Privacy and invoice data

This page describes how the partner integration handles account, credential and invoice information.

Account information

We use your company name, email and optional contact details to operate the partner account and provide support. Passwords are stored as hashes. The portal uses an essential session cookie to maintain sign-in.

Integration and government credentials

Partner integration keys are shown once and stored as hashes. Keep them in your backend’s secret store. Supplier government credentials accompany each live submission and are forwarded to JoFotara for that request; they are not stored in the invoice record.

Invoice data

Invoice submissions include supplier, buyer, item and tax details. The partner API stores live invoice XML in a private Cloudflare R2 bucket. Sandbox XML is returned directly and is never archived. Database records hold submission ownership, status, allowance accounting and archive paths. Authorized partner credentials provide access to that partner’s retained invoices.

Retention

Live invoice XML is automatically deleted after 90 days (about 3 months) from acceptance. Download your own copy before expiry. Invoice history and usage metadata remain after XML cleanup for accounting, troubleshooting and duplicate detection. Sandbox XML is not stored; sandbox return-validation metadata is cleared after 90 days. See the relevant API documentation for retention details.

Support chat

Public pages use tawk.to for support chat. Messages you send are processed through tawk.to; see its privacy policy. The widget is not loaded on sign-in, account, invoice or administration pages. You can also contact us by email.

Support and requests

For questions about data handling, account access or your records, contact info@apps-valley.net. Never include passwords, API keys or government secrets in a support message.