Yordan Creatives.

Privacy Policy

Yordan Creatives · last updated 25 October 2026

This policy explains what personal data is collected through yordaan.com and through the invoicing application described on that site, why it is collected, where it is kept, and what you can ask us to do with it.

1. Who is responsible

Yordan Creatives is the trading name of Yordan Mihaylov, a sole trader (eenmanszaak) registered in the Netherlands:

  • KvK number: 42180735
  • VAT number (btw-id): NL005560897B23
  • Address: Zonnestein 142, 1181 MA Amstelveen, Netherlands
  • Email: Yordancreatives@gmail.com
  • Phone: +31 6 288 497 35

In the language of the GDPR (Algemene verordening gegevensbescherming, AVG), we are the controller (verwerkingsverantwoordelijke) for the data described here. There is no Data Protection Officer, because a business of this size is not required to appoint one. Questions and requests about privacy go to the email address above, and are handled by the owner.

2. What this policy covers

Two things:

  1. This website (yordaan.com). It is a set of static pages. There is no login, no contact form and no account on the site itself.
  2. The invoicing application. Software operated by us that turns recorded work into invoices. It is in development, has a single account, and has registration disabled.

It does not cover other websites, including Google, whose own privacy policy applies to your use of their services.

3. What personal data the application processes

The application is used to prepare and issue invoices, so most of what it holds is business records. Under the GDPR, a sole trader's name, address and VAT number are still personal data when they identify a person, so we treat the whole record as personal data and protect it accordingly.

Client and contact details. Company or trading name, address, contact person, email address, telephone number, VAT number (btw-id), Chamber of Commerce number, and any purchase order or reference number a client requires on its invoices.

Invoice data. Invoice number, invoice date, due date, a description of the work and the dates it was carried out, quantities and day rates, amounts excluding VAT, the VAT rate or the reverse-charge statement, the total, payment status, and any credit note or correction linked to the invoice.

Work schedule data. The dates, times, location and project name of shifts. This comes either from a schedule feed published by the client, or from the owner's own Google Calendar when the owner connects it.

Email content. The recipient address, subject line and text of the email that sends an invoice, held only until the email is sent.

Account data. One login email address and a password. The password is stored as a hash by the authentication provider; we never see it in readable form.

Documents. The invoice PDFs themselves, which repeat the client details and invoice data above.

The application does not ask for, and does not want, special categories of data (such as health data), and it is not used to build profiles of individuals.

4. Google user data: what is accessed and why

The application connects to the owner's own Google account, with the owner's permission, given on Google's consent screen. It requests access to three Google services, and only uses them for the purposes below.

Google Drive. To store invoice PDFs in a folder structure per client, so that an issued invoice can be found and attached to an email later. Access is limited to the folders and files the application creates; it does not open, read or index other files in the Drive.

Google Calendar. To read the owner's work schedules, so that shifts can be matched to a client and a project and turned into invoice lines without being retyped. When the owner chooses to add a work entry from the application, a matching calendar entry is created in the same calendar.

Gmail. To send the invoice email from the owner's own Gmail address, with the invoice PDF attached. The application sends mail; it does not read the mailbox, and it does not scan incoming messages.

The permission token that allows this access is stored on the server side, not in the browser, and can be revoked at any time by the owner from the Google Account permissions page or by disconnecting the account in the application. Revoking it stops all further access.

5. How Google user data is used — and how it is not

Google user data is used only to provide the functions described in section 4: storing invoice documents, reading work schedules, and sending invoice emails that the owner has chosen to send.

We do not:

  • sell, rent or trade Google user data, or any other personal data — it is never sold;
  • use Google user data for advertising, ad targeting, retargeting, or to build advertising audiences;
  • use Google user data to determine creditworthiness, or for lending purposes;
  • use Google user data to train, fine-tune or otherwise develop artificial intelligence or machine-learning models, whether general or specialised;
  • allow humans to read Google user data, except: where the owner has given explicit consent to read a specific item for support; where it is necessary for security purposes, such as investigating abuse; or where required by law — and then only the minimum necessary;
  • transfer Google user data to third parties except where necessary to provide or improve user-facing features that are visible in the application, to comply with applicable law, or as part of a merger, acquisition or sale of assets — and never for advertising or for a purpose unrelated to the one it was collected for.

6. Limited Use statement

The application's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Legal basis for processing

Under article 6 of the GDPR:

  • Performance of a contract (art. 6(1)(b)) — processing client and invoice data to carry out work and issue an invoice for it.
  • Legal obligation (art. 6(1)(c)) — keeping invoices and business records for the period Dutch tax law requires (see section 10).
  • Legitimate interest (art. 6(1)(f)) — running and securing the business and the application: keeping the records accurate, preventing misuse, keeping the system working. Where this basis is used, the interest is the ordinary interest of a small business in keeping correct books, and it does not override the rights of the people concerned.
  • Consent (art. 6(1)(a)) — connecting a Google account, which is a choice and can be undone at any time. Withdrawing consent stops further access to that account; it does not affect processing that already happened.

8. Who else is involved

We do not sell data and we do not share it for marketing. A small number of service providers process data on our instructions, under a data processing agreement where the law requires one:

  • Google Ireland Limited — the Google APIs (Drive, Calendar, Gmail) that the application uses.
  • Supabase — database, file storage and authentication. The project is hosted in the European Union (Ireland).
  • GitHub — hosts the static front end of the application. It serves code, not client or invoice content.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on the safeguards those providers have in place, such as the European Commission's standard contractual clauses or an adequacy decision.

Data may also be disclosed where the law requires it — for example to the Belastingdienst in the course of a tax audit, or to a court.

This list may change as the application develops. When it does, this page is updated.

9. How data is stored and protected

  • The application is not a public service. There is one account, registration is disabled, and access is restricted to the account owner. Sign-in is required for every page that shows data.
  • Data is encrypted in transit (TLS) between the browser, the application and the database.
  • Data at rest is encrypted by the hosting and database providers.
  • The database enforces access rules per account, so a request without a valid session returns nothing.
  • Invoice PDFs are held in private storage and in the owner's own Drive. They are not published, indexed or linked publicly.
  • The Google permission token is held server-side, not in the browser.

No system is perfect. We cannot promise that a breach will never happen, but the measures above are chosen so that the data is not reachable without the owner's credentials or a compromise of a provider.

10. How long data is kept

Invoices and business records: seven years. Dutch tax law requires a business to keep its administrative records, including invoices, for seven years (art. 52 AWR, the Algemene wet inzake rijksbelastingen). This is a legal obligation, so an invoice cannot be deleted on request before that period ends.

Work schedule data: kept while it is needed to prepare an invoice, and afterwards only as part of the invoice record (the dates worked and the project). Schedule entries that never became an invoice are removed when they are no longer needed.

Email drafts and content: deleted once the invoice email has been sent. The sent message itself then sits in the owner's own Gmail account, under Google's retention rules and the owner's control.

Account data: kept while the account exists. If the application is discontinued, the account and its data are deleted, except for records that must be kept under the seven-year rule.

Google tokens: kept until the Google account is disconnected or the permission is revoked.

11. Your rights

If you are in the European Union, you have the right to:

  • access the personal data held about you, and receive a copy (art. 15 GDPR);
  • correct data that is wrong or incomplete (art. 16);
  • delete data, where no legal obligation requires it to be kept (art. 17);
  • restrict processing while a question about the data is being resolved (art. 18);
  • object to processing based on legitimate interest (art. 21);
  • receive your data in a portable format, where the processing is based on consent or contract and is carried out by automated means (art. 20);
  • withdraw consent at any time, where processing is based on consent (art. 7(3)).

How to exercise them. Send an email to Yordancreatives@gmail.com with the subject line "Data request", describing what you want. You do not need to use a form. We will respond within one month. If a request is complex or there are several, that period may be extended by two further months, and you will be told why. If we cannot be sure who is asking, we may ask for information to confirm identity — no more than is needed to answer the request.

There is no charge for a request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse, and will explain why.

About invoice data specifically. If you are a client and your details appear on an invoice, we may not be able to delete that invoice before the seven-year period ends, because keeping it is a legal obligation. In that case we will tell you what is held and why it cannot be removed, and delete anything that is not covered by the obligation.

Complaints. If you think your data has been handled wrongly, you can complain to us first, or directly to the Dutch supervisory authority:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
autoriteitpersoonsgegevens.nl

12. Cookies and tracking

The website does not use analytics, advertising or tracking cookies, and does not embed third-party trackers. If that ever changes, this section and the cookie notice will be updated before the change goes live.

The application uses only what is needed to keep a signed-in session working. It does not use cookies to follow you across other sites.

13. Children

The site and the application are business tools. They are not intended for, and are not directed at, children, and we do not knowingly collect data about children.

14. Changes to this policy

This policy may change as the application changes. The version on this page is always the current one, with the date at the top. If a change materially affects how Google user data is used, we will state that clearly on this page rather than only changing the date.

15. Contact

Yordan Creatives
Zonnestein 142, 1181 MA Amstelveen, Netherlands
Yordancreatives@gmail.com
+31 6 288 497 35

← Back to Yordan Creatives