Privacy notice

How Invocello handles data

Last updated 5 August 2026.

Beta notice: this operational notice describes implemented behavior during the free beta and may change as the service is tested.

Provider and contact

When a customer submits invoice content for purposes the customer determines, the respective controller and processor roles depend on the facts and contract and may require a suitable data-processing agreement. Contact: support@invocello.com.

What we process

The account-free converter processes one digital PDF transiently in application memory using local PDF text-reading software. It sends neither the PDF nor extracted rows to OpenAI, and retains neither. For abuse prevention and daily capacity, it retains for seven days an HMAC-protected hash derived from the request IP address, timestamp, one-page count, completion status, optional non-identifying campaign code, and local-processing aggregate; it does not store the raw IP address in the trial ledger.

The verified workspace processes account email and authentication data, API-key hashes, usage records, and the extracted vendor baseline needed to provide structured extraction and supplier-change warnings. Workspace uploads are processed transiently in application memory and sent to OpenAI for extraction; this application does not retain the original file. An unverified free-beta signup creates an expiring email login-code record, not an account.

Anonymous visit measurement

On public pages, Invocello counts visits and signup intent using a random identifier held only in the tab's sessionStorage. The service stores only a one-way hash of that identifier, the page path, referring website hostname, timestamps, aggregate counts, and an optional short campaign code from a beta link. Campaign codes contain no recipient identity and are retained for up to 90 days. The analytics tables do not store an IP address, full referring URL, email, or user-agent string, and Invocello sets no analytics cookie. Do Not Track is respected. You can exclude this browser by opening /?analytics=off; use /?analytics=on to participate again.

Sign-in cookie

Invocello asks before creating the essential invoice_api_session cookie that keeps this browser signed in for up to seven days. The cookie is HTTP-only, secure in production, and contains an opaque session token; the corresponding token is stored only as a hash by the service. Public pages remain available without it. We do not use advertising or analytics cookies. This browser stores the cookie choice locally so it can respect that choice on later pages. Continuing without the cookie signs this browser out.

Why and for how long

We process data to provide and secure the service, understand whether the free beta is useful, prevent abuse, and meet legal obligations. Account-free trial records are retained for up to seven days; anonymous visit aggregates are retained for up to 90 days. Login-code hashes and the associated email expire after ten minutes, and session-token hashes expire after seven days. Operational account, vendor, and usage data remain while an account is active. After an eligible closure request, local access stops immediately and local data is erased within 30 days. Provider logs may follow the provider's own retention arrangements.

Processors and transfers

Our current providers are Hetzner for application and mail-server hosting, Cloudflare for authoritative DNS, OpenAI for verified-workspace document extraction, and SMTP2GO for outbound service-email delivery. The account-free converter does not use OpenAI. Inbound mail is handled by self-hosted Mailcow software on the Hetzner server. The beta does not currently use application or mailbox backups. Stripe is not used to collect payment during the free beta. The current provider list is published at Subprocessors.

Your rights

You may request access, correction, erasure, restriction, portability, or object to processing by contacting support@invocello.com. You may also file a complaint with the Swedish Authority for Privacy Protection (IMY). For account closure, use the signed-in account portal.

Terms · Acceptable use · Home