Privacy notice

1. Scope

This notice applies to the Temlavo website, account console, Invoice Extraction API, TypeScript SDK and CLI, and official integration examples.

When a customer submits invoice or related document content for processing, Temlavo generally processes that content to provide the service on the customer's instructions. Customers remain responsible for deciding whether they are permitted to submit that content and for their own downstream use of the results.

2. Information we process

Account and contact information

We process information needed to create and secure an account, authenticate users, provide support, and communicate about the service. Authentication is provided through Clerk.

Billing information

Stripe handles payment-method and payment-processing information. Temlavo receives and stores the identifiers, subscription state, usage records, invoices or billing status needed to administer plans and reconcile usage. Temlavo does not need to store complete payment-card numbers.

API and operational information

We process API-key authentication state, request and document identifiers, processing state, timestamps, retry and idempotency records, usage events, security events, bounded provider request identifiers, and privacy-safe operational telemetry needed to run, secure, bill, debug, and maintain the service.

Invoice and document content

Submitted source files may contain personal information about vendors, customers, employees, sole traders, or other people. Processing may also create OCR/layout intermediates and structured extraction results. Temlavo treats this content separately from ordinary operational telemetry.

Public playground demo

You can process one of your own invoices in the public playground without an account. Only upload invoices you are allowed to share. The file is processed through the same providers as any other document (section 5) and deleted once its result is shown. To limit demo use, a signed browser cookie records how many invoices this browser processed that day and its demo documents, and requests are counted by a keyed hash of your IP address (its network prefix for IPv6); the raw address is not stored. Vercel BotID checks the processing request for automated activity.

Public website analytics

We use Vercel Web Analytics on public pages to measure visits and six actions: trial/signup, playground entry, a processed demo invoice (its outcome only, never its content), plan choice, integration guide choice, and the official n8n template link. It uses no cookies and measures aggregate page views, approximate location, device and browser information, validated marketing campaign labels, and eligible referring sites. Vercel's visitor estimates reset daily; they are not identified Temlavo accounts.

With your permission, measurement tags from our advertising partners run on our website so we can tell whether our ads led to a sign-up. These tags may set their own cookies, including an ad-click identifier from the link you followed. When you create an account, we tell them that a sign-up occurred, identified only by a random event identifier. We do not send your name, email address, account details, API keys or invoice content to them.

Separately from that permission, Temlavo keeps a limited first-party record of how a new account found us so we can understand product and subscription outcomes. We record that an account was created and may add one coarse first-entry source: validated source, medium, campaign and content labels, a coarse referring domain, and an eligible public landing path. We do not ask you to report a source and do not store advertising click identifiers. The first-entry context lasts 30 minutes in this tab and is used only to label a newly created account; it is not sent to analytics or advertising partners. Source labels are kept for up to 365 days from account creation.

Page URLs include only validated marketing parameters actually present on that page. Other queries and fragments are removed. We skip Web Analytics when native referrers could contain sensitive paths or parameters; first-party source labelling does not depend on Web Analytics. Sign-in, sign-up and private account pages do not mount Web Analytics. We do not send invoice content, filenames, customer metadata, API keys, or account identifiers to it.

Allow or decline optional advertising measurement through Analytics preferences in Account settings. Your choice is stored in this browser for 180 days. Withdrawal stops advertising measurement from this browser immediately and removes advertising measurement cookies set on our site; it does not change Vercel Web Analytics or Temlavo's first-party account source record. Closing your account erases that record. This optional permission does not cover invoice-content analytics.

Source labelling is one first-entry browser observation, added during a new account's first 30 minutes. It is not cross-device tracking or a verified history of how you found us. Missing or expired context stays unattributed. Signing out clears pending source context. Erasing a source changes future aggregate reports; it cannot remove copies of reports previously exported by the service operator.

Accounting-entity discovery information

When you supply an accounting-entity ID, processing that ends in completed or needs_review records the raw ID and first/last-seen timestamps in a separate account-scoped index used to find entities in account usage views. These customer-supplied identifiers are not anonymous data or the pseudonymous attribution used in financial records.

3. How we use information

We use information only as needed to:

• provide, secure, and operate the service;
• authenticate users and API requests;
• process documents and return structured results;
• detect duplicate submissions and preserve idempotency;
• measure plan usage and administer billing;
• prevent abuse and control provider spend;
• maintain, troubleshoot, and improve service reliability;
• understand aggregate public visits and actions, measure with your permission whether our advertising led to sign-ups, and understand coarse first-party acquisition outcomes;
• respond to support, privacy, and security requests; and
• meet applicable legal, accounting, and security obligations.

Temlavo does not use invoice content for advertising and does not intentionally place invoice values, raw OCR text, source files, prompts, or model responses into normal application logs.

4. Legal bases for Temlavo's own processing

Where Temlavo acts as a controller and EU/EEA data-protection law applies, the legal basis depends on the purpose:

• Contract and steps requested before a contract: account access, service delivery, plan administration, support, and billing functions needed to provide the service you request.
• Legitimate interests: securing the service, preventing abuse and fraud, maintaining reliability, diagnosing content-free operational failures, improving service operation, measuring aggregate public website visits with cookie-free analytics, and measuring which channels lead to new accounts with limited first-party source labels, where those interests are not overridden by individual rights and freedoms.
• Legal obligations: records or processing required for tax, accounting, legal claims, regulatory requests, or other obligations that apply to Temlavo.
• Consent: where Temlavo specifically asks for consent for optional advertising measurement. Consent is not the basis for core invoice-processing needed to provide the requested service.

For customer personal data processed on a customer's behalf, the customer determines the applicable lawful basis and Temlavo processes that data on the customer's documented instructions.

5. Invoice and document data

Source files are uploaded directly to private object storage using short-lived signed upload authorization. The public API server does not proxy the source bytes.

Temlavo uses document-processing providers to read the submitted file and extract structured invoice data. Mistral is used for OCR and OpenRouter is used to reach eligible AI model endpoints for structured extraction.

The API may return extracted invoice values, line items, consistency checks, duplicate signals, review outcomes, and processing metadata. A completed result means the declared checks found no blocking issue under the document's policy; it is not a certification that every extracted value is correct and it does not authorize payment.

6. Service providers

Temlavo relies on the service providers listed below to operate the product.

For personal data processed on a customer's behalf, the Data Processing Addendum (DPA) sets out processing terms and its contractual subprocessor schedule. The table above also covers providers used for account administration, payments, and service operations.

Apps you connect

You can connect an AI assistant or another app, such as Claude or ChatGPT, to your Temlavo account through our MCP server. When you sign in and approve the connection, the app can, depending on the permissions you approve, submit invoices from your account, read their extraction results and see your page usage. Invoices it submits are processed like any other submission (section 5) and use your page allowance. Some apps, such as ChatGPT, also receive your account's email address and name.

A connected app is not a Temlavo service provider. It is a separate service you choose to share information with, and its own terms and privacy notice govern what it does with the invoice content, results and account details it receives. You can disconnect an app at any time in its settings. Access tokens Temlavo issues to connected apps expire within 24 hours.

7. Retention and deletion

Source files and processing intermediates

A 24-hour default expiry applies from each stored object's creation for confirmed source files and processing intermediates. Unconfirmed uploads expire 24 hours after document creation. Physical cleanup can follow expiry and may wait for processing recovery or storage-deletion retries.

Structured document results

Seven days from completion by default. API access to the result ends at the authoritative result-expiry timestamp exposed by the document resource; physical cleanup can follow.

Idempotency records

Retained for seven days to preserve safe replay behavior.

Operational records

Generally retained for approximately 90 days where needed for service operation, security, and reliability.

Pseudonymous duplicate fingerprints

Submissions ending in completed or needs_review with duplicate detection enabled retain tenant-keyed fingerprints, account/document references, scope and completion time without automatic expiry. These are not plaintext invoice identifiers or anonymous data. Explicit document deletion or account closure removes the associated entries. Submissions with duplicate detection disabled add no entries.

Billing and financial records

Retained for as long as required for billing integrity, accounting, tax, fraud prevention, dispute handling, and other applicable legal obligations.

Public playground demo

The file and result are deleted once the result is shown. If you leave before processing finishes, the source-file and result windows above apply. The demo cookie expires after two days, and the hashed demo counts are deleted within two days.

Accounting-entity discovery IDs

Raw customer-supplied accounting-entity IDs and their first/last-seen timestamps are retained for the active account lifetime. They survive individual document deletion and have no automatic expiry. Removal is part of coordinated account closure, separate from document deletion and financial-record retention.

Customers can explicitly delete a document through the API. Deletion ends document API access and clears stored results and document fields. Storage deletion is attempted immediately and retried if needed. The separate accounting-entity discovery index remains, as do required billing, security, and operational records under their respective retention rules.

Document deletion and subscription cancellation do not close an account. To request account closure or return/deletion of retained personal data, contact privacy@temlavo.com. There is no self-service account-closure or export workflow. Requests require separate coordination of content, keys, billing obligations, identity, and retained records.

Vercel may retain request metadata (such as URLs, query parameters, browser and referrer information), callback destinations, and related error logs under its separate retention policy. Completing a callback or deleting a document removes Temlavo's stored callback URL and event payload, but does not delete Vercel's platform logs.

Copies created by a customer's own systems, including n8n execution history, callbacks, logs, CI output, or downstream databases, remain under that customer's control and retention policy.

8. International processing

Temlavo is operated from Cyprus and uses service providers that may process information in other countries. For information about provider locations and applicable transfer arrangements, contact privacy@temlavo.com.

9. Your choices and rights

Depending on where you live and the context in which information is processed, you may have rights to request access, correction, deletion, restriction, portability, or objection, to withdraw consent where processing depends on consent, and to complain to a relevant data-protection authority.

Temlavo's service returns extraction and review information to the customer; Temlavo does not itself decide whether an invoice is paid, posted, accepted, rejected, or otherwise given a legal or similarly significant business effect.

If Temlavo processes personal data on behalf of a customer, the customer may be the appropriate first contact for a request about that invoice or document. Temlavo will support customers with processor obligations as described in the DPA.

10. Security

Temlavo uses account-scoped authorization, private object storage, short-lived signed upload authorization, encryption for protected application state, bounded retention, content-minimized observability, abuse controls, and operational monitoring.

No internet service can guarantee absolute security. Security issues can be reported to security@temlavo.com. See the Security & retention page for the current technical boundaries.

11. Changes to this notice

We may update this notice as the product, legal requirements, or service-provider arrangements change. The current version will be posted here with its updated date. Material changes will be communicated when required.

12. Contact