Draft — pending legal review
Privacy Policy
ainventry — a product of Andrei Diachenko (autónomo), Spain. Last updated: 28 June 2026.
DRAFT — for legal review only. Not final legal advice. Do not publish without review by qualified counsel.
1. Who We Are
Andrei Diachenko, a sole proprietor (autónomo) established under the laws of Spain (“ainventry”, “we”, “us”, “our”) is the data controller responsible for personal data collected through the ainventry service at ainventry.com.
Registered address: Calle Covera 19, 5A, 33012 Oviedo, Asturias, Spain
NIF/NIE: Z1579875X
Contact email for data-privacy matters: andreidiachenko95@gmail.com
Data Protection Officer (DPO): No DPO has been appointed. Under GDPR Art. 37, a DPO is not required at the current scale of processing (no large-scale systematic monitoring, no large-scale processing of special-category data). Data-protection enquiries should be directed to andreidiachenko95@gmail.com.
2. Scope
This Privacy Policy applies to: visitors to ainventry.com, registered users and account holders, and contacts whose data is entered into ainventry by our customers (see Section 3.3).
3. Data We Collect and Why
3.1 Account and Contact Data
| Data category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account registration data | Name, email, hashed password | Creating and managing your account | Performance of contract (GDPR Art. 6(1)(b)) |
| Billing data | Billing name, address, VAT number | Invoicing and payment processing | Performance of contract; legal obligation (Art. 6(1)(b/c)) |
| Communication data | Support emails; in-app messages | Responding to enquiries | Legitimate interest (Art. 6(1)(f)) |
| Marketing preferences | Email opt-in/opt-out | Sending product updates with your consent | Consent (Art. 6(1)(a)) — you may withdraw at any time |
3.2 Usage and Technical Data
| Data category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Log data | IP address, browser type, pages visited | Security monitoring; debugging | Legitimate interest (Art. 6(1)(f)) |
| Product usage analytics | Feature usage events, session duration | Improving the Service | Legitimate interest (Art. 6(1)(f)) |
3.3 Customer Business Data
When you use ainventry to manage your business operations, you enter business data that may include personal data about your contacts. For this Customer Data, you are the data controller and ainventry acts as your data processor. We process it only on your documented instructions. Where required, a Data Processing Agreement (DPA) is available on request.
3.4 QuickBooks Online Integration Data
If you connect your QuickBooks Online account to ainventry, we access customer records, vendor/supplier records, and inventory items from your QuickBooks Online company, strictly within the scope of the OAuth authorisation you grant. OAuth credentials (access token, refresh token) are stored encrypted at rest using AES encryption via a dedicated key. QuickBooks Online data is used solely to provide the core ainventry service features you have authorised. It is never sold or shared for any other purpose.
Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.
4. AI assistant and Large Language Model Processing
The Service includes an AI assistant powered by large language models provided by Anthropic, PBC (“Anthropic”). When you interact with the AI assistant, your natural-language commands and relevant context are transmitted to Anthropic's API. Anthropic processes this data as a subprocessor of ainventry. We do not use your data to train AI models.
5. How Long We Keep Your Data (Retention)
| Data category | Retention period | Reason |
|---|---|---|
| Account data | Duration of subscription + 90 days post-cancellation (indicative; subject to change), then deleted | Contract; data export window |
| Customer Data | Same as account retention; earlier deletion on written request | Contract |
| QuickBooks OAuth tokens | Deleted immediately upon disconnection | No longer needed |
| Billing records | Up to 6 years, as required by Spanish tax law (indicative; subject to change) | Legal obligation (Spanish Ley 58/2003 General Tributaria) |
| Log data | Up to 90 days (indicative; subject to change) | Security and debugging |
6. Who We Share Your Data With
We do not sell personal data. We share data only with: subprocessors necessary to operate the Service; Intuit Inc. (when you use the QuickBooks Online integration); and as required by applicable law.
7. International Data Transfers
Some of our subprocessors are located outside the European Economic Area (EEA), including in the United States (Railway, Cloudflare, Anthropic, Resend). Where we transfer personal data outside the EEA, we rely on Standard Contractual Clauses (SCCs) as adopted by the European Commission (Decision 2021/914).
8. Subprocessors
We use subprocessors to operate the Service. A full, maintained list is published at ainventry.com/legal/subprocessors.
| Processor | Purpose | Region |
|---|---|---|
| Railway | Backend hosting and database | United States |
| Cloudflare | Frontend hosting and CDN | Global (EEA + US) |
| Anthropic | AI assistant LLM processing | United States |
| Resend | Transactional email | United States |
| Intuit Inc. (QuickBooks Online) | Accounting data sync (conditional) | United States |
9. Your Rights
As a resident of the EU/EEA or UK, you have rights including: Access, Rectification, Erasure, Restriction, Portability, Objection, and the right to Lodge a Complaint with your supervisory authority. Our lead supervisory authority is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain — www.aepd.es. UK residents may also contact the ICO: ico.org.uk.
To exercise any of these rights, contact us at andreidiachenko95@gmail.com. We will respond within 30 days.
10. Cookies and Tracking
ainventry uses strictly necessary cookies (session, CSRF, authentication JWT) that are required for the Service to function, plus optional analytics cookies (with consent). We use a cookie consent mechanism on our marketing site to obtain your consent before setting non-essential cookies.
11. Data Security
Our technical and organisational measures include: TLS 1.2+ encryption in transit, AES encryption at rest for sensitive data, multi-tenant data isolation at the database query level, and no logging of credentials or OAuth tokens. See our Security page for full details.
12. Data Breach Notification
In the event of a personal data breach, ainventry will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by GDPR.
13. Children's Data
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be communicated by email or in-app notice at least 30 days before they take effect.
15. Contact
For any privacy-related questions or to exercise your rights:
Andrei Diachenko (autónomo)
Calle Covera 19, 5A, 33012 Oviedo, Asturias, Spain
Email: andreidiachenko95@gmail.com
No DPO appointed (not required at current scale — see Section 1). Privacy enquiries go to the email above; we respond within 30 days.