Privacy policy

This notice covers Factivo.ai on the web, its APIs and native iPhone app, including internal TestFlight builds. Testing with real data does not remove privacy rights.

For account, billing and service security purposes, the operator determines the purposes of processing. When a business customer entrusts third-party data to the service, the customer normally determines the accounting purposes and Factivo acts on its instructions. These roles and the applicable processing agreement must be established for the actual service.

• Account: name, email, login identifiers and requested interface preferences, to create and operate your account and communicate about the service. Basis: performance of the service contract, or steps you request before it.
• Bookkeeping: uploaded originals, extracted fields, NIF/NIE, addresses, optional IBAN, business profile, amounts, supplier/customer details, bank imports and report links, to organize records and prepare drafts. Basis for your service data: the contract; for third-party data handled on your behalf: your lawful instructions and the applicable processing agreement.
• Billing: billing name/address, tax identifiers, payment and subscription status, to manage the plan and accounting obligations. Bases: contract and applicable tax/accounting legal duties. Stripe handles card details; do not send card data in support or chat.
• Security and support: limited request/error identifiers and information you provide, to protect accounts, investigate incidents and respond to requests. Basis: legitimate interests in operating a secure service and applicable legal duties; optional browser diagnostics require your cookie choice.

Account information is needed for access. Gmail, messaging links, diagnostic reporting and IBAN are optional. Without documents or the required profile fields, related calculations cannot be prepared. Avoid uploading unnecessary health, political, religious or other sensitive information. If documents identify other people, you must have authority to provide them and give the information required in your own controller role.

Gmail is optional. New connections use Composio managed OAuth, which requests full Gmail access plus contacts and profile permissions. Factivo uses Gmail to read and import bookkeeping documents and does not send, modify or delete messages. Google authorization uses either Factivo’s direct Google connection or a Composio-managed connection. For direct connections, Factivo encrypts authorization credentials, refreshes access and calls Gmail directly. For Composio connections, Composio stores and refreshes credentials and proxies Gmail requests. Authorized messages, metadata, bodies and attachments are inspected for bookkeeping documents and processed by the document/AI pipeline. Review the actual scopes shown by Google before authorizing. Disconnect in Settings to stop the connection; imported records are managed separately.

These commitments cover Gmail data and information derived from it. We use it only for the bookkeeping features you request: finding invoices and receipts, importing documents, extracting fields, categorizing records and preparing your reports or assistant answers. We do not sell this data, use it for advertising, transfer it to data brokers, or use it to assess creditworthiness or lending eligibility. We do not use Google Workspace data to develop, train or improve generalized AI or machine-learning models.

With your permission, document content is sent to OpenAI for extraction and attachment text to TypeSafe to check whether it is an invoice or receipt; relevant imported records may also be processed by the self-hosted Letta assistant and OpenAI when you use AI features. Our hosting and storage services process imported records to operate your account. Existing Composio-managed connections also pass Gmail requests and responses through Composio. Transfers are limited to delivering the features you authorize, necessary security investigations, legal obligations, or a business transfer after your explicit prior consent. These restrictions also apply to our service providers.

People may read Google user data only after you explicitly agree to access to the specific messages or files, where necessary to investigate a security issue or comply with law, or when the data is aggregated and anonymized for lawful internal operations. Routine support does not authorize access to your mailbox content.

We store the connected mailbox address, encrypted authorization credentials for direct Google connections, sync status and message identifiers to avoid duplicate imports, plus imported documents and extracted bookkeeping records. HTTPS protects data in transit; account access controls and encrypted direct-connection credentials protect access to stored data. Disconnecting in Settings stops future imports and requests revocation of the connection. You can also revoke access in your Google Account. Revocation does not remove previously imported documents: remove those records separately or use Account → Delete account for account erasure, including linked connection data. You can also request deletion by email. Isolated off-server backups rotate after 30 days; legally required records and provider cleanup follow the retention rules below.

Gmail scope: https://www.googleapis.com/auth/gmail.readonly. Manage or revoke access in Google

If you link Telegram, channel identifiers and messages also pass through Telegram. Disconnecting stops new service interactions, but copies already delivered remain subject to those services and the recipient. Invoice email delivery uses Resend where enabled; it receives the recipient, reply-to address, message and attached original. No decorative supplier-name/logo lookups are needed for local initials.

You choose accountants and report recipients. Share links use access controls and can be revoked; revocation cannot retract a copy already downloaded by a recipient. Verify the recipient and avoid sending passwords through the same channel as the link.

The service uses Clerk for identity; Netcup for application hosting, PostgreSQL databases, document storage and the self-hosted Letta assistant, managed through Coolify; Stripe for billing; configured Sentry for minimal error diagnostics; and GitHub for source delivery and deployment automation, and Hetzner for off-server backups. OpenAI, TypeSafe, Letta, Composio, Google, messaging services and Resend are described above. Public content may load licensed photos from Unsplash. Authorities receive information when legally required. Authorized support staff may access what is necessary for their assigned purpose.

Depending on hosting, provider entities and support access, processing may occur outside the EEA. An applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses are required where relevant. This page does not certify an unverified provider region, contract, zero-retention configuration or training restriction. Contact support for the actual recipient entities, transfer mechanism and a copy or explanation of the applicable safeguards; operational details still awaiting verification must be completed before representing the register as final.

Cancelling a subscription stops new processing when the paid term ends but does not delete saved records. Read-only access to saved documents, originals and exports remains available while the account and records are retained. We also store subscription coverage periods and one-time backfill purchase records to avoid charging twice. Active records and originals are retained to provide the service until you remove them or close the account, subject to lawful retention/restriction. Removing an invoice from the ordinary view may leave a soft-deleted copy. Account deletion is broader. Processor copies, pending cleanup, incident evidence and isolated backups can have separate lifecycles; deletion is not a promise that every historical backup disappears instantly.

Records needed to meet applicable accounting/tax duties or establish, exercise or defend claims are restricted to those purposes for the applicable period, then removed. These periods depend on the category and obligation; there is no universal four-year rule. Ask support for the retention applicable to your data, a restriction request or the status of a deletion. Keep the originals your own business must retain.

The iPhone app keeps protected account-scoped snapshots on disk, including financial and conversation data, and temporary document previews. These caches are excluded from device backups; they are not only held in memory. Logout/account changes and relevant deletion actions clear local copies through the app’s cleanup controls. Device permissions for camera/photos are separate from permission to send selected content for AI processing.

You can request access, correction, erasure, restriction, objection and, when applicable, portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Automated estimates remain subject to your review; contact us if you need to contest how information about you was used.

Use Account for export and deletion, or email support@factivo.ai. Identify the request without sending passwords, full tax documents or unnecessary ID. Proportionate identity checks may be needed. The normal response period is one month; any lawful extension must be explained within that period. For data handled for a business customer, we coordinate with that controller.

You may lodge a complaint with the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, including where you normally live or work. AEPD.

See service terms for subscription and exit information. Material changes to purposes, recipients or permissions require updated information; continued use is not a blanket consent to unrelated processing.