Privacy policy

The controller of personal data relating to factuarea.com and app.factuarea.com user accounts is José Luis Caravaca Carretero, owner of Factuarea, an invoicing platform for self-employed professionals and small businesses operating in Spain.

Name

José Luis Caravaca Carretero

Spanish ID / tax ID (DNI/NIF)

20182019L

Registered address

Cuesta de los Mesones 17, 2C · 14840 Castro del Río

Email

info@factuarea.com

Phone

+34 648 44 20 04

Data protection officer

José Luis Caravaca Carretero

info@factuarea.com is Factuarea's only mailbox: sales enquiries, support requests and data protection matters all go through it. Whatever you write about, it arrives at the same place.

This policy covers the public factuarea.com website, its contact form and the service available at app.factuarea.com, including registration, the account, support, service billing, artificial intelligence features and any integrations that are enabled.

Factuarea is the controller of visitor, contact, user and customer data needed to provide and administer the service. The contractual relationship and, where applicable, the data processing agreement govern these activities.

When a business or professional enters data about clients, suppliers, employees or other people in the application, that business or professional determines the purposes and is the controller; Factuarea processes the data on its behalf as processor under Article 28 GDPR.

The data involved depends on whether you visit the website, subscribe to Factuarea or enter information in the application.

Contact, account and contractual relationship

Name, email, phone number and company; credentials and access data; tax and billing details of the account holder; subscribed plan, payments, support communications and acceptance of terms. Company and reason are optional in the public contact form.

Content managed in the application

Data about clients, suppliers, employees and contacts; products, services, invoices, quotes, contracts and other documents; amounts, tax identifiers, addresses, bank accounts, files and messages that the user chooses to enter or generate. Factuarea processes them on the customer's instructions.

Use of artificial intelligence and integrations

When an AI feature is used, the current provider (Microsoft Azure OpenAI) receives the instruction and context strictly needed to answer or carry out the action. If Stripe, WhatsApp or another integration is enabled, the data needed to connect and provide that feature is processed.

Technical data and browser storage

IP address, date and time, headers, device, browser, identifiers and security and usage logs. If you accept measurement, Vercel also receives the page visited, referrer, approximate location, device characteristics and performance metrics. The browser stores the session and interface preferences; the Cookie policy contains the inventory for factuarea.com and app.factuarea.com.

The public website uses Vercel Web Analytics and Speed Insights only after consent. It contains no advertising, cross-site tracking, third-party chat or social widgets. Factuarea does not use application data for advertising and makes no decisions with legal effects based solely on automated processing.

We process data only for purposes connected with the website and the subscribed service:

• To create and administer the account, authenticate the user, provide invoicing features and maintain the contractual relationship.
• To host, organise and process on the customer's behalf the documents and data entered in the application.
• To handle enquiries, support and incidents and send operational or contractual email notices.
• To provide artificial intelligence features and user-connected integrations when requested.
• To comply with applicable tax, accounting, fraud-prevention and other legal duties.
• To protect system security and availability, prevent abuse, remember technical preferences and, when accepted, measure website visits and performance in aggregate.

We do not sell personal data or use it to send unsolicited advertising. The public website has no newsletter or mailing list.

Each purpose rests on a basis set out in Article 6 of the GDPR:

Registration, account and service delivery

Article 6(1)(b) GDPR: performance of a contract or pre-contractual steps requested by the data subject.

Tax and legal duties

Article 6(1)(c) GDPR: compliance with the obligations applicable to Factuarea.

Contact, security and operational improvement

Article 6(1)(f) GDPR: the legitimate interest in handling communications, protecting systems, preventing fraud and maintaining a reliable service, after balancing the rights concerned.

Necessary cookies and storage

Article 22.2 of the Spanish LSSI: they are needed to provide the service or retain a requested preference and require no consent. Any optional use will be enabled only with consent.

Data entered by customers

Factuarea processes it as processor and does not determine its legal basis. The customer, as controller, must have a valid basis and inform the people concerned; instructions and duties are governed by the Article 28 agreement.

You may object to processing based on legitimate interest and ask about the balancing assessment by writing to info@factuarea.com.

Each item is kept for as long as its purpose requires, and no longer:

Account, contract and billing

While the account or contract remains in force. On termination, data is erased or restricted for the applicable statutory limitation and tax, accounting or legal-defence retention periods.

Customer data and documents

While the service is provided and, on termination, for the period needed to allow export and follow the return or erasure instructions in the processing agreement; it is then erased or restricted if a legal duty applies.

Enquiries, support and email

While the request is handled and afterwards for the limitation period of any resulting claims. Resend generally retains email data and its logs for 30 days.

Technical hosting logs

Vercel retains runtime logs for 1 hour on Hobby, 1 day on Pro and 3 days on Enterprise; with Observability Plus, 30 days. Build logs remain linked to a deployment while it is retained. Ephemeral contact-form counters expire after one minute.

Cookies and browser storage

Each item has the period stated in the Cookie policy: from the browser session or 10 minutes for temporary state to sign-out, a preference change or manual deletion for persistent storage.

Factuarea does not sell personal data. It uses the following providers to deliver the website and application; optional integrations are involved only if the user enables them:

Vercel Inc.

Hosts and delivers the public factuarea.com website and receives the IP address and technical data of each request. If the visitor accepts measurement, it also provides Web Analytics and Speed Insights using aggregated browsing and performance data, without analytics cookies. Its published DPA is automatically incorporated into Pro and Enterprise plans, but not the Hobby plan.

Resend, Inc.

Sends transactional, support and contact-form email. Its DPA automatically forms part of the service agreement.

Microsoft (Azure OpenAI)

The current provider of artificial intelligence features. It receives only the instruction and context needed when the feature is used; Microsoft's DPA is incorporated into the Online Services terms.

Stripe (optional integration)

Involved only when a payment, collection or subscription feature is enabled. Stripe acts as processor for operations performed on the user's instructions and as an independent controller for regulatory duties, fraud prevention and security.

Meta / WhatsApp (optional integration)

Involved only if WhatsApp Business is connected; it may receive phone numbers, metadata and message content. Its exact legal role depends on the product and terms applying to the connected account.

HubSpot is not active and receives no data. Outside the providers and integrations described, data is disclosed only to authorities where required by law and to advisers bound by confidentiality where necessary.

Vercel operates global infrastructure and may process technical data in the United States. Resend can send email from Ireland but stores account data, metadata, logs and email data in the United States. Their agreements incorporate the European Commission's standard contractual clauses and both providers state that they participate in the EU-US Data Privacy Framework.

The Microsoft Azure OpenAI instance currently used by Factuarea is configured in Europe. Microsoft incorporates its DPA and the standard contractual clauses into the Online Services terms; Factuarea will verify the region and deployment type before any change.

Optional integrations such as Stripe or WhatsApp may involve processing outside the European Economic Area. When enabled, the safeguards in their terms and transfer agreements will apply, such as the Data Privacy Framework or standard contractual clauses as appropriate.

You can request information or a copy of the applicable safeguards by writing to info@factuarea.com.

The GDPR and the LOPDGDD (Ley Orgánica 3/2018) grant you the following rights over your data:

Access

To know whether we process data about you and, if so, which data and for what purpose.

Rectification

To correct data that is inaccurate and complete data that is incomplete.

Erasure

To ask us to delete data once it is no longer necessary for the purpose it was collected for.

Objection

To object to processing based on legitimate interest, on grounds relating to your particular situation.

Restriction

To ask us to keep the data without using it while a challenge or a rectification request is resolved.

Portability

To receive the data you have provided to us in a structured, commonly used format where processing is based on a contract or consent and is carried out by automated means.

Withdrawal of consent

To withdraw it where processing is based on consent, without affecting what was done before the withdrawal.

How to exercise them

Write to info@factuarea.com stating which right you wish to exercise. If there are reasonable doubts about who is making the request, we may ask you to prove your identity. We will reply within one month of receiving it, extendable by a further two months if the request is complex, in accordance with Article 12 of the GDPR. Exercising these rights is free of charge.

Complaint to the supervisory authority

If you believe we have not handled your request properly, or that the processing infringes the law, you may lodge a complaint with the Spanish supervisory authority: Spanish Data Protection Agency (AEPD).

We apply measures proportionate to the risks of the website and of an application that may contain financial and tax information:

• The website and application are served over HTTPS to encrypt data in transit.
• Access requires authentication and is restricted by user, role and business; providers receive only the data needed for their function.
• Backups, incident logging, access controls and system continuity and update measures are applied.
• Forms and access are protected with rate limits, anti-CSRF state and other controls against automated or unauthorised use.

No measure removes the risk entirely. Should a security breach occur that poses a high risk to your rights, we would inform you in accordance with Article 34 of the GDPR.

The public website uses a technical language cookie and one local consent preference. Vercel Web Analytics and Speed Insights are enabled only if accepted and set no analytics cookies. The application uses local or session storage to authenticate, retain the active business, remember preferences and maintain requested features. There are no advertising cookies.

The details are in the Cookie policy.

This policy may change if the processing activities or the applicable law change. When that happens:

• We will publish the new version at this same address.
• We will update the last-updated date shown above.
• If the change substantially affects processing that concerns you and we have a way to reach you, we will tell you by email.

Versions

17 August 2026

Current version. Unifies the policy for the website and application, includes their technical storage and distinguishes active providers from optional integrations.

10 March 2026

Previous version. Limited its scope to the website and contact form.

For any question about this policy, about your data or to exercise your rights:

Email

info@factuarea.com

Phone

+34 648 44 20 04

You can also write to us from the contact form.

This policy is completed by:

• Legal notice
• Terms and conditions
• Cookie policy