Privacy Policy

Last updated 2026-10-25. This policy explains what personal data we process when you use the EN16931 / XRechnung / Peppol BIS 3 Validator, why, and what your rights are under the EU General Data Protection Regulation (GDPR).

1. Controller

Niko yhtiöt Oy
Business ID (Y-tunnus): 3636929-9
VAT ID: FI36369299
Registered office: Helsinki, Finland
Postal address: Aleksis Kiven katu 22, 00500 Helsinki, Finland
E-mail: nyo-agentti@nikoy.fi

2. What we process and why

Data	Purpose and legal basis	Retention
Invoice files you submit (UBL/CII XML, or a ZUGFeRD / Factur-X PDF; from a PDF only the embedded invoice XML is read, in memory). They typically contain business names, addresses, identifiers and may contain names and contact details of individuals.	To produce the validation result or the repaired file you asked for. The file is held in memory only for the duration of the request. Free use: legitimate interest in providing the service you requested (Art. 6(1)(f)). Paid plans: performance of the contract (Art. 6(1)(b)); where you process your customers' data, we act as your processor under a data processing agreement (Art. 28).	Not stored. Discarded when the response has been sent.
PDF files you submit for the PDF/UA check. They may contain any personal data that is in the document.	To produce the veraPDF result and the fixed file you asked for (Art. 6(1)(f) for the free check, Art. 6(1)(b) for the purchased fix). The file is written to a temporary file only while veraPDF reads it, in the same isolated service. If you give a web address instead of a file, the service downloads the PDF once from that address (the address is not logged).	Not stored. The temporary file is deleted when the result has been sent.
Request log: timestamp, file size, accepted/rejected, duration, HTTP status, and a flag when the file is one of our own published test or sample files (checked against their checksums in memory; no checksum of your file is logged). No file content, no file name, no rule messages.	Operating the service, capacity planning and abuse prevention (Art. 6(1)(f)).	Up to 90 days.
Page view counts: the page path, the domain of the site that linked to it (for example google.com) whether the browser identifies itself as a bot and, if the address contained one, the `?ref=` code of a partner or of one of our e-mail mailings (one code per mailing, not per recipient). No cookies, no IP address, no device or user identifier.	Measuring which pages are useful and where visitors come from (Art. 6(1)(f)). The data does not identify anyone.	Up to 90 days.
Infrastructure logs kept by our hosting provider (Render), which may include your IP address and user agent.	Security and reliability of the hosting platform (Art. 6(1)(f)).	According to the hosting provider's retention policy.
Subscription and billing data for paid plans: name, e-mail address, company name, country, VAT ID, plan, invoice identifiers and the payer details of your bank transfer. For card payments: the Stripe payment and customer identifiers and the last digits of the card shown to us by Stripe; we never see or store full card numbers.	Providing the subscription and support, and complying with accounting and tax law (Art. 6(1)(b) and (c)).	For the duration of the subscription, then as required by the Finnish Accounting Act (6 years from the end of the financial year).
API keys and usage counters for paid API plans.	Authentication and quota enforcement (Art. 6(1)(b)).	Until the subscription ends plus 30 days.
Invoice orders for the PDF/UA fix (order form): organisation, invoicing address, e-mail, web addresses of the PDFs, purchase order number, VAT ID or registration number and notes, kept as a customer record with our payment provider Stripe.	Delivering and invoicing the order, and complying with accounting law (Art. 6(1)(b) and (c)).	Until the order is delivered and paid, then as required by the Finnish Accounting Act (6 years from the end of the financial year).
Partner records for the partner programme: company name, country, VAT ID or company registration number, website, contact e-mail and the partner code; the code is also stored with the payments it brought.	Running the partner programme: calculating, reporting and paying commissions, and complying with accounting law (Art. 6(1)(b) and (c)).	For the duration of the arrangement, then as required by the Finnish Accounting Act (6 years from the end of the financial year).
Correspondence you send us.	Answering you (Art. 6(1)(f)).	Up to 2 years.

Google Sheets add-on (JSON/XML Tools for Sheets)

The add-on runs as Google Apps Script inside your Google account. It asks for three permissions and uses them only as follows:

See, edit, create and delete only the spreadsheet you open it in (spreadsheets.currentonly): to read the range you select (for export and schema validation) and to write imported tables, the "Validation" sheet and highlights of failing cells.
Display and run third-party web content in prompts and sidebars (script.container.ui): to show the add-on's sidebar and dialogs.
Connect to an external service (script.external_request): only to download the https address you type in for an import. Google's servers fetch that address directly; we do not see it or the data.

Spreadsheet contents, imported data and schemas are processed only inside Google's Apps Script environment in your account. They are not sent to Niko yhtiöt Oy or to anyone else, are not stored by us, are not read by people, and are not used for advertising, profiling or training AI models. The license key you paste on the License tab is stored in your own user properties in Google Apps Script and checked inside the add-on; checking it sends nothing to us. If you buy Pro, the purchase happens on our website through Stripe (see section 4); the add-on itself does not transmit your Google account details to us.

If the add-on hits an error, Google records the error message and stack trace in the Google Cloud project that runs the add-on (Cloud Logging, default retention 30 days). We look at these only to fix bugs. An error message can contain a short fragment of the input that caused it, for example the position of invalid JSON or an unsupported schema pattern.

JSON/XML Tools for Sheets's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To stop all access, remove the add-on in Google Sheets (Extensions → Add-ons → Manage add-ons) or revoke it in your Google Account under Security → Third-party apps with account access. The add-on is not made, endorsed or sponsored by Google.

3. Cookies and tracking

We set no cookies and run no third-party analytics or advertising scripts. Each page sends one anonymous page-view count to our own server (see section 2: path and referring domain only, nothing stored on your device). When you arrive through a partner link or a link in one of our e-mails (an address with ?ref=), the code — which identifies the partner or the mailing, not you — is counted with the page view and the check, and stored with your payment for commission accounting; no cookies or browser storage are used for this. The card checkout page is provided by Stripe and sets the cookies Stripe needs for payment and fraud prevention (Stripe privacy policy: stripe.com/privacy).

4. Recipients and processors

Our bank receives the payments you make by bank transfer and processes the payer details as an independent controller under banking law.
Stripe (Stripe Payments Europe, Ltd., Ireland) processes card payments for the Pilot, the Pro license of our Google Sheets add-on and single-file repairs (for these, the file name and SHA-256 checksum of your file are stored with the payment so that the download can recognise the file; the file itself is not stored) and PDF/UA fixes (for these, the file name, the SHA-256 checksums of the original and the fixed file, the chosen document language and the before/after rule counts are stored with the payment, and, if you checked the file by its web address, that address, so the paid download can fetch the file again; the file itself is not stored; for a self-service batch only the first 24 characters of each file's SHA-256 checksum, the number of files and the document language are stored, no file names). Stripe receives your e-mail, VAT ID, company name and card details and acts as an independent controller for payment processing and fraud prevention.
Files sent by e-mail for the PDF/UA batch triage service and the alternative-text service stay in our mailbox only until the work is delivered and are deleted within 30 days of delivery; they are not shared with anyone, except that for the alternative-text service the images are shown to the AI model provider that runs our agent (Anthropic PBC, USA) to draft the descriptions.
Our e-mail hosting provider processes the e-mails, invoices and files you send us or we send you, as our processor.
Render (Render Services, Inc., United States) hosts the service. We deploy in Render's Frankfurt (EU) region; personal data is processed in the EU. Render acts as our processor under its data processing agreement, which includes the EU Standard Contractual Clauses for any support access from outside the EU.
The static rule reference pages may be served by GitHub Pages (GitHub, Inc.) or Cloudflare Pages (Cloudflare, Inc.); the provider sees your IP address to deliver the page and keeps its own infrastructure logs.

We do not sell personal data and do not share it with anyone else, except where required by law.

5. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability where applicable. Because we do not store submitted files, there is normally nothing to access or erase about them; billing data requests are answered within one month. Contact us using the details in section 1. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the supervisory authority of your residence.

6. Security

All traffic is encrypted (HTTPS). Invoice files are processed in memory in an isolated service and are never written to disk by our application; PDF files for the PDF/UA check are written to a temporary file only while the validator reads them and deleted right after. Access to the hosting account is restricted to the operator.

7. Changes

We will post changes to this policy on this page with a new date. Material changes affecting subscribers are also announced by e-mail.