Factando

Privacy Policy

Last updated: 18 August 2026

1. Controller

Factando is the data controller for personal data processed through this website. Contact: support@factando.com.

2. What we collect

  • Account data: name, email address, hashed password.
  • Business data you enter: business profile (address, VAT ID, IBAN), client records and invoices. Your clients' details are processed on your behalf — you remain the controller for that data; we act as processor.
  • Billing data: subscription status and a Stripe customer reference. Card details are processed by Stripe and never touch our servers.
  • Technical data: server logs (IP, timestamps) for security and debugging.

3. Why we process it (legal bases)

  • To provide the Service — performance of contract (art. 6(1)(b) GDPR).
  • Billing and tax records — legal obligation (art. 6(1)(c)).
  • Security, abuse prevention, service emails — legitimate interest (art. 6(1)(f)).

We do not sell personal data and do not use it for third-party advertising.

4. Processors we use

  • Hosting: Vercel (app) and Neon (database), under EU-compliant data processing agreements.
  • Payments: Stripe.
  • Transactional email: Resend (if invoice emailing is enabled).

5. Retention

Account and invoice data are kept while your account is active and for 30 days after deletion, except billing records we must keep for 7 years under Dutch tax law. Server logs are kept for at most 90 days.

6. Your rights

Under the GDPR you can request access, correction, deletion, restriction, portability, or object to processing — email support@factando.com. You can also complain to the Autoriteit Persoonsgegevens (Dutch DPA).

7. Cookies

We only use strictly necessary cookies: a session cookie to keep you signed in and a CSRF token. No tracking or advertising cookies, so no cookie banner is needed.

8. Security

Passwords are hashed with bcrypt, all traffic is encrypted (TLS), database access is restricted, and payment data is handled entirely by Stripe.

9. Changes

We will announce material changes to this policy by email or in the app.