Compliance · Article 11.1
GDPR: what Clozo stores about you, why, and for how long
Clozo runs 13 distinct processing activities under GDPR Art. 30. Each one has a documented purpose, a lawful basis under Art. 6(1), a recipient list, and a retention window. This article is the user-facing summary of our Records of Processing Activities.
The General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) requires every controller to maintain a documented register of every processing activity it performs (Art. 30). The register names the purpose, lawful basis, data categories, recipients, retention windows, and security measures. Clozo's full register lives in docs/compliance/RoPA.md — this article gives you the user-readable summary so you know exactly what we hold and why.
Why this works this way
Clozo is the data controller for your account (you, the freelancer). For data about your clients — names, email addresses, billing details on the invoices you issue — you are the controller and Clozo is the processor. That distinction matters because client-data subject requests (export, erasure) come to you first and you decide how to respond; Clozo gives you the tooling to fulfil them but doesn't own the relationship. See article 11.7 for the practical workflow.
From 2026-05-19 (production launch trigger), Clozo also implements the legal retention foundation per [A-021..A-027]: a multi-step Celery saga for GDPR cascade erasure (DB-only steps first, then external Stripe / R2 side-effects), Stripe Connect deactivation (not deletion) at erasure time so AEAT requerimientos in years 6–10 can still be answered via stripe_account_id, pseudonymisation that retains vat_number and company_name (EU VAT Directive Art. 226(10) + Art. 244 require these on retained invoices), HMAC-SHA-256 lookup User.email_hmac so a former user can be matched to their row years after anonymisation, and a public /recover-invoice endpoint with strong anti-enumeration for third-party clients to retrieve their own legally-retained invoices in 2031+.
The 13 active processing activities, grouped by lawful basis under Art. 6(1):
Art. 6(1)(b) Contract — the data we must process to deliver the service: 1. User account creation — email, name, country, locale, password hash. Retained until account deletion + 30-day grace. 2. Invoice generation — your business identity + your client's billing data + line items. Retained 10 years under EU VAT Directive 2006/112/EC Art. 244. 3. Subscription billing — Stripe customer ID, plan, billing email, billing address. Retained 10 years under Spanish LGT 58/2003 + EU VAT Directive (we are Spain-controlled). 4. Payment processing (Stripe Connect) — payer name, billing address, payment method token, transaction amount. Clozo holds only the PaymentIntent ID and status; Stripe holds card data per their PCI-DSS scope (~7 years per their policy). 5. Transactional email (Resend) — recipient email + name + message body. Delivery logs 1 year; email bodies not retained beyond the send queue.
Art. 6(1)(c) Legal Obligation — the data the law requires us to keep: 6. VAT validation (VIES) — VAT number + country code, validated against the European Commission's VIES SOAP service. Cached 24 hours. 7. GDPR self-service endpoints — identification + contact + billing + operational data needed to fulfil Art. 15 / 17 / 20 requests. Tokens cleared on first use or after 14 days. 8. R2 file ledger — every PDF or e-invoice XML object the system stores. Required by GoBD §147 AO (Germany, 10 years), eIDAS Art. 34 (10-year signature audit), and EU VAT Directive Art. 244. Ledger row outlives the blob. 9. Admin audit log — every state-mutating admin action on user data. Required by Art. 5(2) accountability. Retained for the lifetime of the affected data subject's account.
Art. 6(1)(a) Consent — strictly opt-in, can be revoked any time:
10. Marketing attribution (Google Ads + GA4) — click IDs, SHA-256-hashed email/phone for Enhanced Conversions, GA4 client_id, transaction value. Retained 13 months on GA4 (project setting). High-risk processing — we maintain a DPIA at _scratch/DPIA_marketing_attribution.md (pending counsel review).
11. Product analytics (PostHog) — pseudonymous distinct_id, page views, feature events, country (city resolution disabled). Retained 13 months. Ingest is on EU servers (eu.i.posthog.com).
Art. 6(1)(f) Legitimate Interest — balanced against your rights: 12. Security logs — source IP, user-agent, request path, response code, auth outcome. Retained 14 days (Railway log retention). 13. Customer support chat (Crisp) — email, name, chat content. Retained 2 years from last message; deleted on customer request. Crisp is hosted in France (EU jurisdiction).
Troubleshooting
Keep reading
Compliance
eIDAS: what makes a Clozo signature legally binding in the EU
EU Regulation 910/2014 (eIDAS) defines three signature levels and gives each a clear legal weight. Clozo issues an Advanced Electronic Signature (AES) under Art. 3(11) — equivalent to a handwritten signature for almost all freelancer contracts.
Compliance
10-year retention: GoBD §147 AO and its EU equivalents
Tax-relevant documents — invoices, receipts, signed agreements, payment records — must be available to a tax-office inspector for ten years. Clozo enforces this server-side across every EU jurisdiction.
Compliance
Data-subject requests: how clients exercise GDPR rights and what you must do
Articles 15–22 GDPR give your clients the right to access, correct, port, or erase the personal data you hold about them. As a controller of *your* clients' data, you have one month to respond. Clozo's tooling helps you answer each request efficiently.
Compliance
Sub-processors: who Clozo uses, where data goes, and why it's safe
Clozo uses 11 sub-processors to deliver the service; 6 are EU-based, 5 are US-based with active EU-US Data Privacy Framework certification + Standard Contractual Clauses + supplementary measures documented in our Transfer Impact Assessment.