Privacy Policy

Version 2026-09-17 · Last updated: 17 September 2026 · Versión en español

This policy explains how the mobile app EU VAT Calculator - EHERO (Spanish name: Calculadora IVA UE - EHERO; home-screen name "EHERO IVA UE"; app ID com.ehero.ivaue) for iOS and Android, and the EHERO servers that power it, process personal data. It is published at https://api-iva.cehero.com/privacy, and the Spanish version at https://api-iva.cehero.com/privacidad. Our website and other services are covered by our general privacy policy. In case of discrepancy, the Spanish version prevails.

1. Summary

2. Controller

Consultoría EHERO S.L.U. ("EHERO"), tax ID B72671100, Rúa Emilia Pardo Bazán 25 A2, 36204 Vigo (Pontevedra), Spain. Email: info@consultoriaehero.com.

3. Data, purposes and legal bases

3.1. Installation ID and service operation

The app generates a random ID (UUID), stores it on the device and sends it with each request. Linked to it we record the platform, app version and language when sent, sign-up and last-activity dates, a test-install flag and your analytics preference. Our server also receives your IP address and technical request data. We use this to provide the features you use, apply usage limits, protect the service against abuse and fraud, and count new and active installations in aggregate. We count, in aggregate and without identifiers, how many times the app is opened and its features are used per day and platform, to size and improve the service. Those counts only store the date, platform, app version and feature used (for example, app open, calculation or VIES check): they do not include the installation ID, IP address or any other data that could link them to you. We do not use IDFA, Android advertising ID, IMEI, MAC address or serial number, and we do not try to recognise you across reinstalls. Legal basis: providing the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in security and aggregate usage statistics (Art. 6(1)(f)).

3.2. VAT calculation

The app sends the case data to our server: seller and customer countries, customer type, transaction type, current and previous-year distance-sales bands, single-establishment and destination-election answers, special cases selected, the VIES outcome (without the number), the amount and whether it is net or gross. The result is returned without storing the case or the amount. Offline, the app calculates on the device. Legal basis: Art. 6(1)(b).

3.3. VIES VAT number check

The app sends the country and VAT number (and, as requester, the same number or another company's VAT number you enter), encrypted in transit, to our server, which forwards the query to the European Commission's VIES system and the relevant tax administration (for XI, Northern Ireland, the UK tax authority). The response may include validity, the official date, a consultation reference and the trader's name, address and company type when disclosed. EHERO does not store, cache, log or use in analytics the queried or requester VAT numbers or the returned identity, not even hashed. On the device, the result stays in memory while you use it (up to 15 minutes in the iOS calculator). Legal basis: Art. 6(1)(b); for the business whose number is checked, the legitimate interest in verifying intra-EU VAT numbers (Art. 6(1)(f)). See section 10.

3.4. PDF record

The VIES PDF record is generated entirely on your device as a protected temporary file excluded from backups and deleted when you leave the check. It is never sent to EHERO. If you share it, the app or service you choose handles it under your control.

3.5. Local history

History stays in the app's private storage, is excluded from device backups and is never synced with EHERO. It contains calculation details (date, countries, customer and transaction type, rule, VAT country and rate, resulting amounts). On Android it may also list VIES checks with the country, outcome and a masked number (last characters only), never the trader's name or address. Free keeps 3 entries; Pro up to 100. Delete it in History, via Delete my data, or by uninstalling.

3.6. Optional first-party analytics

Off by default. If you enable it in Settings, the app sends usage events (app open, calculation or VIES check completed, recommendation shown or tapped, report or contact requested, store opened) with the installation ID, a random session ID, time, screen, platform, version, language and closed-list values (tax rule, transaction type, outcome, customer or checked-number country, recommendation placement and campaign, error code, amount band). Events never include VAT numbers, names, addresses, email, phone, exact amounts or free text. They are pseudonymous because they are linked to the installation ID. Turning analytics off stops sending and deletes events already linked to your installation. Regardless of this setting, last-activity dates let us count new and active installations, the aggregate counts without identifiers described in section 3.1 record how often the app is opened and its features are used, and taps through our redirect link are counted without your ID. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

3.7. EHERO recommendations

The app may show up to two recommendations for EHERO's own products and a solutions catalogue. On Android they only appear in the Solutions tab; on iOS they may also appear after a result. They are chosen by placement, platform, language and Pro status, and we record which variant was assigned to your installation. No profiling, no data from other apps, no sharing with advertisers. Links open consultoriaehero.com in your browser, where our general and cookie policies apply; campaign parameters are added, not your ID. Legal basis: legitimate interest (Art. 6(1)(f)); you may object by emailing us.

3.8. EHERO VAT Pro and purchases

Pro is bought through the App Store or Google Play, which process your store account, payment, billing and refunds as independent controllers. We receive no card details, name or store email. To activate, restore and maintain Pro, the app sends the store purchase identifier (iOS: original transaction ID; Android: purchase token) and the product. Our server verifies it with Apple (App Store Server API) or Google (Google Play Developer API) and stores a SHA-256 fingerprint (not the identifier itself), product, platform, status, expiry, auto-renew flag and last verification date. One purchase can activate Pro on up to five installations, which are linked by that fingerprint. On iOS and Android the app checks automatically at launch for an active subscription. Google may notify us of renewals, cancellations or refunds. Cancel in your Apple or Google Play account (see our support page); deleting data or uninstalling does not cancel it. Legal basis: contract (Art. 6(1)(b)) and fraud prevention (Art. 6(1)(f)).

3.9. Email reports (Pro)

When available, we process the email you enter and a summary (rule, VAT country, rate, rate-set version and, if applicable, an amount band), without VAT numbers or exact amounts; the VIES PDF is not emailed. Data is stored encrypted until sent from soporte@consultoriaehero.com via ZeptoMail, Zoho's transactional email service (section 6), then deleted. Requesting a report does not subscribe you to marketing. Legal basis: Art. 6(1)(b).

3.10. Contact requests and marketing

In Solutions you can provide your email (and, on iOS, an optional name) and your area of interest, and tick separately, unticked by default: contact about the selected solution (pre-contractual steps at your request, Art. 6(1)(b); not added to campaigns) and/or the practical guide and EHERO marketing emails (consent, Art. 6(1)(a) GDPR and Art. 21 Spanish LSSI; confirmed by a verification email). We also record language, platform, the accepted text, date and policy version; no calculation data, VAT numbers or amounts are attached. Our server delivers the request, signed and authenticated, to EHERO Leads Manager on our own website; the encrypted intermediate copy is deleted once delivery is confirmed. Leads Manager keeps status, dates, interest tags and, for marketing, open and click statistics and an interest score. Every marketing email has an unsubscribe link.

3.11. Contacting EHERO

If you email us, we process your address, message and any data needed to answer or verify your identity (Art. 6(1)(b) and 6(1)(c)).

4. Data stored on your device

The app uses no cookies. It stores the installation ID, language, analytics preference, cached Pro status, downloaded rate set and history, all needed for the features you request; analytics sending depends on your consent. On Android the ID and history are excluded from backups; on iOS the history is. This web page uses no cookies or third-party resources either.

5. Automated decision-making

Programmed rules produce indicative VAT guidance and select recommendations. No decisions with legal or similarly significant effects are made (Art. 22 GDPR). Results are not tax advice; uncovered cases are flagged for professional review.

6. Recipients and processors

• OVH SAS (France): hosting for the app server and our website with Leads Manager (processor).
• Zoho Corporation B.V. (Netherlands), through its ZeptoMail service: email reports sent from our server once that feature is active (processor).
• Our website's email delivery provider: Leads Manager verification and marketing emails (processor).
• Google Ireland Limited (Google Workspace): our mailbox (processor).
• European Commission (VIES) and Member State tax administrations (and the UK for XI numbers): the VIES query you request.
• Apple (Apple Distribution International Ltd. and Apple Inc.) and Google (Google Ireland Limited and Google LLC): distribution, payments, purchase verification and subscription notifications, as independent controllers (Apple privacy policy, Google privacy policy).
• Public authorities and courts where required by law.

We do not sell or rent data or share it with advertisers. Processors act under Art. 28 GDPR contracts.

7. International transfers

Our servers are in the EU. Transfers outside the EEA may occur when checking XI numbers (United Kingdom, covered by an EU adequacy decision); when verifying purchases with Apple Inc. or Google LLC (United States, certified under the EU-US Data Privacy Framework, adequacy decision of 10 July 2023); and when Zoho (ZeptoMail, served from Zoho's EU data centres) or our other email providers use group companies or sub-processors outside the EEA, for example for technical support or security, relying on adequacy decisions such as the Data Privacy Framework or on Art. 46 GDPR safeguards such as the EU Standard Contractual Clauses. Apple and Google apply their own safeguards to store and payment data. Ask us for details at info@consultoriaehero.com.

8. Retention

• Installation record and recommendation assignments: until you use Delete my data or after 24 months of inactivity.
• IP or ID fingerprints for rate limiting: up to 24 hours. Server logs: up to 30 days unless needed for a security incident.
• Calculation cases and VIES checks: not stored on our servers.
• Analytics events: 90 days or until you turn analytics off; anonymous daily aggregates may be kept indefinitely.
• Pro record: while the installation record exists, and no longer than 24 months after the subscription expires.
• Email reports: until sent, maximum 7 days. Intermediate copy of contact or marketing requests: until delivery is confirmed, maximum 30 days.
• Marketing: until you unsubscribe or withdraw consent (unconfirmed sign-ups deleted after 30 days; unsubscribed addresses kept on a suppression list). Contact requests: 12 months after the last interaction unless a contract follows. Detailed open and click data: 90 days.
• Proof of consent, unsubscription and rights requests: blocked for 3 years for legal defence only.
• On-device data: until you delete it or uninstall the app.

9. Your rights

You have the rights of access, rectification, erasure, objection, restriction and portability, and may withdraw consent at any time.

Settings › Delete my data immediately deletes local history and asks our server to delete your installation record and everything linked to it (analytics preference and events, recommendation assignments, Pro records, pending reports and intermediate contact copies). If offline, only the ID is kept to retry. It does not cancel your subscription, delete Apple or Google data, remove an email you gave us for contact or marketing (use the unsubscribe link or email us) or affect anonymous aggregates. Using the app again creates a new unrelated ID; an active subscription is linked to the new installation when you restore it or, automatically, when you open the app again.

By email: write to info@consultoriaehero.com with the subject "Privacy EU VAT app". For email-linked data, write from that address; we may ask for information needed to verify your identity. We reply within one month (extendable by two months for complex requests).

You can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to your local supervisory authority.

10. If your VAT number was checked

An app user may check your VAT number in VIES. We then process, only during the query, your VAT number and the data your tax authority discloses through VIES (validity, name, address, company type) to return the result to that user, based on the legitimate interest in verifying intra-EU VAT numbers (Art. 6(1)(f)). Unless the user enters another requester, your own VAT number is also sent to VIES as the requester number. EHERO keeps none of this data and cannot link past checks to your number; the result may remain on the user's device or in a record they choose to share. Contact info@consultoriaehero.com to exercise your rights, including objection.

11. Children

The app is intended for professionals, businesses and people aged 18 or over. It is not directed at minors and we do not knowingly collect their data; if we learn that a minor has provided personal data, we will delete it.

12. Security

We use HTTPS/TLS for all connections, closed data lists, encryption of pending emails and requests, cryptographic fingerprints for purchase identifiers, HMAC-signed server-to-server delivery, no-store VIES responses, rate limits, access controls and on-device file protection with backup exclusion for history and records. No system is fully secure; we review these measures and will handle any breach under Articles 33 and 34 GDPR.

13. Changes

We will publish every version on this page (https://api-iva.cehero.com/privacy) with its number and date. For significant changes (new purposes, data types or recipients) we will also inform you in the app beforehand and ask for consent again where required. Contact and marketing requests record the policy version in force when submitted. Previous versions are available on request.

Version 2026-09-17 · Last updated: 17 September 2026.