Effective 2026-10-29

Exportable Data

This page lists the data of the Service that you can export, and the formats you receive it in. It is the list referred to in Section 14 of the Terms of Service ("Switching to another provider") and in the Privacy Policy. Capitalised terms have the meaning given in the Terms.

1. How to export

Use Export your data in the account settings. You receive one ZIP archive. Each data file in it holds one JSON object per line (newline-delimited JSON, UTF-8), and a manifest file in JSON lists the files and the time of the export. Times are given in ISO 8601 format with their offset from UTC.
The Account Owner receives the Account's data (Sections 2 and 3) and their own personal data (Section 4). An Authorised User receives their own personal data only (Section 4).
The self-service export can be used once every thirty days, except during a switch to another provider and the retrieval period that follows it, and on the page where the Account Owner confirms closing the Account; in those cases the thirty-day limit does not apply, and the export can be used again five minutes after the previous one. If you need an export sooner, contact us at contact@byteimagination.com and we provide it without undue delay and within thirty days, for as long as the data exists.

2. Data of the Account

Users of the Account — the email address and role of the Account Owner and of every Authorised User, and the date each joined.
API Keys of the Account — for each key: its visible prefix, its label, whether it is active, and when it was created, revoked and last used. The key itself is never included.
Subscriptions — the plan, the status and the dates of each Subscription of the Account.
API usage records — for each authenticated API request of the last 365 days: when it was made, the visible prefix of the API Key used, the IP address and the user agent.
API request logs and usage counters — logs of API requests (kept for 30 days) and quota and rate-limit counters are not in the self-service archive; we provide them on request at contact@byteimagination.com without undue delay and within thirty (30) days, for as long as we hold them. A request about your own personal data can also be sent to privacy@byteimagination.com under Art. 15 GDPR, which has its own time limit of one month.

3. Data of the Service

Numbering series — for each series, including series deleted since: its identifier, its name, its format, the next value it will issue, when it was created and last modified, and when it was deleted, if it was.
Numbering activity log — every recorded operation on the Account's series, including series deleted since: the series, the details of the operation, when it happened, and the visible prefix of the API Key that performed it, and, for 365 days, the IP address from which it was performed.
National e-invoicing operation records — for each recorded operation: its type and outcome, the environment (test or production), the session and invoice reference numbers, the number the national system assigned, its status code, further details of the operation, and when it happened, and, for 365 days, the IP address from which it was performed.

While the Subscription is active, you can also read the current state of each numbering series through the API. After it ends the API is not available (Section 6 of the Terms of Service), and the export is the way to retrieve your data. Invoices themselves are stored by the national e-invoicing system, not by us, and you retrieve them from it, including through the Service's API.

4. Your personal data

your account details — email address, role, and when your user account was created and your email address was verified;
your records of accepting legal documents — the document, its version, when and how you accepted it, and the language shown to you;
the API Keys you created, described as in Section 2;
actions performed in the panel by you, and actions performed with API keys you created — when, what kind of action, and which item it concerned — without the content of the Customer's data.

5. What is not included

API Keys and their cryptographic hashes, password hashes, and the single-use tokens sent in emails — these are credentials that secure the Service, not data generated by your use of it;
billing details held by our payment processor as Merchant of Record — you can obtain your invoices and payment records from Paddle;
records of the emails we sent and of their delivery, support correspondence and marketing consent records. We provide them on request at privacy@byteimagination.com where they contain your personal data (Art. 15 GDPR);
the IP addresses and user agents attached to accepted legal documents, which you can request in the same way;
the content of invoices, which we do not store, and the credentials you use to sign in to the national e-invoicing system, which we do not keep;
records kept only to recognise a repeated submission, and records kept only to stay within the national system's limits, which exist for a few days at most.

6. Switching to another provider

How to start a switch, how long it lasts, and how long you can still retrieve the data afterwards is set out in Section 14 of the Terms of Service. We do not charge for switching.

7. Where the data is held

The data of the Service is stored on the infrastructure of DigitalOcean, LLC in Germany (Frankfurt / FRA1 region), under a contract that includes the EU Standard Contractual Clauses. The database storage is encrypted at rest by DigitalOcean, LLC at the level of the storage volume. Backup copies are stored with rsync.net, Inc. in the United States (Fremont, California); they are encrypted on our server before they are sent, with a passphrase that only we hold, so rsync.net stores only encrypted data. Data is encrypted in transit. The Service does not store the credentials you supply to the national e-invoicing system (Additional Terms, Section 2). Only named accounts of our personnel have access to the systems. Emails we send pass through Resend, Inc. (United States), and payments are handled by Paddle in the United Kingdom. Because DigitalOcean, LLC and rsync.net are incorporated in the United States, they may be subject to requests from US authorities; a request to rsync.net can disclose only the encrypted backup copies. The measures above reduce but do not exclude that possibility.

8. Files and fields in the archive

This section lists every file in the archive and the fields of each line in it. The files under organization/ hold the data described in Sections 2 and 3 and are in the Account Owner's archive only. The files under personal/ hold the data described in Section 4 and are in every archive. A field without a value is given as null.

`manifest.json`

The manifest. Unlike the other files, it holds a single JSON object.

Field	Type	Meaning
`schemaVersion`	text	The version of the archive format.
`exportedAt`	date and time	When the export was made.
`tool`	text	The name under which the Service identifies itself in the archive.
`username`	text	The email address of the user who made the export.
`parts`	list of text	The parts the archive holds: `organization`, `personal`, or both.
`entries`	list of text	The data files in the archive.

`organization/members.ndjson`

Users of the Account (Section 2), one line per user.

Field	Type	Meaning
`email`	text	The user's email address.
`role`	text	`OWNER` for the Account Owner, `MEMBER` for an Authorised User.
`joinedAt`	date and time	When the user joined the Account.

`organization/api-keys.ndjson`

API Keys of the Account (Section 2), one line per key.

Field	Type	Meaning
`keyPrefix`	text	The visible prefix of the key.
`label`	text	The label given to the key.
`active`	true or false	Whether the key can be used.
`createdAt`	date and time	When the key was created.
`revokedAt`	date and time	When the key was revoked, if it was.
`lastUsedAt`	date and time	When the key was last used, as shown by the API usage records.

`organization/subscriptions.ndjson`

Subscriptions (Section 2), one line per Subscription.

Field	Type	Meaning
`plan`	text	The plan of the Subscription.
`status`	text	The status of the Subscription, such as `ACTIVE`, `PAST_DUE` or `CANCELED`.
`createdAt`	date and time	When the Subscription was recorded.
`currentPeriodStart`	date and time	When the current billing period started.
`currentPeriodEnd`	date and time	When the current billing period ends.
`pastDueSince`	date and time	Since when a payment has been overdue, if one is.
`suspendedAt`	date and time	When the Subscription was suspended, if it was.
`canceledAt`	date and time	When the Subscription was cancelled, if it was.

`organization/api-usage.ndjson`

API usage records (Section 2), one line per authenticated API request of the last 365 days.

Field	Type	Meaning
`usedAt`	date and time	When the request was made.
`keyPrefix`	text	The visible prefix of the API Key used.
`ipAddress`	text	The IP address the request came from.
`userAgent`	text	The user agent sent with the request.

`organization/invaro-series.ndjson`

Numbering series (Section 3), one line per series, including series deleted since.

Field	Type	Meaning
`id`	number	The identifier of the series, used as `seriesId` in `organization/invaro-series-events.ndjson` and as `resourceId` in `personal/activity.ndjson`.
`friendlyName`	text	The name of the series.
`format`	text	The format of the numbers the series issues.
`nextValue`	number	The next value the series will issue.
`createdAt`	date and time	When the series was created.
`modifiedAt`	date and time	When the series was last modified.
`deletedAt`	date and time	When the series was deleted, if it was.

`organization/invaro-series-events.ndjson`

Numbering activity log (Section 3), one line per recorded operation.

Field	Type	Meaning
`seriesId`	number	The `id` of the series concerned in `organization/invaro-series.ndjson`.
`series`	text	The name of the series concerned. A deleted series may share its name with a later one; `seriesId` tells them apart.
`details`	JSON object	The details of the operation, including its kind as `action`.
`recordedAt`	date and time	When the operation happened.
`apiKeyPrefix`	text	The visible prefix of the API Key that performed it.
`ipAddress`	text	The IP address it was performed from, for 365 days; `null` after that.

`organization/invaro-ksef-events.ndjson`

National e-invoicing operation records (Section 3), one line per recorded operation.

Field	Type	Meaning
`eventType`	text	The type of the operation.
`outcome`	text	The outcome of the operation.
`environment`	text	The environment of the national system: test or production.
`sessionReferenceNumber`	text	The reference number of the session.
`invoiceReferenceNumber`	text	The reference number of the invoice.
`ksefNumber`	text	The number the national system assigned.
`ksefStatusCode`	text	The status code the national system returned.
`details`	JSON object	Further details of the operation, or `null`.
`createdDate`	date and time	When the operation happened.
`ipAddress`	text	The IP address it was performed from, for 365 days; `null` after that.

`personal/account.ndjson`

Your account details (Section 4), one line.

Field	Type	Meaning
`username`	text	Your email address.
`role`	text	Your role in the Account: `OWNER` or `MEMBER`.
`accountCreatedAt`	date and time	When your user account was created.
`emailVerifiedAt`	date and time	When your email address was verified.

`personal/legal-acceptances.ndjson`

Your records of accepting legal documents (Section 4), one line per accepted version.

Field	Type	Meaning
`document`	text	The document you accepted.
`version`	text	The version you accepted.
`acceptedAt`	date and time	When you accepted it.
`method`	text	How you accepted it: `SIGNUP` when you created your user account, `EXPLICIT_UPDATE` on the acceptance page, or `IMPLICIT_MIGRATION` when it was recorded for a user account that existed before the document was first published.
`locale`	text	The language the document was shown in.

`personal/api-keys.ndjson`

The API Keys you created (Section 4), one line per key.

Field	Type	Meaning
`keyPrefix`	text	The visible prefix of the key.
`label`	text	The label given to the key.
`active`	true or false	Whether the key can be used.
`createdAt`	date and time	When the key was created.
`revokedAt`	date and time	When the key was revoked, if it was.
`lastUsedAt`	date and time	When the key was last used, as shown by the API usage records.

`personal/activity.ndjson`

Actions performed in the panel by you, and actions performed with API keys you created (Section 4), one line per action.

Field	Type	Meaning
`occurredAt`	date and time	When the action was recorded.
`action`	text	The kind of action.
`resourceType`	text	The kind of item the action concerned, or `null` when it names none.
`resourceId`	text	The identifier of that item, or `null`. In the Account Owner's archive it is the `id` of the item's line in the `organization/` files; an Authorised User's archive has no `organization/` files, so there it identifies the item only.