Privacy Policy

• We collect the minimum needed to run accounts and usage limits.
• We do not store the invoice documents you validate. Playground validation runs entirely in your browser; API documents are processed in memory to produce a result and then discarded.
• If you choose to share a report, we store that report — the verdict and rule violations, whose messages can quote specific values from the document — until you or we delete it. Sharing never happens automatically.
• We do not sell your data, and we do not train models on your invoice contents.
• We use a small, named set of sub-processors, listed in clause 6.

Account data — your email address and a salted PBKDF2 hash of your password (we never store the password itself). Purpose: to create and secure your account. Legal basis: performance of a contract.

Usage records — monthly counters per feature (hosted API calls, shared reports, ruleset checks) and a last-used timestamp per API key. We do not keep a per-call log of what you sent. These records do not contain your invoice contents. Purpose: to enforce plan quotas and show you your usage. Legal basis: performance of a contract.

Shared reports — created only when you press “Share report”: the verdict and the list of rule violations. Violation messages can quote individual values from the document (for example an amount that fails an arithmetic rule), so share a report only if you are comfortable with the recipient seeing those. Anyone with the link can view it. Legal basis: performance of a contract.

Plan and upgrade data — your current plan and any upgrade request you make. We never see or store your payment details. Paying happens entirely on PayPal's own site: we send you there, and PayPal tells us only whether a payment or subscription is in good standing. If you subscribe, we pass PayPal your email address and your account reference so the subscription can be matched back to your account. We hold the fact of your request and, once paid, what we need for our accounting records. Legal basis: performance of a contract and our legal obligation to keep accounting records for invoices we issue.

Auto-invoicing data (optional, paid plans) — if you switch on the payment webhook, the payment notifications your provider sends us are turned into invoice records saved to your account. Those notifications can include your customer's name, email and the amount and reference of the payment. You are choosing to send us this data, and it is your customers' personal data, so here you are the controller and we are your processor (see clause 8). We store these records like any other saved invoice and never use them for anything but showing them back to you. Legal basis: performance of a contract. If you do not enable the webhook, none of this applies.

Technical logs — our infrastructure provider (Cloudflare) processes IP addresses and request metadata at its edge to deliver the site and defend it; we see aggregate statistics, not a browsing log, and we do not log request bodies. Legal basis: legitimate interest.

The playground on this website validates, repairs and generates documents entirely in your browser — the XML never reaches our servers at all. When you send a document to the hosted API endpoints it is parsed in memory, checked against the rules, and the result is returned to you. The document itself is not written to our database and is not retained after the response. We keep only the metadata described above.

If you would prefer that invoice data never leaves your infrastructure at all, use the open-source library, which runs entirely locally with no telemetry. See Security.

Three optional, opt-in AI features can send data to Anthropic. Each sends only what is described below, and only when you use it; if you do not, nothing is sent to Anthropic. The assistant keeps your recent chat in your browser's session storage so it survives navigating between pages — it is cleared when you close the tab, and we do not store the conversation on our servers beyond the API call that answers each message.

• Explain a validation result. The findings for that request — rule identifiers, business term references and our own message text — are sent so a plain-language fix list can be generated.
• AI assist in the invoice builder. The free-text description you type (for example “12 hours of design work at £95/hr”) is sent so it can be turned into draft line items. Only that text is sent — never the rest of the invoice, and never anything you did not type into that box.
• The assistant (paid plans). The messages you type into the chat are sent so it can answer them. It is not given your invoices, your account data or anything else you do not type into it.

We use two strictly necessary cookies, and only when you sign in. The first holds your session; it is HttpOnly, SameSite and Secure, so it cannot be read by scripts. The second is a small non-secret flag that simply records that you are signed in, so the site knows to show your account rather than the sign-in button without calling our server on every page — it contains no personal data and no session token. We use no advertising or cross-site tracking cookies, so we show no consent banner for them, and we run no analytics scripts at all: traffic is measured as aggregate page counts in our own edge worker (one number per page, per day — never an IP, a cookie or a per-visitor record) and as request statistics at our infrastructure provider, with nothing executing in your browser.

We use these third parties to run the service:

• Cloudflare — website hosting and delivery, the account database (Cloudflare D1), and email routing/delivery for our @stampbench.com addresses.
• Anthropic — the optional AI features (see clause 4), applicable only once they are enabled.
• PayPal — payment and subscriptions for paid plans. You pay on PayPal's own site under their privacy policy. For a subscription we share your email address and account reference with them; we receive the subscription's status, not your card or bank details.

We will update this list before adding a new sub-processor that handles personal data. Cloudflare operates a global edge network, so requests may be handled outside the UK/EEA; such transfers rely on Cloudflare's Standard Contractual Clauses and the UK Addendum.

Account and usage data are kept while your account is open. To close your account, email [email protected] from your account address and we will delete your account record, API keys, usage history and shared reports promptly — self-serve deletion is coming. Individual shared reports are also deleted on request. Invoice documents are not retained at all. Records of invoices we issue to paying customers are kept for as long as tax law requires, typically six years.

Invoices normally contain personal data about your customers. Where you send such data to our hosted API, you are the controller and we act as your processor. A data processing agreement (Auftragsverarbeitungsvertrag) is in preparation — contact us at [email protected] if you need one. Using the open-source library locally avoids this question entirely, since no data reaches us.

Under UK and EU data protection law you may request access to your personal data, request correction or deletion, object to or restrict processing, and request portability.

To exercise any right, email [email protected]. We aim to respond within 30 days. If you believe we have handled your data improperly you may complain to your supervisory authority — in the UK, the Information Commissioner's Office; in Germany, your state data protection authority.

We will update this policy as the service evolves and will change the date at the top. For material changes affecting how we use personal data, we will notify account holders by email.