1. Data Controller
SkyCode Ltd (СКАЙКОД ООД), registration number 831524230, Sofia 1592, zh.k. Druzhba, bl. 67, apt. 8, Bulgaria
GDPR enquiries: gdpr@skycode.com
2. Data We Collect
- Registration data: company name, ЕИК/БУЛСТАТ, full name, email address.
- Document data: contents of uploaded invoices and accounting documents (names, addresses, registration numbers, VAT numbers of suppliers and recipients).
- Technical data: IP address, browser type, security log files.
- Payment data: we do not store card details — these are processed directly by PayPal/Stripe.
3. Purpose and Legal Basis for Processing
- Performance of contract (Art. 6(1)(b) GDPR): provision of the SkyInvoices service.
- Legal obligation (Art. 6(1)(c) GDPR): invoicing, accounting, tax compliance.
- Legitimate interest (Art. 6(1)(f) GDPR): platform security and fraud prevention.
- Consent (Art. 6(1)(a) GDPR): marketing emails — only if you explicitly opted in at registration.
4. AI Processing — Local Server in Bulgaria
5. Sub-processors
| Vendor | Role | Location |
|---|---|---|
| SkyCode Ltd — proprietary AI infrastructure | AI document processing | Bulgaria (data does not leave the country) |
| Stripe / PayPal | Payment processing | EU / USA (SCCs) |
| Hosting provider | Infrastructure & storage | Bulgaria / EU |
Transfers of personal data outside the EEA occur only for payment processing purposes (Stripe/PayPal), under EU Standard Contractual Clauses (SCCs). AI document processing does not involve any transfer of data outside Bulgaria.
5. Retention Periods
- Account data: until account deletion + 90 days.
- Uploaded documents and extracted invoice data:
- Starter and Professional plans: up to 3 months from the upload date. After that, original files and processed data are deleted automatically.
- Enterprise plan (on-premises installation): no limit — data is stored on the customer's own infrastructure.
- Accounting records and approved invoices: if you need to retain them longer, use the export function before the retention period expires.
- Technical log files: up to 12 months.
6. Your Rights
You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection. The right to erasure may be limited by statutory retention obligations (e.g. tax documents).
Submit requests to: gdpr@skycode.com — response within 30 days.
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): cpdp.bg.
7. Cookies
The platform uses only technically necessary cookies (session, CSRF protection). We do not use tracking or advertising cookies.
8. Changes to This Policy
We will notify you by email of any material changes. The current version is always available on this page.