Privacy Policy

1. Who is responsible for your personal data?

For personal data relating to your account, use of the public website, service administration and security, the controller is:

In this Policy, "you" means a person visiting the website or using an account. Where a business customer enters personal data about its own clients into FaktuFlow, that business customer will generally act as the controller of those records, while FaktuFlow processes them to provide the Service and according to the customer's instructions. The actual roles depend on the specific processing activity.

2. Personal data we process

Depending on how you use the Service, we may process the following categories of data:

• Account data: email address, authentication identifiers and account-related settings.
• Business profile data: company name, contact name, phone number and business address entered in settings.
• Client and invoice data: client company and contact names, client email addresses and phone numbers if entered, invoice identifiers, amounts, currencies, issue dates, due dates and payment statuses.
• Reminder records: recipient address, reminder type and sequence, sending status, timestamps, and any delivery error information or email-provider identifier stored by the Service.
• Technical and security data: information made available through hosting, authentication and security logs, which may include request timestamps, IP address, browser or device information and diagnostic events.
• Support correspondence: information you include when contacting us for help.

Please do not enter sensitive personal data into the Service unless a feature expressly requests it and you have confirmed a lawful basis for doing so.

3. Why we use personal data

We use personal data only as needed for purposes such as:

• Creating and managing user accounts and providing access to the Service, including trial-period and plan status.
• Providing client, invoice, reminder-history and business-settings functionality.
• Sending manual and automated invoice reminders at the account holder's request and under that user's configuration.
• Maintaining, securing, debugging and improving the Service, and detecting abuse or unauthorised activity.
• Responding to support requests and communicating important service-related information.
• Complying with applicable legal obligations and establishing, exercising or defending legal claims where necessary.

We do not use the invoice or client information entered into a customer's workspace to advertise to that customer's clients.

4. Legal bases under the GDPR

Where the GDPR applies, we rely on one or more of the following legal bases, as appropriate to the purpose:

• Contract: processing necessary to create your account and provide the Service you request.
• Legitimate interests: securing the Service, preventing misuse, troubleshooting and maintaining reliable operations, where those interests are not overridden by your rights.
• Legal obligation: processing necessary to comply with a legal requirement.
• Consent: where consent is legally required for a particular processing activity. Where processing is based on consent, you may withdraw it at any time without affecting processing already carried out lawfully.

5. Client data entered by business customers

If you use FaktuFlow to store information about your clients or to send invoice reminders to them, you are responsible for ensuring that you have an appropriate legal basis to enter and use that information, that any required privacy information has been provided, and that reminder emails are sent lawfully.

We process this information to deliver the features you use, maintain reminder history, prevent duplicate processing and provide support. We do not take over your responsibilities as controller of your client records. Where required, the parties should enter into a separate data processing agreement before production use with personal data.

6. Service providers and recipients

We use technical providers to operate the Service. Based on the current implementation, these include:

• Supabase: account authentication and database services.
• Vercel: application hosting and delivery.
• Resend: delivery of transactional email, including invoice reminders.

These providers process data as needed to deliver their services under their applicable terms and data-protection commitments. Depending on configuration and support needs, data may be processed in different countries, including outside the European Economic Area. Where required by law, appropriate safeguards must be in place for international transfers. Provider lists, locations and safeguards can change; check the providers' current legal and subprocessor documentation and your project region settings.

We may also disclose information where required by law, to protect rights and security, or as part of a business transfer, subject to applicable legal requirements.

7. How long we keep data

We retain account and workspace data while needed to provide the Service and administer the account. If an account is closed or data deletion is requested, we will delete or anonymise data when appropriate, unless retention is required for legal obligations, security, dispute resolution or the establishment, exercise or defence of legal claims. Limited copies may remain in backups or provider logs for a period determined by their backup and retention systems.

Suspending or ending access does not by itself mean that invoice records are immediately deleted. If you need account or workspace data removed, contact us using the details in Section 1. Business customers remain responsible for maintaining their own required accounting records and copies.

8. Security

We use technical and organisational measures designed to protect data against unauthorised access, loss, alteration and disclosure. These measures include access controls and the security features provided by our hosting, authentication, database and email providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping your login credentials confidential and for granting access to your workspace only to authorised people. Please contact us promptly if you suspect unauthorised access to your account.

9. Cookies and similar technologies

FaktuFlow may use strictly necessary cookies or similar technologies to support authentication, maintain secure sessions and protect the Service. Your browser may also store technical information needed for the site to function. This page does not describe any non-essential analytics or advertising cookies as being enabled. If we introduce non-essential cookies or similar technologies, we will update this Policy and obtain consent where required by law.

10. Your data protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• Access your personal data and receive a copy.
• Correct inaccurate or incomplete personal data.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests.
• Receive certain data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with the competent data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

To exercise a right, contact us using the privacy contact in Section 1. We may need to verify your identity before responding. These rights are not absolute and some requests may be limited by legal obligations or the rights of others.

11. Children

The Service is designed for business use and is not intended for children. Please do not create an account on behalf of a child or submit children's personal data unless this is necessary, lawful and appropriately authorised.

12. Changes to this Policy

We may update this Policy as the Service, our providers or applicable laws change. We will update the date at the top of this page. Where required, we will give additional notice of material changes.

13. Contact

For questions about this Policy, privacy requests or personal data processing, contact:

Solovianov Anton Oleksandrovich
Email: solovyanova63@gmail.com