Privacy

Short, because there is little to describe. Two forms collect an email address, and the hosted API processes invoices without storing them. Nothing else about you is stored deliberately.

Invoice data sent to the API

This is the part that matters most if you are integrating, so it goes first.

An invoice you send to api.attestwire.com is processed in memory and never stored. It is parsed, validated or generated, and answered; when the response is written the payload is gone. There is no database of invoices, no cache, no queue and no backup holding one. Responses carry Cache-Control: no-store. Payloads are never used to train anything — the engine is deterministic TypeScript, and we send payloads to no third party.

We do not log invoice payloads in normal operation. Error traces are scrubbed of payload values. What we keep for an API account is an email address, a tier, and a request count per key — nothing about the documents themselves.

The full detail, including where processing physically happens and who our subprocessors are, is on the security page. If you need a GDPR Article 28 processor agreement, one is written: the data processing addendum.

What we collect, and where

Two places on our properties take an email address:

• The "need more than 100 documents a month" form on this site (attestwire.com). It was a waitlist for the hosted API until that opened; the store and its shape have not changed.
• The update list on the French E-Invoicing Checker (check.attestwire.com), a free tool we build.

Both store the same three things, and only these:

Email address

Lowercased, and used as the storage key — so a second submission updates nothing rather than creating a duplicate.

Timestamp

ISO 8601, of your first submission. Later submissions do not overwrite it.

Source

A short label such as home or waitlist-page, so we know which form you used.

The email forms do not record your IP address, user agent, referrer, name, company, or anything you did not type into the box. There is no account, no password, no profile.

One place IP addresses are used: the hosted API applies abuse-prevention rate limiting keyed on the calling IP address — today on the key-issuing endpoint, so that one caller cannot mint unlimited free keys. That is a counter that resets daily, not a record of you, and it is not joined to an account or to anything else.

Why

To reply to you about the thing you asked about, and nothing else. That is the entire purpose: no drip sequence, no newsletter, no marketing automation. Under the GDPR the lawful basis is your consent (Art. 6(1)(a)), given by submitting the form. You can withdraw it at any time and we delete the record.

Cookies and analytics

None. We set no cookies, use no local storage, and run no analytics product — no Google Analytics, no Plausible, no pixels. Every page here loads only from this domain: no fonts, scripts, images or stylesheets are fetched from anywhere else, so no third party learns that you visited.

Who else touches the data

We do not sell, rent, share or trade email addresses, and we send them to no marketing, CRM or advertising service.

One processor is unavoidable, and we would rather name it than claim "no third parties": these sites run on Cloudflare, and the email records are stored in Cloudflare Workers KV. Like any web host, Cloudflare processes the technical details of your request — including your IP address — in order to serve and protect the site. We do not retain those logs as a record of you, and we do not join them to anything.

How long we keep it

Until you ask us to remove it, or until the list has served its purpose and we delete the whole store — whichever comes first.

Getting removed, or getting a copy

Email hello@attestwire.com from the address you signed up with, or just tell us which address to look for. We delete it and confirm. No form, no login, no "are you sure" sequence.

The GDPR also gives you the right to access the data we hold, correct it, object to the processing, receive it in a portable form, and lodge a complaint with your national supervisory authority. Ask at the same address; we answer within 30 days, usually the same week.

Contact

Attestwire — hello@attestwire.com. That address reaches a person, and it is the right one for privacy requests, security reports and everything else.

Changes

If this page changes materially we will say so here rather than silently swapping it. Last updated 9 August 2026.