b) GDPR (the contract).
Emails to hello@billklar.com are forwarded by Cloudflare (Cloudflare, Inc.) to a Gmail mailbox at Google. We use your message and your email address to answer you. Cloudflare and Google may process emails outside the EU. Legal basis: Art. 6(1)(f) GDPR (answering your message), or Art. 6(1)(b) GDPR when your message is about a contract.
Hosting and backups
Hetzner Online GmbH runs the server in Nuremberg, Germany. We have a data processing agreement with Hetzner (Art. 28 GDPR). The database with API keys, usage counts and the early-access list is backed up every day on the same server, and each backup is deleted after 14 days. Backups do not contain the hashed IP addresses used for the free limit.
Server logs
The web server (Caddy) keeps no access log. Its own log covers its operation, such as certificate renewals and errors; visitors' IP addresses and request headers are removed from it. The application logs each request with the time, the requested address and the status code, but not your IP address. These two logs are kept until they reach 30 MB each; then the oldest entries are deleted.
The server's system logs record the IP addresses of SSH connections and of connection attempts that the firewall blocks. They are deleted after 7 days.
Legal basis: Art. 6(1)(f) GDPR (running the service reliably and securely, finding faults and attacks).
No tracking
The site sets no cookies, uses no analytics and loads nothing from other websites; fonts are served from this server.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing and a copy in a common format, and you can object to processing based on legitimate interest. Write to hello@billklar.com. You can also complain to a data protection authority.