Avis de confidentialité

This notice covers processing in which apiRiver acts as controller: account data, messages sent through the contact form, technical logs and the measurement of how the website is used and which Google ads bring visitors to it. Processing of the content of your documents, where apiRiver acts as a processor on the customer's instructions, is not governed by this notice — it is governed by the data processing agreement (see the DPA outline) and is described in section 7 only for completeness.

1. Who processes the data

Controller: ФОП Александр Рич, a sole proprietor in Ukraine (same as in the Terms of Service, section 1). Country of registration: Ukraine. The registered address and the registration number are stated in the Imprint. Contact for data-protection matters and data-subject requests: [email protected].

• Data protection officer (DPO): [LAWYER REQUIRED: whether one is appointed; the Article 37 GDPR criteria for this processing are not assessed here].
• Representative in the EU under Article 27 GDPR: [LAWYER REQUIRED: the question arises because the controller is established outside the EU and offers services to data subjects in the EU; whether the Article applies, or one of its exceptions, is a legal question].

2. Two roles

Data	apiRiver's role	Governed by
Email, sign-in metadata, API key, contact form messages, technical logs, website usage and advertising measurement	Controller	this notice
Content of invoices submitted for generation or validation	Processor, on the customer's instructions	data processing agreement with the customer

[LAWYER REQUIRED: the processor role for document content is decided; the controller role for registration data is a proposal awaiting confirmation]

3. What data is processed

Data	Form
Email address	stored in plain form, normalised, unique per account; also held when a sign-in link is requested, before an account exists
Sign-in link token	only a keyed hash (HMAC-SHA-256 with a server-side secret) is stored; the raw value is not
Sign-in session	a session identifier tied to the account; the session cookie is HttpOnly, Secure, SameSite=Lax
API key	a public prefix in plain form plus a keyed hash of the secret; the raw secret is not stored and is shown once, when the key is issued
Remaining free quota	a number, at account level
Sign-in form rate-limit counters	kept only in the memory of the running process, keyed by email address; they do not survive a restart
Messages sent through the contact form on the home page	your email address (used as the reply address), the name you give (optional) and the text; delivered as an email to the operator's mailbox at Zoho Mail; not stored in the application's database
Contact form rate-limit counters	kept only in process memory, keyed by email address and a hash of the message; lost on restart
Website usage measurement before a cookie choice (Google Analytics) — home page and legal documents only	When you open the home page or one of the legal documents and have not chosen yet, your browser loads Google's script, which sends Google measurement requests without cookies. They contain: the fact that no consent has been given; the page, as a fixed address chosen by us for each page, together with the advertising click identifiers (gclid, gbraid, wbraid) and campaign tags (utm_source, utm_medium, utm_campaign, utm_term, utm_content, utm_id) if the address you opened carries them; the address of the site you came from, reduced to its domain; browser and device type and screen resolution; the events we record (page views, a sent contact form without its content) and the standard events Google Analytics records by itself (first visit, start of a visit, time spent on the page); and the IP address of the request, from which Google may derive an approximate location. No cookie of this site is set or read by Google's script before you choose. apiRiver's own script only reads your stored choice, the list of this site's cookies (to delete leftover Google cookies of this site) and the address you opened and the address of the site you came from (to reduce them as described above before it passes them to Google's script). After “Decline”, Google's script is not loaded on the following pages while this browser keeps your choice (section 8).
Website usage measurement after “Analytics only” or “Accept all” (Google Analytics)	The same data, and in addition a random browser identifier kept in the analytics cookies listed in section 11 and the event of the creation of an account (without the email address or any account identifier); the sign-in pages are measured only after this choice. Other parts of the address you opened — other query parameters, fragments and sign-in links — are not included in the page address we send. With “Analytics only”, and before a choice, the click identifiers and campaign tags are still part of the page address sent to Google; Google states that without advertising consent it uses ad-click information only to approximate traffic measurement. Your email address, the text of the contact form and your account code are never sent to Google. apiRiver's server sends Google nothing. Inside the account area only one thing is recorded: on the first page shown after your account is created, Google's script is loaded to record that event, and the page is then reloaded without it (unless you have already used a form on that page, which leaves the page by itself).
Advertising measurement after “Accept all” (Google Ads, through Google Analytics)	Google's script may store and read advertising cookies (section 11) that link your visit to the Google ad you clicked, and the measurement data above is used in apiRiver's Google Ads account to measure its ads. Personalised advertising and remarketing are not switched on.
Your cookie choice	stored only in your browser's local storage (key apiriver_consent): whether you chose “Accept all”, “Analytics only” or “Decline”, and when; it is not sent to apiRiver's server
IP address	in the reverse-proxy access log and in the application log
Request URL, time, response code, request identifier	in the access log and the application log

About the IP address specifically: the rate limiter does not read the client address at all until a trusted perimeter is configured — its windows are keyed by email address, and its counters are ephemeral in-process memory, not permanent storage. The IP processing that exists from day one is logging: the client address appears in the logs, and it is for the logs that a legal basis and a retention period are needed. Separately, Google derives an approximate location from the IP address of your browser's requests to Google, also before a cookie choice on the home page and the legal documents (see the measurement rows above). [LAWYER REQUIRED: treating an IP address as personal data is an agent's proposal awaiting confirmation]

Not processed: passwords (sign-in is by one-time link only).

Payment data: account code; euro balance; history of balance movements (type, amount, balance after, date, a reference — for top-ups, the PayPal transaction identifier or, if the notification carries none, its message identifier); subscription dates and allowance; subscription purchases (months, price, dates); a record of each email processed from the payment mailbox, including emails from other senders, which are rejected (message identifier, outcome, short reason; for a rejected sender, its domain); unmatched payments (amount, currency, reference, message identifier). Unmatched payments are also reported to the operator by email (amount, message identifier, reference, reason). The text of a PayPal notification email, which may include the payer's name and PayPal email address, is not stored in the database and is not included in that report. Original PayPal notification emails remain in the operator's mailbox. [AUTHOR/LAWYER REQUIRED: retention period of the mailbox holding PayPal notification emails, and whether they count as accounting records under tax law]

A usage log of API calls is not kept at this time; when one is introduced, this notice will be extended with a line about it and its retention period.

4. Purposes and legal bases

[LAWYER REQUIRED: every basis below is a proposal; none should be read as established]

Purpose	Data	Proposed legal basis
Create an account and let you in (sending the sign-in link email)	email	performance of a contract / taking steps at your request before a contract, Art. 6(1)(b) [LAWYER TO CONFIRM: this is the key qualification of the whole notice. The sign-in form has no consent checkbox because the transactional email is treated as fulfilling the user's request, not as consent. If the qualification is wrong for the author's jurisdiction, an opt-in appears in the form — a change to the product, not only to this text]
Provide the API (key authentication, quota accounting)	email, key, quota	performance of a contract, Art. 6(1)(b) [LAWYER TO CONFIRM]
Prevent the sign-in form from being used as a mail relay (anti-abuse)	email (in memory); the address when a perimeter is configured; the result of the Cloudflare Turnstile check on the sign-in form (a one-time token, no email address — see section 5)	legitimate interest, Art. 6(1)(f) [LAWYER REQUIRED: a documented balancing test for each of the legitimate-interest purposes in this table — this one, security and diagnostics, and the contact form rows]
Security and diagnostics (perimeter and application logs)	IP, URL, time, request identifier	legitimate interest, Art. 6(1)(f) (see the note in the row above)
Answer a question you send through the contact form	email, name (optional), message	[LAWYER REQUIRED: legal basis — taking steps at your request (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)); not established]
Prevent the contact form from being used for mass sending (anti-abuse)	email address and a hash of the message (in memory only)	[LAWYER REQUIRED: legal basis — legitimate interest (Art. 6(1)(f)); not established]
Measure how the website is used and which Google ads bring visitors (Google Analytics, Google Ads)	the data in the measurement rows of section 3	consent, Art. 6(1)(a), for the cookies and for the measurement after your choice; measurement requests without cookies are sent before a choice on the home page and the legal documents only [LAWYER TO CONFIRM: consent as the basis; the legal basis, if any, for the measurement requests without cookies that are sent before a choice, including the advertising click identifiers and campaign tags in the page address; Google's EU user consent policy for measurement in the EEA; and the national rules implementing Art. 5(3) of the ePrivacy Directive for the cookies, the local-storage record and loading Google's script before a choice]
Anonymised aggregated statistics about use	derived from operational metrics	further processing for statistical purposes, Art. 5(1)(b) with the safeguards of Art. 89(1); genuinely anonymous aggregates fall outside the GDPR. The right to such statistics is declared by contract (Terms of Service, section 9).
Balance, subscription and payment processing	[AUTHOR DECISION REQUIRED: not in the draft — added with the payment feature]

5. Who receives the data

Recipient	What it receives	Why
Email provider — Zoho Mail	the recipient's email address and the content of the sign-in email; the messages you send to [email protected] or through the contact form on the home page	sending the sign-in email and receiving your messages [AUTHOR DECISION REQUIRED: the exact legal entity of the provider and its country; the same outgoing mail also carries unmatched-payment alerts to the operator — whether that belongs in this row must be decided with the payment data above]
Bot protection on the sign-in form — Cloudflare Turnstile	when the sign-in page is opened, your browser loads the check directly from Cloudflare, which processes the IP address, the TLS fingerprint, the User-Agent header, the site key and the origin of the page (as described in Cloudflare's Turnstile privacy addendum); of your data, apiRiver's server sends Cloudflare only the one-time token of the check, and the email address is not sent	protecting the sign-in form from automated mass sending of sign-in emails [LAWYER REQUIRED: Cloudflare's role for Turnstile (processor or independent controller), the legal basis, the transfer to the USA, and the fact that the Turnstile script runs inside the sign-in page with the page's own privileges and can technically read what is typed into the form]
Website and advertising measurement — Google Analytics and Google Ads	your browser loads Google's script from www.googletagmanager.com — on the home page and the legal documents when you open them, on the sign-in pages only after “Analytics only” or “Accept all” — and sends the data listed in section 3 directly to Google; after “Accept all”, the Google Analytics data is also used in apiRiver's Google Ads account, which is linked to it, to measure apiRiver's ads; personalised advertising is not switched on; apiRiver's server sends Google nothing	measuring how the website is used and which ads bring visitors [LAWYER REQUIRED: the Google entity and its role (processor or independent controller) — the Google Analytics terms and data processing terms were accepted with Google Ireland Limited as the contracting party; the transfer to the USA and its basis; and the fact that the Google script runs inside every page where it is loaded with the page's own privileges — it can technically read what the page shows and make requests to this site on your behalf: on the sign-in pages what is typed into the form and the address shown on the "check your email" page, on the home page, the legal documents and the sign-in pages opened by a signed-in visitor the account area behind them, and on the first page of a new account what that page shows; the role of Google for Google Ads measurement; and the fact that Google's script itself can read the full address of the page, including parts that apiRiver leaves out of the page address it sends]
Hosting provider / infrastructure	everything physically stored on the server	hosting the application and database [AUTHOR DECISION REQUIRED: provider not chosen]
Payment recipient — PayPal	payments are accepted as PayPal transfers; apiRiver receives PayPal's notification emails in a mailbox; what is kept from them is listed in section 3	receiving and matching payments [LAWYER REQUIRED: PayPal's role (an independent controller or otherwise) and whether it belongs in this table as a recipient of data that apiRiver sends, or only as the source of the notifications] [AUTHOR DECISION REQUIRED: which provider hosts the mailbox that receives the PayPal notifications]

The web fonts of this site are served from apiRiver's own server: no visitor data is transmitted to third parties for that purpose. [LAWYER REQUIRED: the draft's general statement that data is not passed to other third parties is deliberately not carried over as a blanket claim — the recipients are those in the table above, and the table is still incomplete (hosting provider, mailbox provider, payment-related recipients).] Customer data is not used for the company's own purposes.

apiRiver may change its email provider (Zoho Mail is the only one used at this time) and will update this notice when it does.

Transfers outside the EEA. [LAWYER REQUIRED IN FULL: processing is under the control of a controller established in Ukraine, i.e. outside the EEA, and sub-processors may be in third countries (including Google, which provides Google Analytics and Google Ads). On what basis such a transfer is permissible — an adequacy decision, standard contractual clauses or otherwise — is not established here. This is one of the main points of the legal review before publication.]

6. How long data is kept

The periods below are upper limits ("up to"): in practice data is usually deleted earlier.

Item	Retention
Sign-in link token	valid for 15 minutes; the record (which holds the email address) is kept for up to 30 days after it expires, then deleted by a scheduled job. The record is also invalidated when the link is requested again.
Session	a sign-in lasts 30 days (the session cookie expires 30 days after sign-in and is not renewed; the expiry of the session record on the server is extended with activity); the record is kept for up to 30 days after it expires (or after you sign out, when it is deleted at once), then deleted by a scheduled job.
Account and email	for as long as the account exists. Inactive accounts are not deleted automatically; an account is deleted on request (section 8).
API key	a revoked key's record is not deleted on revocation (needed for history and for the integrity of the future usage log) and is kept for as long as the account exists.
Rate-limit counters	not stored: process memory, evicted when the longest window (a day) expires, lost on restart
Messages sent through the contact form	kept in the operator's mailbox [AUTHOR TO CONFIRM: retention period of the messages in the mailbox]
Website measurement data at Google	kept by Google under the retention setting of apiRiver's Google Analytics property [AUTHOR/LAWYER REQUIRED: the retention period set in Google Analytics (the console default is two months) and whether it is adequate]
Advertising measurement data at Google	kept by Google under the settings of apiRiver's Google Ads account [AUTHOR/LAWYER REQUIRED: the retention of Google Ads data and whether it is adequate]
Your cookie choice (local storage)	the choice is valid for up to 180 days, after which you are asked again; the record stays in your browser until you choose again or clear this site's data in your browser
Perimeter access log (including IP and URL)	up to 90 days [AUTHOR TO CONFIRM: the reverse proxy is not chosen yet; before publication its log format must be set to leave out the URL query string of the sign-in confirmation address, which carries the one-time token, and the retention period must be set on the host]
Application log (request identifier, client address)	up to 90 days. The application does not write URL query strings, email addresses, names or messages entered in the sign-in or contact forms, API keys or cookie values into its log. The application log records the request identifier, the client address, account identifiers, and, for emails in the payment mailbox, the email's message identifier (when the email is rejected, cannot be parsed, its amount cannot be read, its processing fails, it cannot be marked as read, or the operator's report about it cannot be sent) and the sender's domain (when the email is rejected, cannot be parsed, its amount cannot be read or it has no message identifier).
Usage log of API calls	does not exist at this time; when it is introduced, this notice will be extended with its retention period (see section 3)
Balance, ledger, subscription and payment-email records	for the period required by tax and accounting rules [ACCOUNTANT/LAWYER REQUIRED: the number of years, and whether these records must be kept after an account is deleted]
Content of documents	not stored after the request is processed. While a PDF larger than about 10 KB is validated, the validation library writes a temporary copy to a private server directory; it is deleted when processing ends or, after an abnormal stop, by a later clean-up.

7. The content of your documents

• The content of invoices submitted for generation or validation is not stored after the request is processed: received, processed, returned, forgotten. While a PDF larger than about 10 KB is validated, the validation library writes a temporary copy to a private server directory; it is deleted when processing ends or, after an abnormal stop, by a later clean-up.
• Operational metrics are counted on the fly, without storing any content. [AUTHOR TO CONFIRM: no operational metrics are collected by the service at this time; this describes how they will be counted when introduced]
• With respect to that content apiRiver is a processor acting on the customer's instructions; the terms are set by the data processing agreement.

8. Your rights

A data subject may request access to their data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and portability (Art. 20), and may object to processing based on legitimate interest (Art. 21). Website and advertising measurement (section 4) is based on consent. You can withdraw or change it at any time, without affecting the lawfulness of the processing before withdrawal, with the Cookie settings link at the bottom of the home page, in the navigation of these documents or on the sign-in page. “Decline” deletes the Google Analytics and Google Ads cookies of this site from your browser and stops Google's script from being loaded on the following pages, as long as this browser keeps the stored choice; if the browser does not let this site store it at all, Google's script is not loaded before a choice on any page; on the page where you decline, requests that Google's script has already started may still be sent, without cookies. “Analytics only” deletes the Google Ads cookies. If any other processing turns out to be based on consent, it can be withdrawn the same way, by writing to us.

Send requests to [email protected]. We respond within one month of receiving a request. [LAWYER REQUIRED: confirm the wording against Art. 12(3), including the possibility of extending the period]

Complaints go to a data-protection supervisory authority [LAWYER REQUIRED: which authority to name, given that the controller is outside the EEA].

Self-service account deletion is not available at this time. To have your account deleted, write to [email protected]: deletion is done on request, by hand, in this order: first the sign-in sessions, then the API keys, then the account itself. Payment records are not deleted together with the account: they are kept for the period required by tax and accounting rules (section 6). A deletion request is carried out within one month, like other requests. [AUTHOR DECISION REQUIRED — an organisational gap, not a text one: how a deletion request is handled for an account with a non-zero balance, and what is kept of the account itself for an account that has payment records — those records refer to the account record, so it cannot be deleted while they are kept (for example, whether the email address is replaced and the record kept).]

9. Automated decisions

The service takes no automated decisions that produce legal effects concerning the user or similarly significantly affect them, within the meaning of Art. 22 GDPR. [LAWYER REQUIRED: this qualification is an agent's proposal; whether the automatic triggering of the rate limiter, the anti-bot check on the sign-in form, the rate limits and the hidden anti-spam field of the contact form or the suspension of access falls under the Article needs separate assessment]

10. Changes to this notice

Material changes to this notice are sent by email to the account's address. The notice period and the date on which the current version takes effect are the same as for the Terms of Service and are shown in the Terms of Service, section 14.

11. Cookies

The site sets four cookies of its own, all strictly necessary for the service you ask for, and — only after your choice in the cookie banner — the cookies of Google Analytics and, after “Accept all”, of Google Ads. Before a choice, Google's script on the home page and the legal documents sets and reads no cookie of this site.

Cookies of the site

Cookie	Purpose	Attributes	Lifetime
apiriver_session	keeps you signed in to the cabinet	HttpOnly, Secure, SameSite=Lax, Path=/	30 days from sign-in (the cookie is not re-issued; only the session record on the server is extended with activity); removed when you sign out
apiriver_login_csrf	one half of a double-submit pair on the sign-in form; protects the request for a sign-in link from being triggered by another site; it authenticates nobody and gives access to nothing	HttpOnly, Secure, SameSite=Lax, Path=/login	15 minutes
apiriver_login_confirm_csrf	the same protection on the sign-in confirmation page, so that the confirmation of a sign-in cannot be triggered by another site	HttpOnly, Secure, SameSite=Lax, Path=/login/confirm	15 minutes (as long as the sign-in link); removed after a successful sign-in
apiriver_lang	remembers the interface language you chose	HttpOnly, Secure, SameSite=Lax, Path=/	until you close the browser (a session cookie); set only when you choose a language

Analytics cookies (only after “Analytics only” or “Accept all”)

Cookie	Purpose	Attributes	Lifetime
_ga	tells browsers apart for Google Analytics	Secure, SameSite=Lax, Path=/, set by Google's script for this site only (not for its subdomains), readable by scripts	395 days (about 13 months) from the last visit
_ga_<ID>	keeps the state of the current visit for Google Analytics	Secure, SameSite=Lax, Path=/, set by Google's script for this site only (not for its subdomains), readable by scripts	395 days (about 13 months) from the last visit

Advertising cookies (only after “Accept all”)

Cookie	Purpose	Attributes	Lifetime
_gcl_au	link a visit to the Google ad click that brought it (Google Ads measurement)	set by Google's script	90 days
_gcl_aw	link a visit to the Google ad click that brought it (Google Ads measurement)	set by Google's script	90 days
_gcl_gb	link a visit to the Google ad click that brought it (Google Ads measurement)	set by Google's script	90 days
_gac_<ID>	the same, for Google Analytics linked with Google Ads	set by Google's script	90 days

[AUTHOR TO CONFIRM after the live check: which of these cookies Google's script actually sets on this site, and their domain and attributes]

Your choice is not stored in a cookie: it is kept in your browser's local storage, is valid for 180 days (section 6) and can be changed at any time with the Cookie settings link. “Decline” deletes the Google Analytics and Google Ads cookies of this site from your browser; “Analytics only” deletes the Google Ads cookies.

The sign-in page also embeds one third-party widget: the Cloudflare Turnstile check (see section 5), which runs in a frame served by Cloudflare. It is not covered by the cookie choice above. [LAWYER REQUIRED: the widget may store data in the browser under Cloudflare's domain; what Turnstile stores in the browser is not verified; whether it is strictly necessary for the sign-in the visitor requests or needs prior consent]

[LAWYER REQUIRED: classifying the four cookies of the site and the stored cookie choice as strictly necessary (so that they need no prior consent) is the author's decision resting on a proposal; ePrivacy is implemented differently across EU countries; the adequacy of the 395-day, 180-day and 90-day periods; whether the Turnstile widget needs prior consent is still open; the residual cases in which a withdrawal does not take effect at once: measurement requests without cookies sent before a choice and from the page on which you decline, Google cookies set again by a page that was still loading Google's script at the moment of withdrawal (they are deleted when the next page of the site with measurement is opened), a page restored by the browser's back/forward cache, a decline or withdrawal that the browser could not save or has since erased (storage full, or cleared by the browser itself — some browsers drop it after seven days without a visit), in which case the home page and the legal documents show the banner again and load Google's script again without cookies until you choose, a decline or withdrawal in a browser that lets this site read the stored choice but refuses both to replace and to remove it, in which case the earlier choice stays in effect on the following pages, cookies that Google may set or read on its own domains (for example google.com) when your browser sends it requests from this site, including before a choice, and the Google cookies left in the browser if the site switches measurement off entirely.]