Privacy policy
This policy explains what personal data DigiTale Invoice processes, why, and what rights you have. It describes the service as it works today.
Last updated:
Controller
The controller of your personal data is DigiTale s.r.o., IČO 17276632, registered in the commercial register (Městský soud v Praze, oddíl C, vložka 369310).
For anything about your personal data, write to talalayev@outlook.com.
We process personal data under Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and the Czech Act No. 110/2019 Coll., on personal data processing.
Purposes and legal basis
Creating an invoice without an account
The invoice form runs in your browser. What you type, the PDF and the payment QR code are created on your device and are not sent to us. We don't store invoices made without an account.
If you choose to save the invoice to an account, your browser keeps a copy in its local storage until you sign in and import it, or until you clear your browser data. The invoice reaches our servers only when you import it.
Visiting the website
When you open a page, our hosting provider processes technical data about the request: your IP address, the time, the address requested and your browser's identification. This is needed to deliver the page and keep the service secure. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
Your account
To create an account you give us your name, your email address and a password. We store the password only as a one-way hash, never in readable form.
In the account you store what you enter: your businesses (name, address, IČO, DIČ, contact details and bank accounts), your clients, invoices, invoice templates and numbering settings.
Legal basis: providing the service you signed up for (Article 6(1)(b) GDPR). We can't create an account without an email address.
Data about your clients and colleagues
Invoices and client records can contain personal data of other people, for example a sole trader's name and address. You decide what you enter. We use it only to store it for you, show it to you and to the people you give access to, and send it where you ask.
If you invite someone to your business, we store their email address with an invitation that is valid for 7 days. Legal basis: the legitimate interest of the business owner in giving colleagues access (Article 6(1)(f) GDPR).
We email them the invitation link through our email provider.
Sending invoices by email
When you send an invoice from your account, we pass the recipient's email address, the subject and the invoice PDF to our email provider, which delivers the message. Legal basis: providing the service (Article 6(1)(b) GDPR).
Company lookup in ARES
In your account you can fill in a business from its IČO. Our server then sends only that IČO to ARES, the public register of economic entities run by the Czech Ministry of Finance, and fills in the public details ARES returns. Your IP address and other data are not sent. Legal basis: providing the service (Article 6(1)(b) GDPR).
Preventing abuse
To slow down password guessing and automated sign-ups, we count sign-in and sign-up attempts per IP address, and company lookups per account. These counters are kept only in the server's working memory, never in the database. Legal basis: our legitimate interest in protecting accounts and the service (Article 6(1)(f) GDPR).
Recipients and processors
We pass personal data only to the providers below, which process it on our behalf, and to public authorities where the law requires it.
- Vercel
- Hosting of the website and the application, including the request logs.
- Prisma (Prisma Postgres)
- The database that holds accounts and everything stored in them.
- Resend
- Delivery of invoices and invitations sent by email.
- ARES (Ministry of Finance of the Czech Republic)
- Receives the IČO you look up. ARES is a public register, not our processor.
Several of these providers are based in the United States. Where personal data is transferred outside the European Economic Area, the transfer relies on the safeguards of Chapter V GDPR: an adequacy decision of the European Commission (Article 45 GDPR) or standard contractual clauses (Article 46 GDPR).
How long we keep data
- Account data: for as long as the account exists. We delete it when you ask us to delete the account.
- Businesses, clients, invoices and templates: until you delete them or the account is deleted. You can delete draft invoices, clients, templates and bank accounts yourself; issued invoices are deleted together with the account.
- Invitations: valid for 7 days, and deleted when accepted or revoked.
- Sign-in session: the session cookie expires 30 days after you last use the account, or when you sign out.
- Abuse-prevention counters: in the server's working memory only. Each counter applies for 15 minutes (sign-in), one hour (sign-up) or 5 minutes (company lookups).
- Request logs: for the retention period of our hosting provider's logs.
- Data in your browser (an invoice waiting to be imported, your light or dark mode choice): until you import it or clear your browser data.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Article 15);
- have inaccurate data corrected (Article 16); you can change most of it yourself in the account settings;
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive your data in a machine-readable format (Article 20);
- object to processing based on our legitimate interest (Article 21).
To exercise any of these rights, write to talalayev@outlook.com. We may ask you to confirm that the account is yours. We reply without undue delay and within one month at the latest (Article 12(3) GDPR).
You can also lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz (Article 77 GDPR).
We don't make decisions about you based solely on automated processing (Article 22 GDPR).
Changes to this policy
When the service or the way we process personal data changes, we update this page and the date at the top.