Terms & Conditions

1. Introduction

These Terms govern your use of PeppolFlow, a software platform that helps EU businesses issue, send, and archive structured electronic invoices on the Peppol network and, for Polish customers, submit invoices to the Krajowy System e-Faktur (KSeF) operated by the Polish Ministry of Finance.

By creating an account or using PeppolFlow you agree to these Terms. If you don't agree, don't use the service. These Terms supersede any prior agreement between us regarding the service.

2. Acceptable use

You agree to use PeppolFlow only for lawful purposes and only to issue, receive, or archive genuine commercial invoices that you are legally entitled to issue or process.

You will not use PeppolFlow to issue fictitious invoices, evade tax obligations, impersonate other businesses, or otherwise commit fraud. We reserve the right to suspend or terminate access where we have reasonable grounds to suspect such use.

You will not attempt to disrupt the service, exceed published rate limits, reverse-engineer the platform beyond what applicable law permits, or use the service to send unsolicited commercial communications.

3. Your obligations as the invoice issuer

You are the issuer of record for every invoice you create through PeppolFlow. PeppolFlow acts as a technical intermediary and software provider. We do not become party to the underlying commercial transaction between you and your customer.

You are responsible for the accuracy, completeness, and legal sufficiency of every invoice you issue: VAT rates, line-item descriptions, customer identifiers, payment terms, and country-specific mandatory fields. PeppolFlow validates structure (EN 16931, FA(3) schema) but does not validate the underlying commercial facts.

You are responsible for compliance with applicable tax law in every jurisdiction in which you issue invoices. For Polish customers, this includes the obligations imposed by the KSeF mandate, including timely submission, archival, and any KSeF-specific identifiers required by Polish tax law.

You authorize PeppolFlow, on a per-organization basis, to use credentials you provide (Peppol Participant ID, KSeF token tied to your NIP, etc.) to act as your technical agent for invoice submission and retrieval. You may revoke this authorization at any time from your account settings, after which we will cease using those credentials.

4. Data processing and GDPR

PeppolFlow processes personal data on your behalf as a data processor within the meaning of the EU General Data Protection Regulation (GDPR). You are the data controller for invoice content, customer records, and any personal data you upload to the platform.

We process your data only to provide the service: storing invoices, transmitting them through Peppol or submitting them to KSeF, generating PDFs, sending notification emails, and producing usage analytics for billing. We do not sell, rent, or use your data for advertising.

Personal data is hosted within the European Union. Our database (Neon Postgres) is located in eu-west-2 (London). Backups are encrypted at rest and at transit.

You may request export, correction, or deletion of your account data at any time by writing to privacy@peppolflow.eu. We will action requests within 30 days unless retention is legally required (e.g. tax-archival obligations).

5. Sub-processors

We use the following sub-processors to deliver PeppolFlow. Each one accesses only the data necessary for its specific function and is bound by appropriate data-protection obligations.

We will notify you of material changes to this list at least 30 days before they take effect.

• Storecove (Netherlands) — Certified Peppol Access Point for cross-border e-invoice delivery.
• Anthropic (USA, EU data residency available) — AI-powered PDF invoice extraction. Invoice PDFs you upload are sent to Claude for field extraction, then discarded.
• Vercel (USA, EU edge hosting) — Application hosting, edge network, build and deployment.
• Neon (eu-west-2, London) — Postgres database hosting. All customer data lives here.
• Resend (USA, EU) — Transactional email delivery (invoice notifications, account email).
• Stripe (Ireland, EU) — Payment processing and subscription billing for PeppolFlow itself.
• Sentry (Germany, EU) — Error and performance monitoring. Personally identifiable information is scrubbed before transmission.

6. KSeF Poland

For Polish-VAT-registered customers, PeppolFlow integrates with the KSeF API operated by the Polish Ministry of Finance. KSeF is a mandatory pre-clearance system: every B2B invoice must be submitted to KSeF and assigned a KSeF number (numer KSeF) before it is legally issued.

PeppolFlow stores your KSeF token encrypted at rest using AES-256-GCM. The token is used solely to act as your authorized agent for KSeF submissions tied to your NIP. We do not, and cannot, use your token to act on behalf of any other taxpayer.

PeppolFlow does not advise on Polish tax law. Determining whether a given transaction must be submitted to KSeF, the correct KSeF schema (FA(3) at the time of writing), and the legal consequences of any KSeF rejection are your responsibility. We surface KSeF rejection details transparently so you can act on them.

7. Service availability

PeppolFlow is provided on a commercially reasonable best-efforts basis. We do not commit to a contractual uptime percentage at this stage of the product. Planned maintenance windows are announced in advance where possible.

Where Peppol delivery or KSeF submission depends on third-party services (Storecove, KSeF API), the availability of those services is outside our control. We will surface status information and make reasonable efforts to retry transient failures.

8. Payment and cancellation

Paid plans are billed monthly or annually in advance through Stripe. The applicable price is the one published on the pricing page on the day you subscribe.

You can cancel from the billing portal at any time. Cancellation takes effect at the end of your current billing period; we do not pro-rate refunds for unused time. Your account drops back to the Free tier after the period ends.

We may change pricing for new subscription periods with at least 30 days' notice by email and in-product notification. Existing subscriptions ride out the current period at the prior price.

9. Liability

PeppolFlow is provided 'as is' to the extent permitted by applicable law. We do not warrant that the service will be uninterrupted or error-free or that every invoice will be successfully delivered to every counterparty.

Our aggregate liability to you for any cause of action arising out of these Terms is limited to the amount you paid us for the service in the 12 months preceding the event giving rise to the claim, or 100 EUR for free-tier users.

Nothing in these Terms limits liability for fraud, gross negligence, or any other liability that cannot be limited under applicable law.

10. Termination

You may terminate your account at any time. We may terminate or suspend your account where you materially breach these Terms, where we are required to do so by law, or where continued service would expose either party to material legal risk.

On termination we will provide you with a reasonable opportunity (typically 30 days) to export your invoice archive before deleting your data. Tax-archival obligations may require us or you to retain certain records longer; we will surface this where applicable.

11. Changes to these Terms

We may update these Terms from time to time. Material changes will be announced by email and in-product notification at least 30 days before they take effect.

If you continue to use PeppolFlow after a change takes effect, you accept the updated Terms. If you don't agree, your remedy is to terminate the account.

12. Governing law and disputes

These Terms are governed by the laws of the Kingdom of Spain, without regard to conflict-of-laws principles. Disputes will be resolved by the competent courts of Spain, save where applicable consumer-protection law assigns jurisdiction elsewhere.

For customers established in the European Union, this choice of law and forum does not affect mandatory provisions of the consumer-protection law of your country of residence.