Privacy Policy

Last updated: 13 November 2026

This policy explains what personal data the InvoiceX10 sandbox handles, why, who receives it, how long it is kept and what rights you have. It covers the InvoiceX10 API and the InvoiceX10 Panel at https://invoicex10.deeprunner.ai. If anything is unclear, email us at contact@deeprunner.ai.

Who we are

InvoiceX10 is provided by DeepRunner AI Hellas Single Member S.A. ("DeepRunner", "we", "us"), registered at 44 Mitropoleos Street, Aigio, Achaia 25100, Greece, with a branch at Char. Trikoupi 62, Athens 14562, Greece. For every privacy question, contact contact@deeprunner.ai.

What the service is

InvoiceX10 is an e-invoicing API, with a web Panel, that lets a business file invoices and other documents with myDATA, the electronic books platform of the Independent Authority for Public Revenue (AADE), and get back the MARK, PDF and XML copies. A business (the "Customer") signs in to the Panel with its API key; there are no user accounts, passwords or email sign-in.

This is the sandbox service, meant for testing. Documents filed with AADE test credentials go to AADE's myDATA test environment. If you use your AADE production credentials, the documents you file are real tax documents. You can delete your account from the sandbox by emailing contact@deeprunner.ai; once it is deleted, we keep no information about it.

Data controller and our two roles

We act in two roles:

• Controller. For the data we need to run and protect the service itself (the Customer's tenant and connection details, sign-in and security data, and logs), DeepRunner AI Hellas Single Member S.A. is the controller.
• Processor. For the content of the documents a Customer files (for example, the name, VAT number and address of the Customer's own customers or other counterparts), the Customer is the controller and we process that data on the Customer's instructions, only to file the documents and show them back to the Customer.

What we collect

Tenant and connection data

• The Customer's business name and VAT number (AFM), the environment (test) and the state of its connection to AADE.
• The Customer's myDATA test user name and subscription key, stored encrypted. They are used only to file with AADE on the Customer's behalf and are never shown back through the API or the Panel.
• The API key. We store only a hash of the key and its first characters, never the full key.

Document data

• The content of each document the Customer files or validates: document type, series and number, dates, lines, amounts, and the counterpart's name, VAT number, country and address where given. For delivery notes, the movement details, such as the dispatch date and vehicle number.
• What AADE returns: the MARK, the unique identifier and the filed XML, and any AADE error codes.
• Each filed document has a digital copy link with an unguessable token. Anyone who has the link can open the document's page, PDF and XML without signing in, so share it only with people who should see the document.

Panel sign-in and security data

• When you sign in, the key is sent once to the Panel server and kept in server memory for the session only. It is never sent back to your browser and never written to logs.
• Your IP address, used to limit sign-in attempts and sent to Cloudflare for the Turnstile check.
• Technical request data such as IP address, time, path and response, recorded by our web server and the API to operate and secure the service. Logs record only a short prefix of the key, never the full key.

Why we use it, and our legal bases

• To provide the service (filing documents with AADE's myDATA, showing them in the Panel, returning PDF and XML copies): performance of our agreement with the Customer, Article 6(1)(b) GDPR, and, for document content, the Customer's instructions as controller.
• To secure the service (Turnstile, sign-in rate limits, logs, abuse prevention): our legitimate interest in keeping the service and its users safe, Article 6(1)(f) GDPR. You may object to this processing, as described below.
• To meet legal obligations, where a law requires us to keep or disclose data: Article 6(1)(c) GDPR.

We do not use the data for marketing, we do not sell it, we do not share it with advertisers, and we do not use it to train any model.

Cookies

The Panel uses only strictly necessary cookies:

• Session cookie: keeps you signed in. It holds a random session identifier, not your key. The session ends after 30 minutes without activity, after 8 hours in total, or when you sign out.
• Security (CSRF) cookie: protects the sign-in form against cross-site request forgery. It is removed once you sign in.

We use no analytics, advertising or tracking cookies. The sign-in page loads Cloudflare Turnstile, which processes data from your browser to tell people from bots, as described under "Who receives your data".

Who receives your data

• Independent Authority for Public Revenue (AADE), Greece: receives every document filed through the sandbox, in the myDATA environment that matches the credentials used, together with the Customer's VAT number and myDATA user. AADE receives the data as the public authority that runs myDATA, not as our processor, and keeps its own copies under its own rules. Those copies are outside our control.
• Hetzner Online GmbH: hosts the servers that run InvoiceX10, in Nuremberg, Germany (EU). Hetzner acts as our processor.
• Cloudflare, Inc.: provides DNS for our domain and the Turnstile check on Panel sign-in. For Turnstile, Cloudflare receives your IP address and signals from your browser. Cloudflare may process this data outside the EU, under the safeguards in Cloudflare's own data processing terms.
• Authorities, where a law, court order or other binding request requires it.

If we add or change a processor, we will update this page before the change takes effect.

Where your data lives

The data we hold is stored on servers in Germany (EU). Documents filed with myDATA are held by AADE in Greece. The only transfer outside the EU that we are aware of is the Turnstile check described above.

How long we keep your data

• Your account data, including tenant and connection data, stored credentials, documents, PDF and XML copies: kept until you delete your account. Once your account is deleted, we keep no information about it.
• Panel sessions and the key in memory: until you sign out, after 30 minutes without activity or after 8 hours, whichever comes first. A restart of the Panel ends every session.
• Sign-in rate-limit data: in memory, for at most a few minutes, or 15 minutes after a block.
• Duplicate-protection records (idempotency records): 72 hours.
• AADE: AADE keeps its own copies of every document filed with it. We cannot delete them, and their retention is set by AADE.

You can delete your account from the sandbox at any time by emailing contact@deeprunner.ai.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• Access the personal data we hold about you.
• Rectification of data that is wrong or incomplete.
• Erasure of your data.
• Restriction of processing in the cases the GDPR provides.
• Portability: to receive data you gave us in a structured, commonly used, machine-readable form, and to have it sent to another controller.
• Objection to processing based on our legitimate interests.
• Complaint to a supervisory authority. In Greece this is the Hellenic Data Protection Authority, Kifisias 1-3, 11523 Athens, www.dpa.gr.

To exercise any of these rights, email contact@deeprunner.ai. We reply within one month, as the GDPR requires. These rights do not reach the copies held by AADE; for those, contact AADE directly.

If your data appears on a document that one of our Customers filed (for example, you are that Customer's client), the Customer is the controller of that data. Please contact the Customer first; we will help it respond.

Security

• All traffic to the Panel and the API is encrypted with TLS.
• myDATA credentials are stored encrypted, and API keys are stored only as hashes.
• Panel sign-in is protected by Cloudflare Turnstile and by a limit on attempts per IP address. Session cookies are Secure, HttpOnly and SameSite=Strict, and every change request is checked against cross-site request forgery.
• Each Customer sees only its own tenant's documents.
• The servers accept only the connections they need, and administrative access is restricted.

If a personal data breach is likely to put your rights and freedoms at risk, we will tell you without undue delay, and we will notify the Hellenic Data Protection Authority within 72 hours of becoming aware of it, where Article 33 GDPR requires. If you find a vulnerability, please email contact@deeprunner.ai.

Children

InvoiceX10 is a service for businesses. It is not meant for children, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. When we do, we change the date at the top of this page. If a change is material, we will tell Customers before it takes effect.

Governing law and courts

This policy is governed by the laws of Greece. The courts of Athens have exclusive jurisdiction over any dispute arising from it, without prejudice to your right to complain to the Hellenic Data Protection Authority or to any other mandatory right you have under the law.

Contact

Email: contact@deeprunner.ai

Post: DeepRunner AI Hellas Single Member S.A., 44 Mitropoleos Street, Aigio, Achaia 25100, Greece (branch: Char. Trikoupi 62, Athens 14562, Greece).