Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Notaly (“we”, “us”, “our”), the operator of getnotaly.com, collects, uses, shares and protects personal data when you use our website and API service (“the Service”).

Data controller: Notaly (operator of getnotaly.com) — hello@getnotaly.com

1. Summary

Notaly is an e-invoicing API. To issue and track e-invoices, we process invoice data you submit, which may include personal data such as names, addresses and tax identification numbers (e.g. Polish NIP or PESEL). We process this data to provide the Service, to comply with applicable law and to protect our systems. We do not sell personal data.

2. Data we collect

Account and registration data: name, email address, company name, and credentials you use to register for and access the Service.

Billing data: payment for paid plans is processed by Paddle, which acts as Merchant of Record. Paddle collects payment details and provides us with limited billing and subscription information (such as subscription status and transaction references). We do not store full card numbers.

Invoice data you submit: any data you send through the API or otherwise to create invoices, which may include buyer and seller names, addresses, tax identification numbers (such as NIP or PESEL), invoice line items, amounts, tax rates and related metadata.

Service and usage data: API requests, timestamps, API keys, error logs, IP addresses, user-agent information and webhook configuration.

Support and communications data: information you provide when you contact us, and the content of those communications.

3. How we use personal data and legal bases

We process personal data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):

• To provide the Service and perform our contract with you (Article 6(1)(b) GDPR): creating and managing your account, generating and validating invoices, submitting invoices to KSeF, returning status, and operating webhooks.
• To comply with legal obligations (Article 6(1)(c) GDPR): retaining records where required by tax or accounting law, and responding to lawful requests from authorities.
• For our legitimate interests (Article 6(1)(f) GDPR): securing and monitoring the Service, preventing fraud and abuse, improving the Service, and providing support, provided these interests are not overridden by your rights.
• With your consent (Article 6(1)(a) GDPR): where you give consent for optional cookies, analytics or marketing communications. You may withdraw consent at any time.

4. How we share personal data

• Paddle (Merchant of Record): for payment processing, invoicing for purchases, tax collection and refund processing.
• KSeF / Poland’s Ministry of Finance: when you submit an invoice, the relevant invoice data is transmitted to the official KSeF system.
• Peppol access point partner(s): where Peppol delivery is used, invoice data is transmitted through certified Peppol partner(s).
• Hosting and infrastructure providers: we use cloud providers to host and process data (with storage in the European Union / European Economic Area).
• Professional advisers and authorities: where required by law, or to establish, exercise or defend legal claims.

We do not sell personal data. We share personal data only as necessary for the purposes above and, where required, under appropriate data processing agreements.

5. International transfers

Personal data is stored and processed in the European Union / European Economic Area. Where a transfer outside the EEA is ever required, we will rely on an appropriate safeguard under the GDPR, such as the European Commission’s Standard Contractual Clauses, and will provide further information on request.

6. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, and to comply with legal obligations:

• Invoice data and related records (including UPO and submission references): retained as required by applicable tax and accounting law, which may be up to 10 years.
• Account data: retained while your account is active, and for a limited period after deletion to meet legal and legitimate business needs.
• Usage and technical logs: retained for a shorter period as needed for security, monitoring and support.

Where you request deletion, we will delete or anonymize data to the extent permitted by law, except where retention is required by law (for example, tax retention obligations).

7. Security

We apply technical and organizational measures to protect personal data, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights under the GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data (subject to legal retention obligations);
• request restriction of processing;
• request data portability;
• object to processing based on legitimate interests; and
• withdraw consent where processing is based on consent.

To exercise these rights, contact us at hello@getnotaly.com. You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Cookies and analytics

Our website uses only essential cookies and, where applicable, limited analytics with your consent. You can manage cookie preferences through your browser settings.

10. Children

The Service is intended for businesses and is not directed to individuals under the age of 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact

• Email: hello@getnotaly.com
• You may also contact your local data protection supervisory authority.