Privacy Policy
Effective as of August 2026 — GDPR compliant (EU 2016/679)
1. Data controller
Kortilabs is the data controller for this service.
Contact: [email protected]
2. No persistence of submitted files — technical confirmation
Facturx Validator does not store the content of the files or XML you submit for validation. Technically:
- The validation endpoints (REST API
/v1/validateand the internal endpoint used by this site,/api/validate) process the uploaded content (XML, PDF, or base64 body) entirely in memory, for the duration of a single HTTP request. - The content is never written to disk, never inserted into a database, and this service uses no database for invoice content.
- Request logging (via the
hono/loggermiddleware on the API) only records the HTTP method, path, status code and response time — never the request body or the submitted file content. - Once the HTTP response is sent, the in-memory buffers holding the file content are released; nothing is retained beyond the request/response cycle.
3. Data collected and purposes
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Invoice validation | XML/PDF content submitted (may contain third-party business data: names, addresses, amounts) | Art. 6.1.b (performance of the requested service) | None — processed in memory only, never stored |
| Technical logs | IP address, user-agent, HTTP method/path/status (never the file content) | Art. 6.1.f (legitimate interest — security, abuse prevention) | 7 days |
| Rate limiting | IP address, request count (in-memory, non-persistent) | Art. 6.1.f (legitimate interest — availability) | Rolling 60-second window |
| Audience measurement (if consented) | Cookies (_ga, _ga_*, _gid) via Google Analytics/GTM | Art. 6.1.a (consent — Google Consent Mode v2, denied by default) | 13 months max |
4. Hosting and sub-processors
The application is hosted in the European Union.
| Sub-processor | Role | Region |
|---|---|---|
| Contabo GmbH | Application hosting (VPS) | Germany (EU) |
| Google (Google Analytics / GTM) | Audience measurement — only after consent | EU/US (Standard Contractual Clauses) |
5. Cookies
This site deposits no strictly necessary cookie beyond the consent-choice cookie itself (tarteaucitron). Audience measurement cookies are deposited only after your explicit consent, collected via the cookie banner (Google Consent Mode v2 — denied by default). You can change your choice at any time via "Manage cookies" in the footer.
6. Your rights
Under the GDPR, you have the right to access, rectify, delete, restrict, and port your personal data, as well as the right to object. Since no invoice content is ever stored, these rights mainly apply to the technical logs (IP, user-agent) and to cookie consent. Requests can be sent to [email protected]. You also have the right to lodge a complaint with the CNIL (France) or your local supervisory authority.