Privacy Policy

This privacy policy explains how personal data is processed when you use the ZUGFeRD platform at zugferd-invoice.attrian.de and the Stripe App “ZUGFeRD E-Invoicing” (together, the “Service”).

1. Controller and contact

BrainWave Software GmbH, Heilig-Kreuz-Straße 24, 86152 Augsburg, Germany. Further details in the legal notice (/impressum).

Privacy requests: zugferd-support@brainwave-software.de or by post to the address above.

2. Roles: controller and processor

We are the controller for the data of our customers' user accounts (sign-in, company profile).

We process the invoice data our customers handle through Stripe — in particular data about their invoice recipients — as a processor on behalf of each customer (Art. 28 GDPR). The customer is the controller for that data. Invoice recipients should first contact the business that issued the invoice. See section 11 for the data processing agreement.

3. Data we process

• Account data: username, email address, role, password (stored only as a bcrypt hash), organisation membership.
• Customer company profile: company name, address, VAT ID, tax number, bank details (IBAN, BIC, account holder), logo. Some of this is copied from the Stripe account during setup (name, email, tax ID, support address) and appears on generated invoices.
• Invoice data from Stripe: invoice number, date, line items, amounts, tax rates, currency, and invoice recipient data (name, address, email address, VAT ID).
• Generated documents: ZUGFeRD/XRechnung XML, PDF/A-3 files, validation reports.
• Stripe connection data: Stripe account ID and — if a customer stores them — API keys and webhook secrets; settings for email and PEPPOL delivery.
• API keys for the external API (stored only as a hash) and time of last use.
• Access requests (title, description, justification, status, admin notes).
• Technical data: session data, server logs (time, API path, status code, duration, truncated response content), IP address (held in memory only for rate limiting, not stored).

4. Purposes and legal bases

• Providing the Service (converting Stripe invoices into ZUGFeRD/XRechnung, validation, archiving, optional delivery): Art. 6(1)(b) GDPR (contract) or, on behalf of the customer, Art. 28 GDPR.
• Sign-in, session management and single sign-on: Art. 6(1)(b) GDPR.
• Security, abuse prevention and troubleshooting (logs, rate limiting): Art. 6(1)(f) GDPR; our legitimate interest is operating the Service securely and reliably.
• Our own statutory retention obligations: Art. 6(1)(c) GDPR.

We do not use data for advertising, do not sell data, and use no analytics or tracking tools.

Providing account and company data is required to conclude the contract and use the Service; without it we cannot provide the Service. There is no statutory obligation to provide it.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

5. Stripe and the Stripe App

When you install the Stripe App or connect your Stripe account, the Service reads via the Stripe API: invoices and invoice PDFs, customers (name, email, address, tax IDs), tax rates, account details (business name, email, tax ID, support address) and branding (logo). Requests from the Stripe Dashboard are authenticated with Stripe's signed request. We receive Stripe webhooks for app install/uninstall and for finalized and paid invoices.

Stripe's own processing is governed by your agreement with Stripe and Stripe's privacy policy (stripe.com/privacy). For customers in the EEA, the contracting entity is usually Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

6. Hosting, storage and recipients

• Hosting: the application and its PostgreSQL database run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in its Nuremberg data centre (Germany).
• Object storage: generated PDF, XML and report files are stored in S3-compatible object storage operated by us (s3.attrian.de), with the same hosting as the application. Files are stored encrypted with AES-256.
• Email delivery: invoices are emailed only if the customer has enabled email delivery. The invoice PDF is then sent to the invoice recipient's email address via the SMTP service Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France).
• Single sign-on: “Login with ATTRIAN” uses a Keycloak server operated by us (auth.attrian.de). Email address, username and name are taken over; an account is created on first sign-in.
• PEPPOL: only if a customer configures PEPPOL delivery is the invoice XML sent to the access point the customer specified; PEPPOL network directory services are queried to look up the recipient.
• Network and attack protection: access to the Service runs through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (reverse proxy, DDoS protection). Cloudflare processes the transmitted data, including IP addresses, to forward it to our servers. A data processing agreement is in place with Cloudflare.
• Stripe: see section 5.

Data is transferred to a country outside the EEA only through Cloudflare, Inc. (USA). Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). In addition, the standard contractual clauses in the data processing agreement with Cloudflare apply. All other recipients process the data in the EU or EEA.

7. Cookies and local storage

We only use storage that is strictly necessary (§ 25(2) no. 2 TDDDG):

• Cookie “sessionId”: session cookie for sign-in, valid for 24 hours, HttpOnly, HTTPS-only in production. The session is stored in our database.
• Cookie “sidebar_state”: remembers whether the sidebar is collapsed, 7 days.
• Local storage “language” (selected language) and “cookie_consent” (your choice in the cookie notice).
• Session storage “pkce_code_verifier” and “oauth_state”: only during single sign-on.

Fonts are served from our own server; no third-party content (CDNs, analytics, advertising) is loaded in the browser.

8. Retention

• Account data, company profile, invoice data and generated documents are kept for the duration of the contract.
• When the Stripe App is uninstalled, the account is deactivated and all sessions are ended; the data is kept so the app can be reinstalled. On request to zugferd-support@brainwave-software.de we delete the data within 30 days unless statutory retention obligations apply.
• Sessions expire after 24 hours.
• Server logs are stored only on our servers and are continuously overwritten once the allotted storage size is reached; there is currently no fixed deletion period.

Note: statutory retention obligations for invoices rest with the invoice issuer; invoices must generally be kept for 8 years under § 14b UStG and § 147 AO (see also GoBD). The Service is not an audit-proof archive; customers should archive the generated documents themselves.

9. Security

Data is transmitted encrypted over HTTPS. Passwords and API keys are stored only as bcrypt hashes. Generated files and stored Stripe keys and access tokens are encrypted at rest with AES-256. Tenants' data is separated in the database by row-level security, and access is role-based. Sign-in attempts and Stripe App requests are rate-limited. Single sign-on requires a verified email address.

10. Your rights

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20).
• Objection to processing based on legitimate interests (Art. 21 GDPR).
• Complaint to a data protection supervisory authority (Art. 77 GDPR), the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Send requests to the address in section 1.

11. Data processing agreement (DPA / AVV)

Customers who process personal data of their invoice recipients through the Service conclude a data processing agreement with us under Art. 28 GDPR; it is part of the terms of service (section 10). The list of sub-processors is at /en/zugferd/support. A countersigned copy is available on request to zugferd-support@brainwave-software.de.

12. Changes

We update this privacy policy when the Service or the law changes. The version published here applies.

Last updated: 11 November 2026