Privacy Policy

Last updated: 18 August 2026

1. Controller

Factando is the data controller for personal data processed through this website. Contact: support@factando.com.

2. What we collect

Account data: name, email address, hashed password.
Business data you enter: business profile (address, VAT ID, IBAN), client records and invoices. Your clients' details are processed on your behalf, you remain the controller for that data; we act as processor.
Billing data: subscription status and a Stripe customer reference. Card details are processed by Stripe and never touch our servers.
Technical data: server logs (IP, timestamps) for security and debugging.
Free invoice generator: what you type stays in your own browser (local storage) until you choose to save it to an account. Nothing is sent to our servers before that moment; clearing your browser data removes it.
Product milestones on your account (for example "invoice sent", "subscription started") so we can see whether Factando works for new users. Invoice contents and your clients' details are never part of these records.

3. Why we process it (legal bases)

To provide the Service, performance of contract (art. 6(1)(b) GDPR).
Billing and tax records, legal obligation (art. 6(1)(c)).
Security, abuse prevention, service emails, legitimate interest (art. 6(1)(f)).

We do not sell personal data and do not use it for third-party advertising.

4. Processors we use

Hosting: Vercel (app) and Neon (database, EU region, Frankfurt), under EU-compliant data processing agreements.
Payments: Stripe.
Transactional email: Resend (if invoice emailing is enabled).

If you store your own clients' data in Factando, our data processing agreement with you is included as section 11 of our Terms of Service.

4a. Transfers outside the EU

Your invoice and client data is stored on servers in the EU (Frankfurt). Some of our processors are US companies: Stripe, Inc. processes subscription payments and Vercel, Inc. provides hosting infrastructure. Where personal data is transferred to the United States, this happens on the basis of the European Commission's Standard Contractual Clauses (art. 46(2)(c) GDPR) and, where applicable, the EU-US Data Privacy Framework, with supplementary measures such as encryption in transit and at rest. Copies of the relevant safeguards can be requested via support@factando.com.

5. Retention

Account and invoice data are kept while your account is active and for 30 days after deletion, except billing records we must keep for 7 years under Dutch tax law. Server logs are kept for at most 90 days. Note that you yourself are legally required to keep your invoice records for 7 years (art. 52 AWR), export your invoices before deleting your account.

6. Your rights

Under the GDPR you can request access, correction, deletion, restriction, portability, or object to processing, email support@factando.com. You can also complain to the Autoriteit Persoonsgegevens (Dutch DPA).

7. Cookies & analytics

We only use strictly necessary and functional cookies: a session cookie to keep you signed in, a CSRF token, your language choice ("lang"), and, for 30 days, the referral or campaign code that brought you here ("src", no personal data). No tracking or advertising cookies, so no cookie banner is needed.

To understand how the website performs we use cookieless, privacy-friendly analytics: aggregate page-view statistics (via Vercel Web Analytics) and anonymous event counters (e.g. "an invoice was generated") stored on our own servers. These measurements use no cookies, no cross-site tracking and no fingerprinting, and are not linked to your identity, IP address or account, which is why no consent banner is required (they fall outside the consent requirement of art. 11.7a Telecommunicatiewet).

8. Security

Passwords are hashed with bcrypt, all traffic is encrypted (TLS), database access is restricted, and payment data is handled entirely by Stripe.

9. Changes

We will announce material changes to this policy by email or in the app.