Last updated 10 July 2026.
To operate the service we store: the invoice data you submit (both canonical JSON and the generated compliant document) and its delivery status; your account (email address, sign-in sessions, API keys — keys are stored hashed, never in plaintext); billing records (balance, ledger of charges, and, if you add a card, a reference to it held by Stripe — we never see or store the card number itself); and your business verification (KYB) record — the legal name, country, VAT ID, registration number you submitted, the attestation text, and the timestamp and IP address it was submitted from.
Sandbox invoices (created with the public sandbox key) are purged automatically after 24 hours, including anonymous ones. Production invoice records are retained for 6 years, the retention period required under UK HMRC record-keeping requirements for business records — this outlasts account closure. Account, session, and KYB records are retained for as long as your account is active, plus a reasonable period after closure for legal and dispute-resolution purposes.
We share data with the following processors, only as needed to run the service:
We do not sell your data, and we do not share invoice content with anyone except the recipient's Access Point, as needed to deliver the invoice you asked us to send.
If you are in the EU/EEA (or otherwise covered by the GDPR), you have the right to access, correct, or delete your personal data, to object to or restrict certain processing, and to data portability, subject to our legal obligation to retain invoicing records for the period described above — that obligation can override an erasure request for invoice records specifically, but not for account data unrelated to a delivered invoice. You also have the right to lodge a complaint with your local data protection authority.
The legal entity responsible for this processing (data controller) is identified in our Imprint.
Privacy requests and questions: privacy@vantane.com.