Privacy Policy

Effective 20 September 2026

This Privacy Policy explains how Zarnitech Capital SL ("EUFactura", "we", "us") collects, uses, and protects personal data in connection with the EUFactura website and application (the "Service"). It is written for the EU General Data Protection Regulation (GDPR) and Spain's LOPDGDD.

This is a real, complete policy prepared to reflect the Service as built today. It has not been reviewed by an external lawyer; we recommend professional legal review before relying on it for a specific regulatory situation, and we will update it as the Service and our processing activities evolve.

1. Who is responsible for your data

For the purposes described in this policy, the data controller is:
Zarnitech Capital SL
Bulevar Príncipe Alfonso Hohenlohe
Urbanización Carolina Park, Edificio Aries, oficina 41
29602 Marbella (Málaga), Spain
Tax ID (NIF): B24963803
Contact: hello@eufactura.eu

EUFactura is a business-to-business (B2B) product: we do not knowingly sell the Service to consumers, and our organization accounts are held by businesses and professionals, not individual consumers acting outside a trade or profession.

Given our size and the nature of our processing, we are not required under Article 37 GDPR to appoint a Data Protection Officer. The contact above handles all privacy and data-protection requests.

2. Two roles: controller and processor

When you use EUFactura to run your own invoicing, some of the personal data flowing through the Service belongs to you (your account, your team's users, your billing information) — for that data, we act as controller. Other personal data belongs to your own customers and contacts (the names, addresses, tax IDs and email addresses you enter when creating a customer, invoice, or quote) — for that data, you are the controller and we act as your processor, under the terms of our Data Processing Agreement. This policy covers both roles; where something applies only to one, it says so.

3. Data we collect

Account and organization data (we are controller)

• Name and email address, used for authentication (via Supabase Auth) and account communication.
• Organization details you provide (organization name, member roles).
• Your own company's details when you configure it in EUFactura (legal name, tax ID, registered address, bank details you choose to display on invoices).
• Subscription and billing status (plan, billing interval, renewal date) — payment card details are collected and stored directly by Stripe, our payment processor; we never see or store your full card number.
• Technical and usage data: IP address, browser/device information, and application log data generated by using the Service, including error reports.
• Support correspondence you send us.

Invoicing data you enter (you are controller, we are processor)

• Your customers' and suppliers' details: name, address, tax/VAT ID, and email address, entered manually or looked up via a public company/VAT registry (see §6).
• Invoice, credit note and quote content: line items, amounts, VAT treatment, and any notes you add — some of which may relate to identifiable individuals (e.g. a sole trader customer).
• If you use the AI assistant, the messages you send it and the invoice/customer data it reads or creates on your instruction (see §7).

We do not intentionally collect special categories of data (Article 9 GDPR — health, religion, political opinions, etc.). Please do not include such data in invoice line items, notes, or messages to the assistant.

4. Why we process this data, and on what legal basis

• To provide the Service (creating your account, issuing invoices, sending emails, processing payments) — necessary to perform our contract with you (Art. 6(1)(b) GDPR), or to take steps at your request before entering into one.
• To keep the Service secure and working (fraud/abuse prevention, rate limiting, debugging, error monitoring) — our legitimate interest (Art. 6(1)(f)), balanced against your rights.
• To comply with legal obligations — in particular, retaining issued invoices and related accounting records for the periods required by Spanish commercial and tax law (Art. 6(1)(c)) (see §8).
• To communicate with you about the Service (service emails, billing notices) — contract performance; marketing communications, if any, only with your consent (Art. 6(1)(a)), which you can withdraw at any time.

5. Who we share data with

We use a small number of third-party service providers ("subprocessors") to operate EUFactura. Each is bound by a data processing agreement and, where they operate outside the EU/EEA, EU Standard Contractual Clauses. We keep an up-to-date list, with what each provider does and where it is located, on our Subprocessors page. In short: our database and file storage (Supabase, hosted in the EU), our hosting/CDN (Netlify), transactional email (Resend), payment processing (Stripe), our AI assistant's language model (Anthropic), error monitoring (Sentry, EU data region), and cookieless website analytics (Plausible, hosted in the EU).

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. We may disclose data where required by law, to a competent authority, or to protect our rights, users, or the public.

6. Public company and VAT registries

To help you fill in a customer or your own company's details faster, EUFactura can query public, official sources: the EU Commission's VIES service for EU VAT number validation, and national company-registry open-data APIs for a small number of countries (currently the Czech Republic, France, and Slovakia). These queries send only the search term (a name, ID, or VAT number) you typed, and return publicly available register data — they are not a source of additional personal data collection beyond what is already public record.

7. The AI assistant

EUFactura's optional AI assistant (available on paid plans) is built on Anthropic's Claude models. When you use it, your messages and the invoice/customer/company data needed to carry out your request are sent to Anthropic's API for processing and to generate a response. Anthropic processes this data under its own data processing terms and does not use API inputs/outputs to train its models. The assistant can only take the specific actions it has been explicitly built to take (e.g. drafting a quote) — it cannot take arbitrary actions on your account.

8. How long we keep data

• Issued invoices, credit notes, and related records are retained for as long as required by applicable law even after you close your account — under Spanish commercial law (Código de Comercio) this is generally at least 6 years, and tax law may impose its own periods. We do not silently delete or alter issued invoice data, per our own invoice-immutability rules.
• Account data is kept for as long as your account is active, and for a reasonable period afterward to handle any legal, accounting, or dispute-related needs.
• Draft invoices, quotes, and other unissued content can be deleted by you at any time and are not subject to the retention period above.
• Error/monitoring logs are retained on a rolling basis (typically 90 days or less) by our monitoring provider.

9. International data transfers

Our primary database is hosted in the EU (Ireland). Some subprocessors — notably Anthropic and Stripe — process data in, or transfer data to, the United States. Where that happens, we rely on the European Commission's Standard Contractual Clauses (or another valid transfer mechanism under Chapter V GDPR) provided by that subprocessor. See our Subprocessors page for details on each provider.

10. Security

We apply access controls at both the application and database level (including PostgreSQL row-level security to keep each organization's data isolated from every other organization), encrypt data in transit, and restrict who can access production systems and secrets. No system is perfectly secure; if we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users as required by Articles 33–34 GDPR.

11. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data, subject to our legal obligation to retain issued invoice records (§8);
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD), or the authority in your own EU member state.

If your organization's admin controls your data within EUFactura (e.g. you are a customer contact recorded by one of our business users), please contact that organization first — they are the controller for that data. To exercise your rights with us directly, email hello@eufactura.eu.

12. Cookies and similar technologies

The application uses a strictly necessary session cookie (via Supabase Auth) to keep you signed in — this is required for the Service to function and is not used for tracking or advertising. For aggregate visitor statistics we use Plausible Analytics, a privacy-focused service hosted in the EU that sets no cookies and, by design, does not collect or store personal data (visitor IP addresses are used only transiently, hashed with a daily-rotating salt). We run no advertising cookies or trackers. Our error monitoring tool (Sentry) may, in production only, record a masked session replay after an error to help us debug it — by default it masks all text and input content and blocks media, so it does not capture the actual content you typed or viewed.

On our public website we also set one small first-party cookie, eufactura_attribution, kept for 90 days. It remembers how you first found us: the campaign tags on the link you followed (utm parameters), the domain of the site that referred you, the first page you saw and the date. It contains no identifier, is not used for advertising or profiling and is not shared with advertising networks. When you create an account, this information is saved with your workspace and attached, without any personal data, to our aggregate statistics, so that we can tell which channels lead people to EUFactura. You can delete the cookie in your browser at any time; the Service works the same without it.

13. Children

EUFactura is a business tool and is not directed at, or knowingly used by, children. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy as the Service evolves. We will update the effective date above and, for material changes, notify account owners by email.

15. Contact

Questions about this policy or your data can be sent to hello@eufactura.eu.