Privacy statement Peppol e-invoice API
Version 1 November 2026
Who we are
Klik&Shop (sole proprietorship), Paramaribohof 55, 2315 VW Leiden, the Netherlands, KvK 98148362, is the controller for data processed through this website and the e-invoice API. Contact: info@klikshop.tech, +31 6 11188391.
Your invoices are not stored
Invoices and invoice data you send to the API or the web form are processed in memory only to produce the response. We do not store them, do not write them to logs and do not use them for anything else. Once the response is sent, they are gone. The validator on the "Validate" page runs entirely in your own browser: the file is not sent to us. For invoices you have processed via the API, you are the controller and we are the processor.
As little data as possible
We do not ask for a name, email address or account to issue an API key. We use no cookies, no analytics and no trackers.
What data, why and how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Invoice content (API and web form) | Creating or checking the invoice | Performance of contract | Not stored: held in memory only while the request is processed |
| Hash of your API key, key ID, creation time, monthly usage and credit | Providing the service, limits and credit | Performance of contract | While the key is active, then max. 12 months |
| Hashed daily derivative of your IP address | Preventing abuse of key creation (max. 3 per day) | Legitimate interest | 2 days |
| Hashed derivative of your IP address (for IPv6: of the /64 network) and a random browser code in your browser's local storage, with a counter | Enforcing the 2 one-time free web-form invoices. Your IP address cannot be recovered from the hash. The counter contains no invoice data. | Legitimate interest | Max. 12 months after your last use of the web form |
| Your seller details, only if you tick "Remember my details" | Convenience for your next invoice | Consent | Only in your own browser (localStorage), not with us; untick to erase |
| Payment data (via Stripe), key ID, amount, session ID | Processing payment, adding credit, bookkeeping | Contract, legal obligation | 7 years (Dutch tax retention) |
| Technical logs of our hosting provider (incl. IP address; no invoice content) | Security and troubleshooting | Legitimate interest | Per Cloudflare's (short) retention |
Recipients
We use Cloudflare (hosting and API, global network; processes requests, including invoice content during processing) and Stripe (payments, with its own privacy policy for payment data). Transfers outside the EEA are covered by appropriate safeguards such as the EU-US Data Privacy Framework or standard contractual clauses. We do not sell data.
Use via RapidAPI
If you use the API through RapidAPI, RapidAPI processes your registration and payment under RapidAPI's own privacy policy. RapidAPI forwards the content of your requests to Klik&Shop's server, together with an anonymous RapidAPI user ID. Klik&Shop uses this data only to carry out the request and does not receive name or card details from RapidAPI.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. Since we cannot identify you without your key, please mention your key ID in a request. Email info@klikshop.tech. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
API keys are stored as hashes only. All traffic uses HTTPS.
Changes
We may update this statement. The current version is always on this page.