← InvoiceByHerb · Docs · Privacy · Terms · Legal notice

Privacy Policy

Last updated: 4 October 2026

1. Controller

Dominik Märtens, Ostermünsterweg 2, 86465 Welden, Germany. E-mail: maertensdominik@gmail.com

2. What InvoiceByHerb processes

When you use the connector in Claude (Anthropic) or ChatGPT (OpenAI), your AI assistant sends the content of the invoice you want read or checked to our server. Invoices usually contain names, addresses, contact details, tax numbers and bank details of the seller and the buyer. Optionally, a supplier IBAN you already know can be sent along to detect changed bank details.

This data is processed only in memory to answer your request. It is not stored, not logged, not shared with third parties, not used for advertising and not used to train AI models. It is discarded as soon as the request is answered (normally in under one second). We do not create user accounts and do not use cookies.

Legal basis: Art. 6(1)(b) GDPR (providing the service you requested). Where an invoice contains data of third parties, Art. 6(1)(f) GDPR (legitimate interest in checking received invoices).

3. Technical data

To prevent abuse, the IP address of the requesting system (when used via Claude or ChatGPT this is normally a server of Anthropic or OpenAI, not your device) is kept in memory for at most 90 seconds to limit the number of requests. We keep no access logs containing IP addresses. Legal basis: Art. 6(1)(f) GDPR (security of the service).

4. Recipients and hosting

The server is operated by Fly.io, Inc. (USA) in its data centre in Frankfurt am Main, Germany, under a data processing agreement pursuant to Art. 28 GDPR including EU Standard Contractual Clauses. For technical reasons the host may process connection data (e.g. IP addresses) in its own network logs. No other recipients receive invoice data.

5. Your AI assistant

Anthropic and OpenAI are responsible for how Claude and ChatGPT process your data under their own privacy policies. We only receive what your assistant sends to run the tool.

6. Retention

Invoice content: not retained. Rate-limit IP addresses: at most 90 seconds. E-mails you send us: until your request is resolved, unless statutory retention obligations apply.

7. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority, e.g. the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany. As we do not store invoice data, there is usually nothing we could disclose about a specific invoice.

8. Age

The service is intended for businesses and is not directed at children.

Deutsche Fassung: Datenschutz · Nutzungsbedingungen · Impressum. In case of doubt the German version prevails.