RhinvoiceLegal · As of October 2026
Privacy notice
Rhinvoice processes as little personal data as possible. This website sets no cookies and does not measure visits. This notice says which data are processed nevertheless, what for, and which rights you have.
1. Controller
Responsible for processing personal data on rhinvoice.com, in the documentation and in the public demos is:
webberz — Özdemir Kadir
Wegenstrasse 2
9436 Balgach
Switzerland
hello@rhinvoice.com
For questions about privacy or to exercise your rights, an informal message to this address is enough.
2. What this notice covers, and what not
It covers the website rhinvoice.com with the documentation at rhinvoice.com/docs, the public demos at ch.rhinvoice.com, de.rhinvoice.com and at.rhinvoice.com, and e-mails to addresses at rhinvoice.com.
It does not cover installations of Rhinvoice. Whoever installs Rhinvoice runs it on their own machines and is responsible for the data in it. An installation sends no data to webberz: it contains no statistics, no outgoing error reports and no update check. It only connects to the services its operator sets up, such as a mail server or a backup target.
3. Applicable law
We follow the Swiss Federal Act on Data Protection (FADP) and its ordinance. Where the General Data Protection Regulation of the European Union (GDPR) applies because we address people in the EEA, we meet its requirements as well.
We have not appointed a representative in the European Union under Art. 27 GDPR. We process personal data from the EEA only occasionally, no special categories of data on a large scale, and without a high risk to the people concerned, so the exception of Art. 27(2)(a) GDPR applies.
4. Which data we process
4.1 Website and documentation
rhinvoice.com and the documentation are served by GitHub Pages, a service of GitHub, Inc. in the USA. When you open a page, your browser transmits technically necessary details such as your IP address, the time, the address requested and your browser's identification. GitHub processes them to deliver the pages and to protect them against attacks. We do not receive these logs.
The website sets no cookies and uses no analytics, no advertising and no embedded content of third parties. All fonts come from our own server. The documentation's search runs entirely in your browser; search terms are sent nowhere.
4.2 Public demos
The demos run on a server of Hetzner Online GmbH in Germany. For every request the server keeps an access log with IP address, time, address requested and status. We need it to keep the demos running, to find errors and to fend off abuse. We do not use it for anything else and do not combine it with other data. To slow down too many logins and changes from one address, the server counts them for one minute in memory.
After logging in, the demo sets a technically necessary cookie (rhinvoice_session) that keeps you logged in. It ends when you log out, at the latest with the next reset of the demo.
The demos are a shared test environment: all visitors log in with the same account and see the same data. Whatever you enter there is visible to other visitors until the demo is reset, which happens every hour. Do not enter real personal data there. The demos send no e-mail and accept no files.
4.3 E-mail
When you write to an address at rhinvoice.com, we process the details you give and the content of your message to answer you. The e-mails go through our own mail server, which is also hosted by Hetzner Online GmbH in Germany. Unencrypted e-mail is not a secure channel; please do not send sensitive personal data this way.
4.4 GitHub
The source code, bug reports and discussions of Rhinvoice are on GitHub. When you open an issue or join a discussion there, GitHub's privacy statement applies, and your contributions are public.
5. Purposes and legal bases
| Processing | Purpose | Basis under the GDPR |
|---|---|---|
| Serving the website and documentation | Showing the pages, protection against attacks | Art. 6(1)(f), legitimate interest in secure operation |
| Access logs and request limits of the demos | Reliable operation, finding errors, fending off abuse | Art. 6(1)(f) |
| Login cookie of the demos | Staying logged in | Art. 6(1)(f); technically necessary, so without consent |
| Answering your request | Art. 6(1)(b), otherwise (f) |
Under the FADP we base this processing on overriding interests in secure operation and on answering your request. We ask for no consent because no processing requires it, which is also why there is no cookie dialog.
6. Processors and disclosure to third parties
We do not pass personal data on to third parties to sell them or for advertising. For operation we use these providers:
| Service | Provider | Location |
|---|---|---|
| Serving the website and documentation | GitHub, Inc. (GitHub Pages) | USA |
| Server of the demos | Hetzner Online GmbH, Gunzenhausen | Germany (EU/EEA) |
| Receiving and sending e-mail | own mail server at Hetzner Online GmbH | Germany (EU/EEA) |
7. Transfers abroad
We process the demos and e-mails in the EU. When you open the website, technical details reach GitHub in the USA. GitHub relies on the EU-US Data Privacy Framework and its Swiss extension and on the standard contractual clauses of the European Commission, as described in GitHub's privacy statement.
8. How long we keep data
- Access logs of the demos: overwritten automatically when they reach a fixed size, and deleted with every update of the demos. The request count expires after one minute.
- Entries in the demos: at most one hour, until the next reset.
- E-mails: as long as needed to deal with them and with any follow-up question; if an order results, the statutory retention period of ten years applies.
9. Security
The website, the documentation and the demos are served over HTTPS only. The demo servers are reachable only on the ports they need, protected by firewalls, and accessed with keys only. Complete protection of transmissions over the internet cannot be guaranteed.
10. Your rights
Within the applicable law you have in particular the right to access, rectification, erasure, restriction of processing, receiving or transferring your data, and to object to processing we base on overriding interests. A message to hello@rhinvoice.com is enough. In some cases we have to verify your identity before we answer.
You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EEA the data protection authority where you live.
11. Changes
We adapt this notice when our processing of personal data or the law changes. The version published here applies.