Last updated April 18, 2026
The data controller for the personal information processed through Order Invoicer (the "Services") is:
This Privacy Notice describes how and why we access, collect, store, use, and/or share ("process") your personal information when you use the Services, including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@orderinvoicer.com.
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we process personal information depending on how you interact with us — account data, billing data, contact-form submissions, and technical logs. Learn more in section 1.
Do we process any sensitive personal information? No. We do not intentionally process sensitive personal data as defined by GDPR article 9.
Do we collect any information from third parties? No.
How do we process your information? To provide and administer the Services, communicate with you, process payments, meet our legal obligations, and ensure the security of the Services. See section 2.
Who processes your data on our behalf? We rely on a limited number of sub-processors (hosting, database, payments). See section 4.
Are your data transferred outside the EU? Some of our sub-processors are based in the United States. Transfers are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs). See section 4.
Do we use cookies? We use a limited number of cookies and trackers. Non-essential trackers (audience measurement) are only activated with your consent. See section 5.
How long do we keep your information? We apply specific retention periods depending on the purpose. See section 6.
What are your rights? Access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with a supervisory authority (CNIL in France). See section 9.
How do you exercise your rights? Email privacy@orderinvoicer.com or dpo@orderinvoicer.com.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide when you create an account, subscribe to a plan, interact with our Services, or contact us.
Account and billing data:
Contact form data (/contact):
Technical data collected automatically:
Sensitive Information. We do not process "special categories" of data (GDPR art. 9).
Payment Data. All payment data is handled and stored by Stripe. You can find their privacy notice at https://stripe.com/privacy.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for the following purposes:
Under the GDPR, we rely on the following legal bases:
You can withdraw your consent at any time by contacting privacy@orderinvoicer.com.
We do not sell your personal information. We share it only with the sub-processors listed below, strictly within the limits of the Services.
| Sub-processor | Purpose | Location | Transfer safeguards | |---|---|---|---| | Vercel Inc. | Hosting, CDN, Web Analytics (contact-form submission tracking for commercial follow-up), bot detection (BotId) | United States | EU–US Data Privacy Framework + SCCs | | Supabase Inc. | Database (PostgreSQL), authentication | European Union (EU region) | N/A (intra-EU) | | Stripe Payments Europe | Payment processing | Ireland / United States | EU–US Data Privacy Framework + SCCs | | Resend, Inc. | Transactional email delivery (account notifications, and forwarding contact-form messages to our team) | United States | EU–US Data Privacy Framework + SCCs | | Slack Technologies (Salesforce, Inc.) | Internal sales-team notification on incoming contact-form messages | United States | EU–US Data Privacy Framework + SCCs | | Inngest, Inc. | Orchestration of background jobs (syncs, retries) | United States | EU–US Data Privacy Framework + SCCs |
Contact-form data (categories listed in section 1) is forwarded to Resend, Slack and Vercel Analytics for the purposes above.
Each sub-processor is bound by a Data Processing Agreement in compliance with GDPR article 28.
The website integrates the BotId library (published by Vercel Inc.) on form-submission pages. This library fingerprints the browser in order to detect and block automated submissions by bots.
Transfers to non-EU/EEA sub-processors are framed by:
We may share your information in case of:
In Short: We use a limited number of cookies and trackers. Non-essential trackers (audience measurement) are only activated after your consent.
In accordance with article 82 of the French Data Protection Act and the CNIL guidelines (deliberation n°2020-091), we inform you of the trackers placed on your device.
| Name | Publisher | Purpose | Category | Duration | Consent |
|---|---|---|---|---|---|
| orderinvoicer.cookie-consent.v1 | Bewizit (first-party localStorage) | Stores your consent choice so that the banner is not shown again | Strictly necessary | 13 months | Exempt (French Data Protection Act art. 82) |
| _vercel_insights* | Vercel Inc. | Aggregate audience measurement (Web Analytics) — page views, platforms, form submissions | Audience measurement | Session | Required — enabled only after "Accept all" or "Customize" → Audience measurement |
| BotId fingerprint | Vercel Inc. | Detection and blocking of automated submissions on the contact form | Security (anti-spam) | Session | Exempt — tracker strictly necessary to a service expressly requested by the user (form submission), see section 4 |
The consent banner displayed on your first visit lets you:
Refusing is as easy as accepting. You can update your choices at any time by removing the orderinvoicer.cookie-consent.v1 key from your browser's local storage: the banner will re-appear on your next visit.
You can also configure your browser to block all cookies or to notify you whenever a cookie is set. Blocking certain essential trackers may however affect the proper functioning of the site.
We keep personal data only as long as necessary for the purposes for which it was collected, and then archive or delete it.
| Data category | Retention period | |---|---| | Account data (identification, authentication) | Duration of the contractual relationship + 3 years after the last interaction | | Billing and accounting data (invoices, payment history) | 10 years from the issuance date (French Commercial Code art. L123-22) | | Contact-form submissions (prospects) | 3 years after the last contact | | Commercial prospecting | 3 years after the last interaction (CNIL recommendation) | | Connection logs / server logs | 1 year (LCEN art. 6-II) | | Cookies and similar technologies | Max. 13 months (CNIL) | | Data subject requests | 3 years after closure |
Once the retention period has expired, data is either deleted or anonymised for statistical purposes.
We have implemented appropriate technical and organisational security measures designed to protect the security of any personal information we process, including TLS encryption in transit, encryption at rest on our sub-processors' infrastructure, strict access controls, and regular backups. However, no method of transmission over the Internet or method of electronic storage is 100% secure.
We do not knowingly collect data from or market to children under 18 years of age. If you become aware of any data we may have collected from children under 18, please contact us at dpo@orderinvoicer.com.
Under the GDPR and the French Data Protection Act, you have the right to:
To exercise these rights, email privacy@orderinvoicer.com or our DPO at dpo@orderinvoicer.com. We will respond within one month.
If you believe that our processing of your personal data does not comply with the GDPR, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr.
Most web browsers include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognising and implementing DNT signals has been finalised, so we do not currently respond to DNT browser signals. However, our cookie-consent banner lets you refuse non-essential tracking.
Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice.
You may request access to, correction of, or deletion of your personal data by emailing privacy@orderinvoicer.com. You may also manage most account data directly from your account settings.