Privacy Policy
Last updated: November 12, 2026
This English version is a courtesy translation. In the event of any conflict or discrepancy, the Italian version shall prevail.
This policy describes how C.I.R. 2000 snc processes the personal data of people who visit the invoicetronic.com website, create an account on the Dashboard, purchase credits, or receive our communications. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
It does not cover the data contained in the invoices you send and receive through the service: for that data you are the controller and we act as processor, under our Data Processing Agreement (DPA).
1. Controller
C.I.R. 2000 snc, via Trieste 90/A, 48122 Ravenna (RA), Italy, VAT number IT01180680397. Email: info@invoicetronic.com
Data Protection Officer (DPO): Stefano Gardini, reachable at stefano@gestionaleamica.com.
2. What data we process, for what purposes, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (stored only as a hash, not readable), phone number, company name, address, VAT number or tax code, PEC and recipient code | Creating and managing the account, providing the service, support | Performance of a contract (Art. 6(1)(b)) |
| Billing data and order history | Issuing invoices and meeting tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Payment data | Payment of purchased credits (see section 4) | Performance of a contract (Art. 6(1)(b)) |
| IP address, date and time, operation performed, and user agent, in the Dashboard and API logs | Service security, abuse prevention, troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Sending the service newsletter (new features, maintenance, changes to the service) | Legitimate interest (Art. 6(1)(f)) in informing users about the service they use, within the limits of Article 130(4) of the Italian Privacy Code (Legislative Decree 196/2003) | |
| Content of messages sent to info@invoicetronic.com | Answering requests for information and support | Pre-contractual measures and performance of a contract (Art. 6(1)(b)) |
Providing account and billing data is necessary to use the service: without it we cannot activate the account or issue invoices.
When you register, your email address is subscribed to the service newsletter. It concerns Invoicetronic only and contains no third-party communications. You can object at any time, free of charge, using the unsubscribe link included in every message or by writing to info@invoicetronic.com; unsubscribing has no effect on your account or on your use of the service.
3. How long we keep the data
- Account data: for the entire duration of the relationship. When you ask us to close your account, we delete it within 30 days of the request, except for the billing data described in the next item.
- Billing data and orders: 10 years, as required by Italian tax law (Article 2220 of the Italian Civil Code).
- Security logs: 15 days for the API event log, up to 60 days for the servers' technical logs.
- Newsletter: until you unsubscribe or close your account.
4. Who we share the data with
The data is processed by authorized staff of C.I.R. 2000 snc, who are bound by confidentiality. It may also be shared with:
- Infrastructure providers (hosting, email, and backup), based in the European Union, acting as our processors.
- Stripe, which handles credit payments as an independent controller, under its own privacy policy. Card or account details entered at payment are collected directly by Stripe and do not pass through our systems.
- Buttondown, the platform we use to send the service newsletter, acting as our processor and receiving only the email address.
- Tax and accounting advisors and public authorities, when necessary to comply with legal obligations.
The data is not disclosed to the public or sold to third parties.
5. Transfers outside the European Union
- Buttondown is based in the United States. The transfer relies on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), included in its data processing agreement.
- Stripe may transfer payment data to the United States, under the safeguards required by Chapter V of the GDPR and described in its privacy policy.
All other data remains within the European Union.
6. Cookies
The invoicetronic.com website uses no cookies, either for profiling or for analytics, and loads no resources from third-party services: fonts and scripts are served directly from our servers.
The Dashboard uses only technical cookies, required for it to work, for which no consent is needed:
| Cookie | Purpose | Duration |
|---|---|---|
.AspNetCore.Identity.Application |
Keeping you signed in after login | Until the browser is closed, or 14 days if you choose "Remember me" |
Invoicetronic.Dashboard.Session2 |
Work session and cart | Until the browser is closed; session data expires after 30 minutes of inactivity |
.AspNetCore.Culture |
Remembering the chosen language | 1 year |
.AspNetCore.Antiforgery.* |
Protecting forms against cross-site request forgery (CSRF) | Until the browser is closed |
Identity.TwoFactorUserId |
Completing login when two-factor authentication is enabled | 5 minutes |
Identity.TwoFactorRememberMe |
Not asking for the two-factor code on this device, if you choose to remember it | 14 days |
7. Your rights
At any time you can request:
- access to your data and a copy of it (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure of your data, except for data we must keep by law (Art. 17);
- restriction of processing (Art. 18);
- portability of your data in a structured, commonly used format (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, write to info@invoicetronic.com. You can unsubscribe from the newsletter at any time using the link included in every message.
You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of the country where you live or work.
8. Changes to this policy
We may update this policy to reflect changes to the service or to the law. The version in force is always published on this page, together with the date of its last update. Significant changes are communicated by email to registered users.