Privacy Policy

Last updated: August 24, 2026

1. Who we are

Zugfy is an early-stage project building a REST API for generating and validating EU e-invoices (ZUGFeRD, Factur-X, XRechnung). This policy covers zugfy.dev and, once live, the Zugfy API.

Contact: hello@zugfy.dev

2. What we collect today (early access)

Right now, the only data we collect is what you submit through the "Get API key" form:

This form is processed by Formspree, our form-handling provider, who receives and forwards submissions to us. We don't use tracking pixels, analytics cookies, or ad scripts on this page — only what's needed to run the site and the form.

3. What happens once the API is live

When you use the Zugfy API to generate or validate an invoice, the data you send (seller, buyer, line items) is processed in memory to produce the output file and is not written to a database or disk. We keep request logs (timestamp, status code, response time) for debugging and abuse prevention — never the invoice content itself.

Account and billing data (email, API key, usage counts for rate-limiting, and payment details handled by our payment processor) will be described in an updated version of this policy before the paid API launches.

4. Legal basis (GDPR)

We process your email and form data on the basis of consent (you submitting the form) and, for logs, our legitimate interest in keeping the service secure and functioning. You can withdraw consent at any time by asking us to delete your data.

5. Data sharing

We don't sell or rent your data. We share it only with the processors needed to run the service:

• Formspree — receives and stores waitlist form submissions
• Cloudflare — hosts this website and handles DNS/email routing

We don't share data with advertisers, data brokers, or anyone else.

6. Your rights

Under GDPR, you can ask us to:

• Show you what data we hold about you
• Correct inaccurate data
• Delete your data entirely
• Export your data in a portable format

Email hello@zugfy.dev and we'll handle it within 30 days. If you're unhappy with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Cookies

This site uses only strictly necessary cookies (if any, set by Cloudflare for security). No advertising or analytics cookies are used.

8. Changes to this policy

As the API moves from early access to a paid product, this policy will be updated to reflect payment processing and account management. We'll update the date at the top of this page when that happens.