Data Processing Agreement

Last updated:

1. Parties & scope

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Barış Çelik ("Inkvoice", "we") and the customer ("Controller") and governs the processing of personal data on Inkvoice Cloud at cloud.inkvoice.app. Where the Controller acts on behalf of its own customers as a controller, Inkvoice acts as Processor under GDPR Article 28.

2. Subject matter and duration

We process customer, invoice, payment, and account data on the Controller's instructions for the term of the Service Agreement plus the deletion period described in section 9 (about 37 days after the Controller deletes its workspace).

3. Nature and purpose of processing

  • Hosting and serving the SaaS application.
  • Persisting invoices, customers, products, and related data the Controller enters.
  • Generating PDFs, exports, and emails the Controller triggers.
  • Processing subscription payments (the Controller's own subscription only).
  • Operational monitoring, error reporting, and security review.

4. Categories of personal data and data subjects

Personal data of: the Controller's authenticated users, the Controller's end customers (those billed by the Controller), and authorised support contacts. Categories: contact details (name, email, phone, address), invoice and payment line items, IP address, and audit trail entries.

5. Sub-processors

We use the sub-processors listed at /subprocessors. We will provide advance notice of new sub-processors and give the Controller a right to object. Each sub-processor is bound by data protection terms no less protective than this DPA.

6. Security measures (Art. 32)

  • A separate SQLite database per workspace; requests to a workspace are bound to the workspace resolved from its subdomain.
  • The Service is served only over HTTPS (TLS), with HSTS enabled.
  • AES-256-GCM encryption, with a per-workspace key, for stored SMTP passwords and Stripe keys.
  • Bcrypt password hashing.
  • Role-based access control (Owner / Admin / Accountant / Viewer).
  • Audit log of create, update, and delete actions on invoices, customers, products, and users, with no in-app way to edit or delete entries.
  • Support sign-in to a workspace requires a stated reason, is limited to 15-minute sessions, and is recorded in that workspace's audit log.
  • Production secrets are kept in server configuration, not in source code.

7. Data subject requests

Where the Controller cannot fulfil a data subject request itself via our self-service data export (Settings → Danger zone) or account deletion, we will assist within reasonable time and cost.

8. Breach notification

We will notify the Controller of any confirmed personal data breach affecting their data without undue delay and in any event within 72 hours of confirmation, providing the information required under GDPR Article 33(3).

9. Deletion and return

While the workspace is active, the Controller can export its data at any time via the self-service export (Settings → Danger zone). When the Controller deletes the workspace, it becomes read-only, its shared links and client portal are taken offline immediately, and it is scheduled for deletion 30 days later. The Owner receives a confirmation by email and a final notice about 7 days before that date. Until the deletion date the Controller can sign in to export its data or restore the workspace, and we will do either on request. After 30 days the workspace database is moved to a quarantine directory and permanently erased 7 days later, about 37 days after the deletion request.

10. International transfers

Inkvoice Cloud servers are hosted in the EU (Alwyzon, Vienna, Austria). Sub-processors outside the EU/EEA are covered by Standard Contractual Clauses or an adequacy decision, such as the EU-US Data Privacy Framework, as listed for each on the subprocessors page.

11. Contact

Data protection enquiries: support@inkvoice.app