Privacy Policy

1. Who we are

Space Invoices Inc., 8 The Green, Suite B, Dover, Delaware 19901, United States ("Apollo", "we", "us" or "our"), provides Apollo in the United States and is the controller of the personal data described in this Privacy Policy, except where section 2 says that we act as a processor.

This Privacy Policy explains how we process personal data when you visit getapollo.io, create an Apollo account, use the Apollo web app, mobile apps or API (the "Service"), subscribe to a plan, or contact us. It applies together with our Terms of Service. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection law.

For any question about privacy or to exercise your rights, write to support@getapollo.io.

2. Our role: controller and processor

We are the controller for the personal data of website visitors, people who contact us, account owners and the users they invite, and billing contacts.

We are a processor for the personal data that our customers enter into the Service or receive through it, for example details of their own customers, suppliers and employees on invoices, contacts, travel orders, scanned receipts or store orders ("Customer Data"). The business that uses Apollo is the controller of that data and decides why it is processed. We process it only on that business's instructions and under our Data Processing Agreement, published at spaceinvoices.com/dpa. If you received a document from a business that uses Apollo and have a question about your data, please contact that business.

Studio 404 d.o.o. and its affiliated company Space Invoices Inc., which owns the Apollo platform, provide infrastructure, engineering, administration and support services to each other. When one of them processes personal data on behalf of the other, it acts on the other's documented instructions.

Apollo provides the website and Service to customers in supported markets. Personal data is processed through our service providers and infrastructure as described in this Privacy Policy.

3. Personal data we collect

• Account and profile data: name, email address, phone number if you provide it, company name, address, tax or VAT number, your role and permissions, language and market settings, and sign-in data (for example passkey identifiers or your Google or Apple account identity when you choose to sign in with it).
• Billing data: your plan and subscription history, billing contact and address, VAT number, payments and the invoices we issue to you. Card and PayPal payments are handled by our payment providers; we do not store your full card details. For bank transfers, we receive the payer's name, account details and payment reference from our bank.
• Usage and device data: IP address, browser and device type, operating system, pages and screens viewed, features used, time of use, referring page, error diagnostics, security logs and API request logs.
• Mobile app permissions: the Apollo mobile apps ask for Bluetooth access to find and connect to the card readers and receipt printers you choose. On some devices they also ask for location access, because older Android versions require it to scan for nearby Bluetooth devices and because SumUp's card payment software uses it when you take card payments. Apollo does not read, receive or store your device location. The name and Bluetooth address of the receipt printer you select are stored only on your device.
• Sign-up campaign data: when you sign up, we store the campaign parameters (utm_source, utm_medium, utm_campaign) from the link you arrived through with your account and, unless you have declined advertising cookies, the ad click identifier (gclid, gbraid, wbraid or fbclid), to measure which campaigns bring sign-ups. They are not shared with advertising partners and are deleted with your account.
• Communications: messages you send us by email, support chat or the contact form, and feedback or survey answers you give us.
• Data from third parties: your basic profile from Google or Apple if you sign in with them, payment status from our payment providers, and the result of checking a VAT number in the EU VIES service.
• Customer Data that you enter or receive through the Service, which we process as a processor (see section 2).

We do not ask for special categories of personal data, such as health data. Please do not enter such data into the Service unless it is necessary for your documents.

4. Why we process personal data and on what legal basis

• Providing the Service: creating and managing your account, providing the features you use, processing subscriptions and payments, and sending service messages about your account, security and billing. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Legal obligations: issuing our invoices, keeping accounting and tax records, and responding to lawful requests from authorities. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
• Support: answering your questions and requests. Legal basis: performance of a contract for customers (Article 6(1)(b) GDPR) and our legitimate interest in responding to enquiries from others (Article 6(1)(f) GDPR).
• Security and abuse prevention: protecting accounts and systems, keeping logs, preventing fraud and spam, including the automated screening described in section 5. Legal basis: our legitimate interest in a secure and trustworthy service (Article 6(1)(f) GDPR).
• Improving the Service: understanding how the Service is used and fixing errors, using usage statistics and error diagnostics. Legal basis: our legitimate interest in improving the Service (Article 6(1)(f) GDPR); where this requires analytics cookies or similar technologies, your consent (Article 6(1)(a) GDPR).
• Website analytics and advertising measurement: see section 6. Legal basis: your consent (Article 6(1)(a) GDPR).
• Marketing emails: news about Apollo features and offers. Legal basis: for existing customers, our legitimate interest in informing them about similar products, as permitted by electronic communications law (Article 6(1)(f) GDPR); for others, consent (Article 6(1)(a) GDPR). You can unsubscribe at any time.
• Legal claims: establishing, exercising or defending legal claims. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

Where we rely on legitimate interests, you can object as described in section 10. Where we rely on consent, you can withdraw it at any time; this does not affect processing before the withdrawal. You need to give us your account data to use the Service; without it, we cannot provide the Service to you.

5. Automated abuse screening

To prevent spam and fraud, document emails sent from free and trial accounts are screened automatically before they are sent. An AI model provided by Mistral AI in the EU receives a reduced version of the email: the known name and email address of the recipient and recognisable identifiers such as email addresses, phone numbers, bank and tax numbers are removed, and a short summary of the document is added (for example document number, issuer, totals, payment terms and item names). If the risk is high, sending may be paused while the account is reviewed. You can ask for the decision to be reviewed by a person, express your point of view and contest the decision by writing to support@getapollo.io. We do not otherwise make decisions based solely on automated processing that have legal or similarly significant effects on you.

6. Cookies and similar technologies

• Necessary cookies keep you signed in, protect the Service, remember your language, market and display settings, and store your cookie choice (for 12 months). They do not need your consent.
• Analytics cookies (with consent): we use PostHog (EU cloud) to understand how our website and Service are used: pages viewed, button clicks, referring page and campaign parameters, and device and browser data. A sample of visits may be recorded as session replays in which form inputs are masked. With your consent, a cookie also carries campaign information from our website to the sign-up page.
• Advertising cookies (with consent): we use Google Ads (Google Ireland Limited), Meta Pixel (Meta Platforms Ireland Limited) and ChatGPT advertising measurement (OpenAI Ireland Ltd) to measure whether our ads lead to visits, registrations, trial starts, subscriptions (with value and currency) and contact form enquiries. These providers receive advertising identifiers and cookies, the page address and referrer, and browser and device data, but not your name or email address. They may use the data as independent controllers under their own terms and may transfer it outside the EEA.

Analytics and advertising cookies are set only if you accept them in the cookie banner. You can change your choice at any time with the cookie settings button on our website. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal.

Our website also loads fonts from Google Fonts, so Google receives your IP address and browser data when a page loads.

7. Who we share personal data with

• Our affiliated company, as described in section 2.
• Service providers who process personal data on our behalf, listed in the table below.
• Payment providers: Stripe for card payments and PayPal (Braintree) for PayPal payments. They also process data as independent controllers to meet their own legal obligations, such as fraud prevention and anti-money-laundering rules.
• SumUp, for card payments in the mobile apps: Apollo only lets you connect your own SumUp account to an Apollo mobile app; card payments are processed by SumUp under the agreement you have with SumUp as a merchant. SumUp's payment software built into the app sends the payment amount, currency and a transaction reference, the card data read by the card reader or phone, device and card reader identifiers, device location, and diagnostic and usage data about the payment software directly to SumUp. You sign in to SumUp on SumUp's own screens. SumUp is an independent controller of this data under its agreement with you as the merchant and its own privacy policy; Apollo is not a party to that processing and only connects the account. Apollo never receives card numbers; we store only the payment amount, date and SumUp transaction code with the related invoice.
• Recipients you choose: when you fiscalise invoices, send e-invoices, validate VAT numbers, send documents by email or connect an integration, we send data to the tax authority, Peppol network or e-invoicing platform, VIES service, recipient or integration you choose. They act as independent controllers or on your instructions, not as our sub-processors.
• Advertising providers, only with your consent, as described in section 6.
• Authorities, courts and professional advisers, where the law requires it or where necessary to establish, exercise or defend legal claims.
• A buyer or successor of all or part of our business, subject to this Privacy Policy.

We do not sell personal data.

The complete and current list of sub-processors, including the data each receives and the transfer safeguards, is published at spaceinvoices.com/sub-processors. That list prevails if it differs from the table above.

8. International transfers

Most personal data is processed in the EU and EEA. Some providers, such as Cloudflare, Sentry and Slack, and the groups of our payment and advertising providers, may process personal data in the United States or other countries outside the EEA. Where such a country does not have an adequacy decision of the European Commission, we use the European Commission's Standard Contractual Clauses and, where appropriate, additional safeguards. Where a recipient in the United States is certified under the EU-U.S. Data Privacy Framework, the transfer may rely on the related adequacy decision. You can request a copy of the relevant safeguards from us.

9. How long we keep personal data

• Account data is kept while your account exists. After your account is closed, you can export your data for 30 days, and we then delete personal data within 90 days, except as described below.
• Invoices and other records required by law, such as fiscalised invoices, their audit trail, statutory exports and the invoices and payment records of our own billing, are kept for the period required by tax and accounting law, and then deleted.
• Customer Data is kept and deleted as set out in our Data Processing Agreement.
• Support communications and logs are kept only as long as needed for their purpose, for security and to handle follow-up questions or claims.
• Consent choices are stored for 12 months. Analytics data is kept only as long as needed for analysis.
• Marketing: we keep your email address on our suppression list after you unsubscribe so that we can respect your choice.
• Legal claims: where data is needed for a legal claim, we keep it until the claim is resolved or time-barred.

Backups are overwritten on their normal rotation.

10. Your rights

Under the GDPR, you have the right to:

• access your personal data and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data, unless we must keep it, for example under tax law;
• restriction of processing;
• data portability, receiving data you gave us in a structured, commonly used and machine-readable format;
• object to processing based on our legitimate interests, and at any time to direct marketing;
• withdraw your consent at any time, without affecting processing before the withdrawal;
• not be subject to a decision based solely on automated processing that significantly affects you, as described in section 5.

To exercise your rights, write to support@getapollo.io. You can also view and correct much of your account data directly in the app. You can delete your account in the Apollo mobile apps or by email, as described on our account deletion page. We respond within one month; for complex or numerous requests, we may extend this by two further months and will tell you why. We may ask you to confirm your identity. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive. If your request concerns Customer Data, we will forward it to the business that controls that data and help it respond.

If you are in the EU or EEA, you also have the right to lodge a complaint with the supervisory authority of the member state where you live or work or where the alleged infringement took place.

11. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls with roles and permissions, passwordless sign-in options, regular backups, logging and confidentiality obligations for everyone with access to personal data. No system is completely secure. If a personal data breach occurs, we will notify the supervisory authority and affected people where the GDPR requires it.

12. Marketing and service messages

You can unsubscribe from marketing emails at any time with the link in each email or by writing to support@getapollo.io. While you have an account, we will still send you service messages, such as sign-in, security, billing and legal notices, which are necessary to provide the Service.

13. Children

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect personal data of children. If you believe we have done so, contact us and we will delete it.

14. Third-party websites and integrations

Our website and the Service contain links to, and integrations with, services of other companies. Their own privacy policies apply to their processing, and we recommend that you read them.

15. Changes to this Privacy Policy

We may update this Privacy Policy. We will tell you about material changes by email or in the app before they take effect. The current version, with its date, is always published on our website.

16. Contact

Space Invoices Inc.
8 The Green, Suite B, Dover, Delaware 19901, United States
Email: support@getapollo.io

Shopify integration data

Where you connect Apollo through Shopify, Shopify is the source platform for the store, order, and customer data that Apollo processes to automate invoice creation and related order synchronization. After an applicable Shopify deletion or redaction request, Apollo deletes or anonymizes operational Shopify data unless it must retain issued invoices or other accounting records to comply with tax or accounting law. Those retained records remain available to authorized account users with access restricted to them. They are kept for the legally required period, including 10 years where applicable or longer where required, then deleted or anonymized after that period.