Privacy notice

Draft — not in force. No legal entity is configured, so no controller is named and this document is a starting point for review. Set LEGAL_ENTITY once it has been checked.

What we store

Deliberately little. Everything in this list is something the service cannot work without.

Data	Why
Your email address	Identifies the account and is the only way to reach you
A bcrypt hash of your password	To let you log in. The password itself is never stored
Your templates and their sample data	So later requests can send data only
API keys as SHA-256 hashes, plus a short prefix and the name you gave	To authenticate calls and let you tell keys apart. The key itself is unrecoverable
Plan state and Stripe customer and subscription identifiers	To know whether the subscription is active
Timestamps: account created, template updated, key last used	To show you when things happened

What we do not store

Rendered PDFs. A document is generated in memory and streamed back in the response. It is never written to disk or kept.
The data you send to be rendered. It is used to produce the document and then discarded with the request.
Card details. Stripe collects and holds those; they never reach us.

Logs

We keep structured request logs containing the account identifier, the size of the template, how long a render took, and the outcome. They do not contain template contents or the data you submitted.

Where it is processed

On Google Cloud in europe-west1 (Belgium) — Cloud Run for the service, Cloud SQL for the database. Payments are processed by Stripe. Those two are our only processors; we use no analytics, advertising, or third-party trackers, and the pages load no external scripts or fonts.

How long we keep it

Until you delete it. There is no separate archive: deleting your account removes the account row and, by database cascade, every template and key belonging to it.

Your rights

Deletion. Self-serve and immediate, from the billing page. It also cancels any active subscription.
Access and portability. Your templates are retrievable at any time through GET /v1/templates with your API key, which returns them as JSON.
Correction. Templates and their names are editable in the app.

Security

Passwords are hashed with bcrypt and API keys with SHA-256. Sessions use signed, HTTP-only cookies. Templates are rendered by a browser that is blocked from reaching cloud metadata endpoints, so a submitted template cannot read our own credentials. Every database query for a template or key is scoped to the owning account.

Breaches

If data is exposed in a way that puts you at risk, we will tell you by email, and the relevant supervisory authority within 72 hours where the law requires it.