Privacy policy¶
Last update: 3 October 2026.
This policy describes how Antoine LE BORGNE, entrepreneur individuel, trading as Orvel (“we”), processes personal data when you use the Factur-X API and MCP service at https://facturx.orvel.dev.
Publisher identity: orvel.dev/legal.
Contact: le.borgne.antoine.pro@gmail.com.
What we process¶
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account e-mail, name, billing address, VAT number if you provide one | Create the customer account, send receipts, comply with accounting rules | Contract; legal obligation |
| Payment data | Taken by Stripe. We never see full card numbers | Contract; Stripe as processor / independent controller for the payment |
| OAuth connections (encrypted underlying API key, client metadata, hashed token identifiers, necessary consent cookie) | Connect an MCP client with existing plan limits; revoke access | Contract |
| API key and monthly usage counters | Authenticate calls and enforce the plan quota | Contract |
Invoice files and JSON you send to /v1 or /mcp |
Generate, validate or extract the document | Contract |
| Application events (time, normalized route, MCP method/tool name, authentication category, result status, duration, random request ID) | Security, debugging, abuse | Legitimate interest |
| Docs site cookies | Remember language / theme if the browser allows it | Legitimate interest (strictly necessary) |
Invoice files are processed in memory and discarded. Funnel events exclude invoice bodies, arguments, invoice numbers, names, amounts, email addresses, API keys, IP addresses and URL query strings. Hosting providers may separately retain network access logs. We classify known monitor/test user agents; other requests remain unclassified, not assumed to be people.
Hosting and subprocessors¶
- Application: Railway Corporation (USA), Europe West region (Amsterdam). Documents are processed in the EU; Railway acts as processor under its DPA with EU standard contractual clauses.
- Payments and customer portal: Stripe (Ireland / EU).
- Usage counters, prepaid wallets and evaluation grants: Railway Redis in production. Paid evaluation access fails closed if durable storage is unavailable. A pseudonymous marker prevents counting the same key as a first-use conversion more than once. Evaluation and prepaid grant, debit and refund records prevent payment replay from restoring credits. Prepaid balances have no TTL and use a pseudonymous account identifier; account-to-key links are encrypted in Orvel Accounts. No invoice content is stored in these ledgers.
Retention¶
Verified-account trials use the Orvel Accounts PostgreSQL database for the grant, expiry, operation/attempt counters, encrypted trial key and account/hashed-email eligibility record. The account service receives no invoice documents. Minimal eligibility records remain while the trial program operates, including after grant expiry, to prevent repeat grants. See Orvel account privacy for account hosting and deletion requests.
- Customer and billing data: duration of the contract + 10 years (French accounting).
- Technical logs: 30 days.
- Aggregate activation counters (page responses, sign-in outcomes, MCP approvals, allowance actions, checkout and successful document use): 90 days, grouped by day, stage, plan, interface and known probe/test category. These contain no invoice data, IP addresses or raw credentials. One-way markers prevent duplicate payment, key-delivery and first-use counts and are retained with entitlement records.
- API keys: until you cancel or we disable the key.
- OAuth connection records: up to 30 days; underlying API keys are encrypted with a dedicated server key. Access-token records expire after 15 minutes, consent requests/cookies after 10 minutes, authorization codes after 2 minutes. Revocation and replay markers expire within 30 days. Registered client metadata is retained for up to one year. Pseudonymous IP hashes used only for OAuth abuse limits expire within one day. Revoking a connection disables access immediately; expired records are removed by Redis expiry.
Your rights¶
Access, rectification, erasure, restriction, portability, objection: write to the e-mail above. You may complain to the CNIL.
We do not sell data and we do not use it for advertising.
Payments¶
Card and mandate data are handled by Stripe under their privacy policy. Failed or successful payments produce a Stripe receipt sent to the e-mail you entered at checkout.
Orvel sign-in and connected applications¶
Factur-X uses Orvel Accounts for verified email/password and Google sign-in. Passwords are submitted directly to Accounts. Factur-X stores encrypted, server-side login sessions for up to eight hours, including the account identifier, email, provider session identifier and short-lived access token. Browser cookies contain opaque session identifiers; API keys are not stored in browser local storage.
Linked API credentials and pending checkout identifiers are encrypted in the Accounts database so the allowance can be recovered after sign-in. A purchase is activated only after the existing billing checks confirm it. MCP connection records expire within 30 days and remain subject to the underlying plan's expiry and revocation. Sign-out for that session from Orvel Accounts invalidates associated Factur-X browser and MCP sessions. Contact Orvel to remove a linked credential; trial eligibility records are retained for the duration of the trial programme to prevent repeat grants.
Operational statistics¶
Orvel retains daily aggregate counts of MCP tool attempts, discovery requests, REST operations, errors and summed response times for 90 days in its private admin console. Self-declared user-agent markers separate known probes and tests from unclassified traffic; the raw user agent is not retained in these counters. These statistics contain no document contents, API keys, customer identifiers, IP addresses or raw request URLs. Collection is best effort and does not change your plan or allowance.
Successful-use days are deduplicated using one-way entitlement markers. Daily markers expire after 90 days; a pseudonymous first-observed-day marker expires after 90 days without use. Returning use means activity on an earlier UTC day within this retained history, not identification of a person.
Shared operational reporting¶
Orvel records operational events such as sign-in outcomes, completed operations, checkout progress, safe error categories and response times in its private product dashboard. Optional identifiers are pseudonymised separately for each product; they do not contain your email. These events are kept for up to 90 days, with scheduled deletion. They exclude passwords, tokens, invoice or CSV contents, raw URLs and IP addresses. No advertising cookies are added. Contact privacy@orvel.dev about these records.