Privacy Policy

1. Information We Collect

To provide our services, we must collect certain information. We adhere to the principle of data minimization, collecting only what is essential for the functionality of our application:

1.1. Data Provided by the User:

• Contact and Account Information: Email address, company name, and Company Identification Number (CIF/NIF) for account creation and billing.
• ERP Integration Data: URL and API keys for your Dolibarr instance to enable the automated integration of invoice data.

1.2. Data Processed Through the Service:

• Invoice Content: We process the documents you upload, which may contain personal data of third parties (your suppliers). This data is processed solely to extract the necessary information to be sent to your ERP for the corresponding automatic registration.
• Extracted Invoice Data: This includes, but is not limited to, supplier data, amounts, concepts, product references, tax rates, and quantities, which are extracted from the documents.
• File Metadata: We temporarily log the names of uploaded files for operational purposes. The invoice files themselves are deleted from our servers immediately after being processed and sent to your ERP.

1.3. Automatically Collected Data (Cookies):

We use essential and functional cookies for:

• Authentication
• Session management
• Google identification
• Statistical purposes

2. Purpose of Data Collection

Your data is used exclusively to provide and improve our services:

2.1. Service Provision:

To create and maintain your account, process payments, and facilitate the core functionality of the application—extracting data from invoices and integrating it into your Dolibarr ERP.

2.2. AI-Powered Document Processing:

To accurately extract data from the invoices you upload, our service uses advanced Artificial Intelligence models through paid, enterprise-grade cloud infrastructure contracted by UpInvoice. Documents are sent to this service for the sole purpose of data extraction and are processed under a strict enterprise privacy framework: the provider acts solely as a data processor under a GDPR-compliant data processing agreement, acquires no rights over the information, and is contractually prohibited from using it to train or improve its models, for advertising, or for any other purpose beyond the requested service. We do not use free or consumer versions of these tools, whose terms may allow such uses. We continuously monitor our providers' privacy terms and only work with those who guarantee the highest level of confidentiality.

2.3. Communication:

To send you important notifications about your account, service updates, and to respond to your inquiries.

2.4. Security and Fraud Prevention:

To monitor account activity, detect and prevent fraudulent or unauthorized activities, and ensure the integrity of our platform.

3. Data Sharing and Third-Party Processors

We do not sell, trade, or rent your personal data to third parties. We only share information with trusted third-party service providers (sub-processors) who are essential for delivering our service. We are committed to strictly supervising the privacy and security policies of these providers to ensure your data is protected:

• Artificial Intelligence Providers: we use paid, enterprise-grade cloud AI services to process invoices. These providers act as data processors, are contractually obligated to protect the confidentiality and security of the data they process on our behalf, and may not use it to train their models.
• Infrastructure and Service Providers: We use providers for hosting, payment processing, and other operational necessities.
• Legal Compliance: We may disclose your information if required by law or in response to a valid legal process from a competent authority.

4. Your Rights

In accordance with the GDPR and Spanish Organic Law on Data Protection (LOPD-GDD), you have the following rights over your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct any inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): You can request that we delete your personal data, subject to certain legal obligations.
• Right to Object: You can object to the processing of your personal data for specific reasons.
• Right to Data Portability: You can request that we transfer your data to another organization in a structured, machine-readable format.

To exercise these rights, please contact us at the email address provided in the Contact section.

5. Data Security

We implement robust technical and organizational security measures to protect your personal data. This includes using SSL/TLS encryption for all data in transit, both between you and our servers and between our servers and our AI providers. AI processing takes place under a strict enterprise privacy framework, on cloud infrastructure that encrypts data in transit and at rest and holds recognized security certifications such as ISO/IEC 27001. We select partners who demonstrate a strong commitment to data security and privacy.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

7. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any significant changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

8. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at info@upinvoice.eu.