Privacy Policy

1. Data controller

The controller of your personal data is D-Matrix LTD, company ID (EIK) 206576019, registered at 39 Pop Bogomil St., 1202 Sofia, Bulgaria.

Privacy questions: [email protected]

2. What data we process

Account data: name, email address, password (stored hashed only), language and preferences.

Your organisation and client data: business names, company and VAT numbers, addresses, contact persons, bank accounts.

Document content: line items, amounts, notes, uploaded logo and signature.

Subscription data: plan, status and Stripe identifiers. We do not process card details.

Technical data: IP address, browser type and log records needed to keep the service secure.

3. Purposes and legal bases

Providing the service and performing our contract with you (Art. 6(1)(b) GDPR).

Complying with legal obligations, including accounting and tax (Art. 6(1)(c) GDPR).

Our legitimate interest in security, abuse prevention and support (Art. 6(1)(f) GDPR).

4. Recipients and processors

Supabase — database hosting; Cloudflare — network protection and content delivery; Resend (Amazon SES) — email delivery; Stripe — payment processing.

OpenAI — only when you look up a company by its registration number, to structure publicly available Commercial Register data.

We have data processing agreements in place with these providers.

5. International transfers

Some of our providers process data outside the European Economic Area. Where that happens, the transfer relies on Standard Contractual Clauses approved by the European Commission.

6. Retention

Account data is kept while your account exists. When you delete your account the data is removed, unless law requires us to keep it longer.

Documents of accounting significance are retained for the periods required by the Bulgarian Accountancy Act.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection.

You can delete your account and data directly from your profile settings, or by writing to [email protected].

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia.

8. Cookies

We use strictly necessary cookies only: for sign-in and session handling, for your chosen language, and for the interface theme.

We do not use advertising or tracking cookies.

9. Security

Data is transmitted over an encrypted connection (HTTPS), passwords are stored hashed, and access to production systems is restricted.

10. Changes

If we change this policy we will publish the updated version on this page and revise the date above.