1. Data controller

BlueZero, SLU, Paseo Central 17, 04740 Roquetas de Mar, Spain.

2. What we collect

Email address and password hash (account); company name (optional); the content of invoices you submit for validation/conversion (encrypted at rest); API keys (stored hashed, never in plaintext); usage events (which endpoint, when) to measure product demand; IP address and timestamp on contact-form submission and login (abuse protection).

3. Why, and legal basis

Account and invoice data is processed under contract necessity (providing the service you requested). Usage events are processed under legitimate interest (measuring product demand).

4. Third parties

We do not use any third-party analytics or advertising scripts. If a support button (Ko-fi or similar) is shown, it is a separate website you visit directly — this app neither receives from nor sends it any of your data.

5. Cookies

We use exactly one strictly-necessary cookie — the login session. It is exempt from consent requirements because it is required for login to function at all.

6. Contact form

The contact form includes a hidden anti-spam field (honeypot) and is rate-limited per IP address. Your message is emailed to the operator; we do not store it permanently in the database.

7. Data retention

Invoice data (including generated XML and the validation report) is retained for 30 days from creation, then permanently deleted. This is NOT legal long-term invoice archival — archival compliance under Slovak law remains your responsibility.

8. Your rights

You have the right to access, rectify, erase, and port your data. You can delete your own account and all associated data at any time from account settings, or ask us via the contact form. If you believe processing of your data violates GDPR, you have the right to lodge a complaint with the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov SR).

9. Age

This service is intended for users aged 18 or older.