1. Who we are
Kreyo (kreyo.io) is a document and invoicing API platform operated as an individual business (autónomo) based in Spain. We provide four API products: Kreyo PDF (document generation), Kreyo Extract (AI-powered invoice data extraction), Kreyo FacturaE (Spanish electronic invoicing with XAdES signing and FACe submission), and Kreyo VeriFactu (real-time AEAT invoice registration with SHA-256 chaining and XMLDSig signing).
For any privacy-related questions, contact us at: privacy@kreyo.io
2. What data we collect and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address | Account creation, delivering your API key, service communications | Performance of contract (6.1.b) |
| API usage counts | Enforcing plan limits, showing usage statistics in your account | Performance of contract (6.1.b) |
| IP address | Rate limiting on public demo endpoints (3 requests/day) | Legitimate interest (6.1.f) — preventing abuse |
| Digital certificates (.pfx) | Signing FacturaE XML and VeriFactu registros on your behalf (stored encrypted, AES-256) | Performance of contract (6.1.b) |
| Billing information (future) | Processing payments when paid plans are active | Performance of contract (6.1.b) |
We do not use cookies for tracking. Our analytics (Cloudflare Web Analytics) are cookieless and do not transmit personally identifiable data.
Kreyo PDF does not collect any additional personal data. HTML, Markdown, or template content you submit for PDF rendering is processed entirely in memory and is not stored on our servers.
3. Documents you submit
Kreyo PDF: Documents (HTML, Markdown, templates) submitted for PDF generation are processed in memory by Playwright and returned in the HTTP response. We do not store, log, or cache the content you submit or the PDFs we generate. Once the response is delivered, all data is discarded.
Kreyo Extract: Files you send (invoices, images) are processed in memory to extract data and are not stored permanently. Extracted results are cached in Redis for 7 days keyed by a SHA-256 hash of the file content (not the file itself), to avoid redundant processing. The cache holds structured JSON output, not the original document.
Digital certificates (.pfx) uploaded for FacturaE and VeriFactu signing are stored encrypted (AES-256) and used only to sign your documents. They are never shared with third parties.
4. Who we share data with
| Processor | Purpose | Location |
|---|---|---|
| Fly.io | Cloud infrastructure hosting the API and database | EU (Paris — GDPR compliant) |
| Resend | Transactional email delivery (API key on registration) | EU |
| Upstash | Redis cache (rate limits, extraction result cache) | EU |
| Groq | AI inference for invoice extraction (document images sent for processing) | USA — covered by Groq's DPA |
| AEAT | VeriFactu registro submission and FacturaE FACe submission (via SOAP/HTTPS with your certificate) | Spain |
| Stripe (future) | Payment processing when paid plans are active | EU |
| Cloudflare | Cookieless analytics and DNS/CDN | Global — no personal data transmitted |
We do not sell your data. We do not share it with any party other than those listed above.
5. Data retention
- Email and API key: retained while your account is active, and deleted within 30 days of a deletion request.
- Usage counts: retained for 13 months (current + 12 rolling months) then aggregated or deleted.
- Extraction cache: Redis entries expire automatically after 7 days.
- PDFs generated by Kreyo PDF: not stored at all — returned in the HTTP response and immediately discarded.
- IP addresses (rate limiting): expire automatically every 24 hours.
- Digital certificates: retained while your account is active, deleted within 30 days of account closure or deletion request.
- VeriFactu registros and FacturaE submissions: retained for the legally required period (typically 4 years for tax records).
6. Your rights under GDPR
As a data subject you have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure ("right to be forgotten")
- Portability of your data in a machine-readable format
- Object to processing based on legitimate interest
- Lodge a complaint with the Spanish data protection authority (AEPD)
To exercise any of these rights, email privacy@kreyo.io. We will respond within 30 days.
7. Security
All data is transmitted over HTTPS/TLS. Our database (PostgreSQL) and cache (Redis) are hosted within Fly.io's private network and not exposed to the public internet. API keys are stored as SHA-256 hashes in the database. Digital certificates are encrypted at rest with AES-256. VeriFactu and FacturaE submissions to AEAT use mutual TLS with your own certificate.
8. Changes to this policy
If we make material changes, we will update the date at the top of this page. Continued use of Kreyo after changes constitutes acceptance.