Privacy & Cookies

This Privacy Policy explains how Facturaz S.L. ("Facturaz", "we", "our" or "us") collects, uses and protects your personal data in compliance with:

• EU Regulation 2016/679 (GDPR), and
• Spanish Organic Law 3/2018 (LOPDGDD) on the Protection of Personal Data and Guarantee of Digital Rights.

It applies to the website www.facturaz.es, the Facturaz web application and the Facturaz iOS app (together, the "Platform"), and to all users of our services: visitors, registered users, autónomos and companies.

Using the Platform means you must be at least 18 years old or have sufficient legal capacity to enter into binding contracts.

Facturaz S.L. is a Spanish limited liability company, registered in the Mercantile Register of Valencia with NIF B22962112 and legal address at Calle Barques 2, Planta 2, 46002 Valencia, Spain.

You can contact us at soporte@facturaz.es for any questions related to this Policy.

Facturaz acts as the Data Controller when we collect data directly from you (for example, during registration or billing).

In some cases, we act as a Data Processor. For example, when professional clients use our software to manage their own clients' data. In those cases, we process data strictly according to their instructions (see Section 11).

We may update this Privacy Policy periodically to reflect changes in law, technology, or how we operate.

If updates are significant, we'll notify you by email or directly through the Platform.

Please ensure your personal information remains accurate and up to date. Notify us if your details change during your relationship with us.

Our Platform may contain links to other websites, plug-ins, or applications.

If you click on those links, third parties may collect or share data about you.

Facturaz does not control those websites and is not responsible for their privacy practices.

We recommend reviewing the privacy policy of every external site you visit.

We may collect and store the following categories of personal data:

• Identification data: name, surname(s), DNI/NIE or national ID, date and place of birth.
• Contact data: address, email, phone number.
• Financial and fiscal data: bank account (IBAN), invoices and expenses, payment information, tax details and tax returns, bank statements you upload for reconciliation.
• Professional data: activity type, employment status, or professional affiliations.
• Documents you upload: ID cards, passports, digital certificates, receipts and invoices (images or PDFs), payment proofs, signed authorisations (including technical details of the certificate used to sign them).
• Communications: support messages and emails, conversations with the in-app assistant, phone calls with our support line (which may be recorded).
• Technical data: IP address, browser type, session identifiers, access logs, push notification tokens.

We may also use aggregated or anonymized data for statistical or analytical purposes, which does not identify you personally.

We collect data in two main ways:

a) Direct interactions

When you register, fill out onboarding forms, upload documents, make payments, or contact us by email, chat, phone, or other means.

b) Automated technologies

When you use the Platform, we collect technical data such as IP address or browser type using cookies or similar technologies.

See the Cookies section below for more details.

We process your data only when legally permitted, on the following legal bases:

• Performance of a contract (Art. 6.1.b GDPR): creating and managing your account, providing the Platform and its features, processing payments and issuing invoices, managing free trials, handling customer support, presenting your tax returns to AEAT when you contract the Tax Filing Service.
• Legal obligation (Art. 6.1.c GDPR): tax and accounting obligations, Verifactu invoicing records, responding to lawful requests from public authorities.
• Legitimate interest (Art. 6.1.f GDPR): securing the Platform and preventing fraud and abuse, understanding how the product is used so we can improve it, keeping internal summaries of account activity so our team can help you faster.
• Consent (Art. 6.1.a GDPR): when required, we rely on your explicit consent (for example, for marketing emails or cookie preferences). You can withdraw that consent at any time.

We do not make decisions producing legal or similarly significant effects on you based solely on automated processing.

Some features of the Platform use artificial intelligence:

• Receipt and invoice reading: when you upload a receipt or invoice, the document is processed by an AI model from our provider Anthropic to extract its data (vendor, amounts, taxes). Anthropic processes it under the safeguards described in Section 10 and Section 12 and is not permitted to use your documents to train its models.
• In-app assistant: the assistant processes your account data (for example invoices, expenses and tax positions) to answer your questions.
• Phone support: our telephone support line is AI-assisted. Calls may be recorded and transcribed to handle your request and to improve service quality.
• Internal summaries: we generate internal, AI-assisted summaries of account activity to improve the product and give you better support. These summaries are never shared with third parties for their own purposes.

AI-generated outputs are informational only and do not constitute professional advice. They are not used to make automated decisions with legal effects on you.

If you contract the Tax Filing Service, we additionally process:

• The representation authorisation you sign, including technical details of the digital certificate used to sign it;
• The tax returns you approve and the IBAN you designate for direct debit, which we transmit to AEAT on your behalf;
• The filing receipts (justificantes) issued by AEAT, which we store as evidence of presentation.

This processing is necessary to perform the service you contracted and to comply with the legal obligations attached to it. It is retained for the periods described in Section 14.

We may share your personal data with trusted third parties, only when necessary and under confidentiality agreements:

Technology Providers

• Supabase: database, authentication and file storage (EU region).
• Vercel: application hosting and basic, cookie-free web analytics.
• Stripe: secure payment processing and card storage.
• Anthropic: AI reading of receipts and invoices you upload, plus the in-app assistant.
• Resend: delivery of transactional and account emails.
• Verifacti: transmission of Veri*Factu invoicing records to AEAT.
• Mixpanel: product analytics linked to your account, to understand feature usage.
• Google: Tag Manager and Analytics on the website (no analytics cookies are set before you consent), video calls when you book one (Google Meet) and cloud infrastructure for our phone support service.
• Microsoft Clarity: behavioural analytics (heatmaps, session recordings), loaded only after you accept analytics cookies.
• Twilio: telephone support line and SMS; calls may be recorded.
• Cloudflare: bot protection (Turnstile) on signup and other sensitive forms.
• Upstash: short-lived technical storage used for rate limiting and for relaying documents during mobile signing.
• apilayer: validation of the VAT numbers you enter.
• OpenStreetMap: address suggestions while you type an address.
• Apple: push notifications and Sign in with Apple for iOS app users.

Public Authorities

• Agencia Tributaria (AEAT) or other tax/legal authorities when required by law and, if you contract the Tax Filing Service, to present your returns on your behalf.

Professional Service Providers

• Accountants, tax advisors, or auditors under strict confidentiality obligations.

All third parties handle your data in compliance with GDPR and apply appropriate security safeguards.

When Professional Clients use Facturaz to manage their own customers' data (e.g., invoices or client lists), Facturaz acts as a Data Processor.

In those cases:

• We process data only as instructed by the client,
• We apply strict confidentiality and technical security measures, and
• We comply fully with GDPR and Verifactu requirements.

Professional Clients can review and accept our Data Processing Agreement from the Compliance section of the app.

Some of the providers listed in Section 10 may process or store data outside the European Economic Area (EEA), notably in the United States. This can apply to Anthropic, Stripe, Resend, Vercel, Mixpanel, Google, Microsoft, Twilio, Cloudflare, Upstash, apilayer and Apple.

Such transfers happen only if:

• The destination country or recipient is covered by an adequacy decision from the European Commission (including certification under the EU-U.S. Data Privacy Framework), or
• The provider uses Standard Contractual Clauses (SCCs) approved by the EU to guarantee equivalent data protection.

We use strong technical and organizational security measures to protect your personal data from loss, misuse, or unauthorized access.

These include:

• SSL/TLS encryption for data transmission,
• Access control and monitoring,
• Security logging and intrusion detection,
• Regular infrastructure audits, and
• Encrypted backups and redundancy.

While we take all reasonable precautions, no online system can guarantee absolute security.

If a data breach occurs that could affect your rights, we'll notify you as required by law.

We retain your personal data only for as long as needed for the purposes stated in this Policy or as required by law.

Typical retention periods include:

• Account data: while your account is active and up to 6 years after termination (commercial documentation under Art. 30 Código de Comercio; tax limitation periods under Art. 66 LGT are generally 4 years).
• Invoices and Verifactu records: at least 6 years, as required by Spanish commercial law.
• Tax filing records (representation authorisations, approved returns, filing receipts): at least while the related tax periods remain open to review, generally 4 years.
• Support and communication data, including chat transcripts and call recordings: up to 2 years after resolution.

After the retention period, your data will be securely deleted or anonymized.

Under GDPR, you have the following rights regarding your personal data:

• Access: Obtain a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion ("right to be forgotten") when legally allowed.
• Restriction: Limit the processing of your data in specific circumstances.
• Objection: Object to certain uses, such as direct marketing or processing based on legitimate interest.
• Portability: Receive your data in a structured, machine-readable format.
• Withdraw consent: Withdraw consent at any time when processing is based on consent.

To exercise these rights, email soporte@facturaz.es with a copy of your ID for verification.

If you believe your rights have been violated, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Facturaz services are intended for users aged 18 or older.

We do not knowingly collect personal data from minors.

If we become aware that such data has been collected, we will delete it immediately.

Facturaz uses cookies and similar technologies in the following categories:

• Strictly necessary: secure login, session management and protection against bots and abuse (including Cloudflare Turnstile). These are always active.
• Analytics: Google Analytics, Google Tag Manager, Microsoft Clarity and Vercel Analytics help us understand usage and improve performance. No analytics cookies are set before you accept them: Google's tools run in consent-denied mode until then, Microsoft Clarity loads only after you accept analytics cookies and Vercel Analytics works without cookies.
• Marketing: advertising-related signals (Google Consent Mode) are enabled only if you accept marketing cookies.

Separately from cookies, we record product events linked to your account (for example, which features you use) as described in Section 7.

Managing Cookies in Your Browser

You can configure your browser to manage or reject cookies.

• Chrome: Settings → Privacy and security → Cookies
• Safari: Settings → Privacy
• Firefox: Settings → Privacy & Security
• Edge: Settings → Cookies and site permissions

You can also manage your preferences anytime via our Cookie Preferences Center below.

Facturaz may update this Privacy Policy to reflect legal, technical, or operational changes.

Significant updates will be communicated via email or directly within the Platform.

We encourage you to review this Policy periodically to stay informed about how we protect your data.