Privacy Policy — Ksefly
Version 2.0 · in force from ⟨TO CONFIRM: publication date⟩ · replaces the 12 July 2026 version in full.
Data controller: developNET Maciej Matysiewski (brand: develop.NET), ul. Nowowiejska 6/6, 00-649 Warszawa, Poland. NIP 1182238190, REGON 521446646. Data protection contact: privacy@ksefly.app.
Ksefly (“the app”, “the service”) helps Polish taxpayers issue, receive and read invoices in the National e-Invoicing System (Krajowy System e-Faktur, KSeF). Ksefly is an independent product, not affiliated with the Polish Ministry of Finance, the National Revenue Administration or any other government body. The name KSeF is used descriptively only.
This policy describes what the service actually does as of the date above — not what would be comfortable to say. The Polish version at /prywatnosc is the authoritative text; where the two differ, the Polish version controls.
In short
- We do not store your name or your e-mail address. Your account is a Sign in with Apple identifier and nothing else — and we keep that identifier encrypted.
- We do not sell data, we show no advertising and we do not track you across other apps or websites. The app contains no third-party analytics SDK and no advertising identifier.
- Your invoices are on our servers, not only on your device. We hold a full projection of every invoice: both parties’ names and addresses, amounts, numbers, dates, the KSeF number, and your own review note. The previous version of this policy said otherwise. That was false.
- Invoice content reaches a US AI model. The one-line description of what an invoice is for is written by an Anthropic model. We send it the seller’s name, the buyer’s name, the amount and the line-item names. Today this happens automatically, with no separate consent — see §4.
- We ask for location if you accept contactless card payments with the iPhone itself. The payment network requires it. Our own code never reads coordinates; the Stripe library does. The previous version of this policy claimed we do not collect location. That was false.
- You can delete your account from inside the app. That erases almost everything — with the exceptions we state honestly in §9.
1. What we process, and where it lives
Each class of data below answers three questions: what, where it lives, and whether it is encrypted in our database. “Our servers” means Microsoft Azure in the Poland Central region (Poland) ⟨TO CONFIRM: confirm the production environment’s region — the repository documents the development environment’s⟩; “your device” means your iPhone.
1.1. Account
Your Sign in with Apple identifier (the sub — an opaque identifier Apple issues for this app
alone), the date the account was created and the date it last changed.
We do not store your name or your e-mail address. The app asks Apple for an e-mail address at sign-in and that address does pass through our server inside the identity token, but it is never written anywhere — we read only the identifier out of the token.
We also hold an Apple refresh token, for one purpose only: so that deleting your account can revoke Ksefly’s access on Apple’s side.
Where: our servers. Encryption: yes — the identifier and the Apple token are encrypted (AES-256-GCM). A deterministic lookup index sits beside the identifier, because finding your account at the next sign-in requires it; that means an exact-value match on that identifier remains possible server-side.
1.2. Taxpayer context (the company you act for)
NIP, display name, how the company was authenticated with KSeF, synchronisation markers and — if you use payments — your Stripe account identifiers and the state of its capabilities.
Where: our servers and your device. Encryption: partial — the NIP is encrypted (with a lookup index), while the display name and every Stripe field are stored as plain text.
1.3. Invoices — the projection on our servers
This is the class the previous policy left out. For every invoice — issued and received — we hold:
- who — both parties’ NIP and name, both parties’ addresses;
- how much — net, VAT and gross amounts with the currency;
- when, and which document — the invoice number (P_2), the KSeF number, type and status, issue and sale dates, the document’s SHA-256 digest, correction facts (the corrected invoice’s number and date, the reason) and payment facts (due date, payment date, payment kind, payment link);
- what you or we added to it — your own review note on a purchase invoice and the AI-written one-line description (§4).
Those last two are the ones that surprise people, so we say them separately rather than at the end of a list.
The copy on your device is wider still: it adds line items, the bank account, the exchange rate, invoice notes, the exemption’s legal basis and the sale period.
Encryption: the two NIPs only. Party names, addresses, all amounts, the invoice number, your note and the AI description sit in the database as plain text. The database itself is reachable only through a private endpoint inside our network, and storage encryption is provided by the Azure platform — but at column level those fields are not encrypted.
1.4. The invoice document itself (FA(3) XML)
The complete structured document — both parties, every line, amounts, payment terms.
Where: in KSeF only. We do not store invoice XML on our servers; we fetch it from KSeF when it is needed. The line items parsed out of it are cached on your device.
1.5. UPO — the official KSeF receipt
The entire UPO document as XML — the KSeF number, the reference number, the document digest and timestamps. ⟨TO CONFIRM: whether the UPO structure also carries the taxpayer’s name or NIP. The repository does not settle it: the app’s parser reads only the name of the receiving body (the Ministry of Finance), and the tree holds neither a UPO sample nor its XSD. An earlier draft of this policy asserted that a UPO names the taxpayer — we had no evidence for that.⟩
Where: our servers (we keep a copy so it is available without asking KSeF every time). Encryption: no — the UPO is stored as plain text.
1.6. Your data vault (the backup of everything you type)
Everything you create in the app is copied to our servers the moment you save it, so that it survives a change of device and returns when you sign in again. It covers:
- the contractor book — name, NIP, address, REGON, legal form, VAT status, your own name for the contractor, their bank accounts and e-mail addresses;
- the product catalogue and categories — names, prices, VAT rates, units;
- invoice templates;
- payment accounts — label, account number (NRB/IBAN), the white-list check result, the split-payment flag;
- the payment-methods book;
- settings — your numbering scheme and its counter, taxation form, Pulse layout, business-card style, your e-mail template including your HTML signature, invoice appearance and your company logo (stored as an image).
Where: your device (the authoritative copy) and our servers. Encryption: yes — each record’s whole content is encrypted (AES-256-GCM). The collection name and record identifier stay in the clear. A deletion is recorded as a tombstone so your other devices learn about it.
One exception worth naming: when sending a new-invoice notification, our server reads the contractor book so the notification can show your own name for that contractor rather than the registered one.
1.7. Scheduled and queued sends
The complete content of an invoice waiting to be sent — both parties with their addresses, every line, amounts, the number, the dates, the bank account, the notes.
Where: our servers. Encryption: yes (the whole payload). The last send error is stored in the clear and may quote KSeF’s own words.
1.8. KSeF credentials
The KSeF session token, its refresh token, and the KSeF authorisation token with the NIP it belongs to — the last one so that the session can be renewed without involving you.
Where: our servers. Encryption: yes, envelope encryption (a data key wrapped by a platform key, plus AES-GCM). Credentials never travel back to the app and no plaintext token material is ever persisted.
1.9. Device and notifications
Your Apple push token (APNs), the platform, the last-seen time and your “details in notifications” setting. Where: our servers. Encryption: the token is encrypted.
App session tokens are stored on our servers only as hashes, never in a replayable form. An access token lives 30 minutes, a refresh token 30 days.
1.10. Payments
For each payment the app takes: Stripe’s identifiers, the amount, the currency, our fee, the status, the method and wallet type, the receipt URL, and the card brand and last four digits.
We never see the full card number, the expiry date or the CVC — the Stripe library reads the card on the device and sends it straight to Stripe.
Where: our servers and Stripe. Encryption: no — these fields are plain text, the card brand and last four digits included.
1.11. Location
The app asks for When In Use location access for exactly one purpose: accepting card payments contactlessly, with the iPhone itself. The payment network records where an in-person payment was taken, and the Stripe Terminal library will not operate without the permission.
Ksefly’s own code never reads coordinates — it only checks whether permission was granted. The Stripe library reads and transmits the location. Location never reaches our servers. If you do not accept contactless payments with your phone you can refuse; the rest of the app works normally.
For the same reason the app declares Bluetooth access: the payments library checks whether Bluetooth is available. Ksefly pairs with no external reader — the iPhone itself is the reader.
1.12. Diagnostics (optional, off by default)
If you turn on Settings → Diagnostics, the app counts which features are used (for example “invoice sent”). An event carries only the feature name, a timestamp, the app and OS versions, and a random installation identifier created when you turn the switch on and deleted when you turn it off (turning it back on mints a new one, so histories cannot be stitched together).
Events never carry your NIP, your account, your invoices or their contents, and the log line we keep does not name the user. One honest caveat: the request itself is sent from your signed-in session, so it is not anonymous at the transport layer — what is anonymous is the record it leaves behind.
1.13. Technical logs
Our server writes ordinary operational telemetry — requests, dependencies, errors, metrics — to Azure Application Insights / Log Analytics in the same region. We do not deliberately log NIPs, party names or invoice content; some warnings carry an internal user identifier.
1.14. What we do not collect
Contacts, photos, microphone, camera, health data, browsing history, advertising identifiers. The app contains no third-party analytics, attribution or crash-reporting SDK. The ksefly.app website sets no cookies and runs no analytics.
We do not, however, claim that we collect no location — see §1.11.
2. Why we process data, and on what legal basis
The previous version of this policy gave a legal basis for one bullet, and gave it wrongly: it borrowed your tax obligation as if it were Ksefly’s own. Below, every purpose carries its own basis. References are to GDPR art. 6(1).
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account and authenticating you | account (§1.1), session tokens | (b) — performance of the contract |
| Issuing, sending and receiving invoices through KSeF | taxpayer context, invoice content, KSeF credentials, UPO | (b) — performance of the contract |
| Showing and searching your invoices in the app | the invoice projection (§1.3) | (b) — performance of the contract |
| Backing up and syncing your books and settings across your devices | the data vault (§1.6) | (b) — performance of the contract |
| Looking contractors up in public registers (white list, GUS, VIES) | NIP, bank account number | (b) — performance of the contract, at your request |
| Notifying you about new invoices and send outcomes | device token, counterparty name and amount (§6) | (b) — performance of the contract |
| Accepting payment for your invoices and collecting our fee | payment data (§1.10), location for contactless payments (§1.11) | (b) — performance of the contract |
| Keeping the service secure and available, diagnosing failures, preventing abuse | technical logs (§1.13) | (f) — our legitimate interest in keeping the service running and preventing abuse (recital 49) |
| Optional feature-usage diagnostics | §1.12 | (a) — your consent (a switch in Settings) |
| The AI-written Pulse line | a name-free business profile (§4.2) | (a) — your consent (“Ksefly Intelligence”, off by default) |
| The AI-written one-line invoice description | party names, amount, line-item names (§4.1) | ⟨TO CONFIRM: legal basis. Today the feature runs automatically with no separate consent. To be decided: consent (a) once a switch exists, or legitimate interest (f) with a documented balancing test. Do not claim (b) — the app works fully without this feature.⟩ |
| The AI-written bookkeeping note (on your tap) | seller name, amount, line-item names (§4.3) | (a) — your consent, given by invoking the feature |
| Handling your GDPR requests and defending against claims | correspondence, the account data needed | (c) — legal obligation (art. 12 GDPR); (f) — establishing and defending claims |
3. Who receives your data
The previous version named six recipients and omitted Stripe, Anthropic, Sign in with Apple and Application Insights. The full list is:
Processors (acting on our instructions):
| Who | What reaches them | Where |
|---|---|---|
| Microsoft Azure — hosting, database, key vault, logs | the whole server-side dataset | Poland Central (Poland) |
| Azure Static Web Apps — the ksefly.app website | visitors’ request metadata only; no account data | West Europe (Netherlands) |
| Anthropic PBC — the language model | what §4 describes | United States |
| Azure Communication Services | our own operational mail only (a key-expiry reminder). No user data | — |
Apple appears in three distinct roles: as the provider of Sign in with Apple (it runs the sign-in and hands us the identifier), as the operator of APNs push notifications (see §6), and as the seller of subscriptions in the App Store — there Apple is an independent controller and we receive no payment data at all.
Stripe has a dual role: a processor when servicing the platform, and an independent controller for its own obligations — fraud prevention, regulatory and compliance duties. The merchant is your company, not Ksefly: the Stripe account belongs to your taxpayer context and the funds never pass through a Ksefly balance. What reaches Stripe: the business details and address you enter in Stripe’s own onboarding form (you fill it in directly with them — we deliberately prefill nothing), the payment amount and currency, our fee, the invoice number as the line’s product name, our technical metadata (including your Ksefly user identifier), the card data read on the device, and the location for an in-person payment. We never send Stripe your customer’s e-mail address.
Independent controllers acting under their own statutory mandate (we query them when you use the relevant feature):
- KSeF / the Ministry of Finance — receives the complete invoice document and is the only place that document is stored;
- The VAT white list (Ministry of Finance) — a NIP, and for an account check a NIP + account number pair;
- GUS BIR — a NIP; the reply carries the company’s register data;
- VIES (European Commission) — an EU VAT number;
- NBP — a currency code and a date only; nothing identifying.
We require every processor to provide protection at least equal to that described in this policy, under a data processing agreement or the provider’s equivalent terms. ⟨TO CONFIRM: identify the data processing agreements actually in place for Azure, Anthropic and Stripe⟩
4. Artificial intelligence
Three Ksefly features use a language model supplied by Anthropic PBC. The model is claude-haiku-4-5, called by our server (your device never contacts Anthropic directly, and the API key never leaves the server). The texts described below are generated by artificial intelligence and can be wrong — they are not tax or accounting advice.
4.1. The one-line invoice description (“what this invoice is for”)
What we send: the seller’s name, the buyer’s name, the gross amount and currency, and the invoice’s line-item names (up to 20, with quantity and unit). If the invoice carries a buyer NIP, we also attach up to eight earlier descriptions written for that same trading pair, so the wording stays consistent.
That means the buyer’s name — including a consumer’s name on a B2C invoice — and what was bought or sold leaves our servers and reaches a model in the United States.
What gates it: nothing. The description is generated automatically: the app writes one for newly synchronised invoices and gradually fills the gaps for historical ones. The “Ksefly Intelligence” switch does not cover this feature — it governs only the Pulse line (§4.2). We say this plainly because the previous policy did not mention the feature at all. ⟨TO CONFIRM: owner’s decision — either bring this feature under a consent switch, or describe it here as resting on legitimate interest with a stated right to object⟩
What is kept: the returned phrase (one line, at most 120 characters) is stored permanently on the invoice, on our servers and on your device. The model is called once per invoice. We do not store the request itself.
4.2. The Pulse line (“Ksefly Intelligence”)
What we send: figures and behavioural counts only, no names, no NIPs and no invoice numbers — this month’s revenue and costs, an optional forecast band, and a profile as key-value pairs: months of history, sales per month, number of regular buyers, the largest buyer’s share as a percentage, which part of the month you usually invoice in, the share of payments made on time, and the currencies you use. NIPs are used on the device solely to count distinct buyers and are never transmitted.
What gates it: your consent. The “Ksefly Intelligence” switch (in Settings, or the invitation card in Pulse) is off by default; with it off, nothing is sent. Consent is checked twice — before the call and again when the answer returns — so turning the switch off mid-flight discards the result.
What is kept: nothing on our side. The server component behind this feature is built so that writing to the database is impossible: it holds no repository and no unit of work. The answer is stored only on your device, in a file encrypted with AES-GCM under a device-bound key. Turning the switch off deletes that file.
4.3. The bookkeeping note for a purchase invoice
What we send: the seller’s name, the gross amount and currency, and the line-item names. The buyer’s name is not sent to the model on this path.
What gates it: your tap. The feature is part of the Ksefly Ultra plan and runs only when you ask for a draft note.
What is kept: we do not store the generated text. If you keep it, it becomes your review note and is stored with the invoice (§1.3), on our servers too.
4.4. What happens on Anthropic’s side
⟨TO CONFIRM: how long Anthropic retains the requests, and the contractual terms that apply (data processing agreement, any zero-retention terms). Until that is established we state no figure here — publishing an unverified retention period would be misleading.⟩
We do not train models on your data, and we send nothing to the model for any purpose other than those described above.
5. Transfers outside the European Economic Area
Ksefly’s primary infrastructure is in Poland (Azure Poland Central) and the website is in the Netherlands — neither is a transfer outside the EEA. Data leaves the EEA in four cases:
| Recipient | What goes | Country | Mechanism |
|---|---|---|---|
| Anthropic PBC | see §4 | United States | ⟨TO CONFIRM: contracting entity and mechanism — standard contractual clauses (art. 46(2)(c) GDPR) or an EU-US Data Privacy Framework certification verified on dataprivacyframework.gov⟩ |
| Stripe | see §3 | ⟨TO CONFIRM: Stripe Payments Europe Ltd (Ireland) or Stripe, Inc. (United States)⟩ | ⟨TO CONFIRM⟩ |
| Apple — APNs | the device token, and with details switched on the counterparty name and the amount (§6) | United States | ⟨TO CONFIRM⟩ |
| Apple — Sign in with Apple | the identity token exchange, and the revocation call when you delete your account | United States | ⟨TO CONFIRM⟩ |
You can obtain a copy of the safeguards in place by writing to privacy@ksefly.app.
For Microsoft Azure, data is stored and processed in Poland; ⟨TO CONFIRM: whether the provider’s terms permit support access from outside the EEA, and on what basis⟩.
6. Push notifications
If you allow notifications, we send them through Apple’s service (APNs). By default a notification about a single new invoice carries the counterparty’s name and the amount — which means those two facts pass through Apple’s servers and can appear on a locked screen. When several invoices arrive in one batch the notification gives their count and the total, with no names; if the batch mixes currencies, we omit the total as well.
You can turn that off: Settings → Notifications → invoice details in notifications. With it off, the notification carries only a count of new invoices. The setting is per device.
7. How long we keep data
We will say this plainly: apart from the infrastructure exceptions listed below, Ksefly runs no mechanism that deletes data after a period of time. Business records are kept until you delete the taxpayer context or the account.
| What | How long |
|---|---|
| Account, taxpayer contexts, invoices, scheduled sends, the data vault, KSeF credentials, devices | until you delete the context or the account (§9) |
| The AI description on an invoice | stored indefinitely with the invoice; deleted with it |
| UPO (XML) | nothing deletes it — see §9 |
| Payment transactions | nothing deletes them — see §9 |
| App session tokens | access 30 minutes, refresh 30 days; expired rows are not currently pruned |
| Technical logs and usage diagnostics | 30 days (Log Analytics / Application Insights) |
| Database backups | 7 days, with no geo-redundant copy |
⟨TO CONFIRM: the intended retention periods for UPOs, payment transactions and expired tokens — and whether Ksefly relies on any statutory period at all⟩
A correction to the previous version. It said invoices are kept “in accordance with tax law — as a rule for 5 years”. That was wrong twice over. Structured invoices are stored by KSeF for ten years from the end of the year in which they were issued (art. 112aa of the Polish VAT Act), and the taxpayer is relieved of the obligation to store them for that period. Ksefly does not keep invoices “because of a tax obligation” — it keeps them because otherwise the app could not show them to you.
8. What we store on your device
The app stores data in your device’s storage. We tell you this because art. 399 of the Polish Electronic Communications Law requires it:
- the local app database (invoices, books, catalogue, templates, drafts, the send queue) — protected by iOS file protection, readable only after the device’s first unlock;
- the Keychain — session tokens, the key seed for the encrypted AI cache, and any KSeF certificates; entries are bound to this device and are never synced to iCloud;
- preferences — chosen appearance, numbering settings, Pulse layout, dismissed hints;
- the encrypted AI cache (§4.2);
- your company logo files, used on invoices.
Signing out erases every account datum from the device (the database, the send queue, account preferences, the logo, the AI cache); device-level settings such as the biometric lock stay. The vault copy (§1.6) remains, which is what lets a later sign-in restore your books — signing out is not a deletion request; deleting your account is (§9).
Cookies: the app uses none, and the ksefly.app website sets no cookies and runs no analytics, which is why it carries no consent banner.
9. Deleting your account — what goes, and what stays
Settings contains an option to delete your account. On our side it runs a single operation that:
- attempts to revoke the Sign in with Apple grant — first, before anything else, which is what removes Ksefly from the “Sign in with Apple” list in your Apple ID settings. It is a best-effort step: if Apple does not confirm the revocation we log that on our side, and the deletion goes through regardless (§ 7(2) of the Terms says the same),
- deletes every taxpayer context, and with them invoices, scheduled sends, historical import jobs and the encrypted KSeF credentials,
- deletes the entire user data vault,
- deletes device registrations and session tokens,
- deletes the account itself and its identities.
Deleting a single company (context) deletes that company’s invoices, scheduled sends, import jobs, KSeF credentials and its slice of the vault.
What that does not reach — stated honestly:
- UPO documents (XML) and payment transaction records are deleted by no mechanism in the system. After account deletion they remain in the database as orphaned rows. A UPO carries the KSeF number, the reference number and timestamps (what else — see §1.5); a payment record holds the amount, our fee, the card brand and last four digits, and the receipt URL. ⟨TO CONFIRM: whether this is a deliberate retention decision (and on what basis) or a defect to be fixed — until that is settled we describe the facts⟩
- Database backups — data leaves them after 7 days.
- Technical logs — after 30 days.
- What was already sent to KSeF — KSeF stores invoices under statute and we cannot undo that.
- What was already sent to Anthropic and Stripe — subject to their own retention (§4.4, §5).
If you want us to erase something the in-app option does not reach, write to privacy@ksefly.app.
10. Your rights
You have the right to access your data and obtain a copy, to rectification, to erasure, to restriction of processing, to portability of the data you provided under a contract or consent, and to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa).
Withdrawing consent. Where we rely on consent — optional diagnostics (§1.12) and the Pulse line (§4.2) — you may withdraw it at any time using the switch in Settings, without giving a reason. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Right to object
You have the right to object at any time to processing based on our legitimate interest, on grounds relating to your particular situation. This covers the processing marked “(f)” in §2. On receiving an objection we will stop processing that data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. Send an objection to privacy@ksefly.app.
Data protection officer. ⟨TO CONFIRM: whether a data protection officer has been designated (art. 13(1)(b) GDPR). If not, use the sentence: “We have not designated a data protection officer; for data protection matters write to privacy@ksefly.app.” The same marker stands in the counterparty notice (§ 7) and in the data processing agreement (§ 15(5)) — one decision closes three documents.⟩
Automated decisions and profiling. We do not take decisions about you based solely on automated processing — including profiling — which would produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR). The features described in §4 produce assistive text only: they do not refuse you the service, do not change prices or fees, do not affect your tax position, and are shown to nobody but you.
To exercise any of these rights, write to privacy@ksefly.app. We answer without undue delay and within one month at the latest. We may ask for information that lets us confirm the request comes from the account it concerns — remember that we hold neither your name nor your e-mail address (§1.1), so without such confirmation we cannot match a request to an account.
11. Is providing data mandatory
Providing data is voluntary, but without some of it the service cannot work:
- a NIP and KSeF credentials — without them no taxpayer context can be created, and without a context the app has nothing to show and nowhere to send invoices;
- the Sign in with Apple identifier — without it there is no account;
- location permission — required only to accept card payments with your iPhone; refusing it blocks that one feature and nothing else;
- notification permission and the AI and diagnostics consents — entirely optional; refusing them limits no other feature.
12. Security
All traffic runs over TLS. Server secrets live in a managed key vault; the database is reachable only through a private endpoint, with password authentication disabled. KSeF credentials are envelope-encrypted and the vault’s contents are encrypted with AES-256-GCM. On the device, data is protected by iOS file protection and the Keychain, optionally behind a Face ID lock. Section §1 says outright which fields are not encrypted at column level — we do not want this policy to imply more protection than exists.
No system is perfectly secure. If you find a vulnerability, write to privacy@ksefly.app.
13. Children
Ksefly is a business tool and is not directed at children (the 4+ age rating reflects only the absence of unsuitable content). We do not knowingly process children’s data.
14. Changes to this policy
We will update this policy as the app develops. Every version carries a number and a date, and the change log is below. We will announce changes that materially affect your rights inside the app before they take effect.
Change log
- Version 2.0 — ⟨TO CONFIRM: date⟩. A complete rewrite. It discloses: the invoice projection on our servers, including which fields are not encrypted; the storage of UPO documents; all three AI features and what reaches a model in the United States; Stripe and payments; location access; what a push notification carries; the full list of recipients and transfers outside the EEA; the real retention picture; and what deleting an account does not reach. It adds a legal basis per purpose, a separately presented right to object, the terminal-equipment disclosure and a statement on whether providing data is mandatory. It corrects three false statements in the previous version: that we collect no location, that invoices live only on the device and in KSeF, and that invoices are retained “as a rule for 5 years”.
- Version 1.0 — 12 July 2026. The first published version.