Privacy policy

1. Controller

2. What we process and why

We process only what the service needs. We use no analytics or advertising cookies and we do not build profiles. We record aggregate homepage and registration-page view counters by day, broad source and, when present, technical campaign name. These counters do not store IP addresses, visitor identifiers or full URLs. They do not identify unique people.

• Sandbox registration: company or product name and email address. Purpose: creating the account, issuing the sandbox key and being able to notify you of material service changes. Legal basis: steps taken at your request (GDPR article 6(1)(b)).
• Abuse control on the signup form: a cryptographic hash of the request origin. We do not keep the IP address in clear, only a value derived from it that is used solely to count requests per hour and is deleted after 24 hours. Legal basis: legitimate interest in protecting the service (article 6(1)(f)).
• Production accounts: contact details of the customer company and its authorised people. Legal basis: performance of the contract (article 6(1)(b)).
• Correspondence: whatever you tell us when you write to us, in order to answer. Legal basis: legitimate interest (article 6(1)(f)).

3. Retention

• Inactive sandbox accounts: deleted after twelve months.
• Abuse-control counters: deleted after twenty-four hours.
• Contracted customers' data: for the life of the relationship and then for the applicable statutory limitation periods.
• Invoicing records: for the period required by Spanish tax law, which requires them to be retained unaltered.

4. Recipients

We do not sell or share personal data. We rely on the following processors, each under a processing agreement with the safeguards the GDPR requires:

• Supabase — database hosting, within the European Union (Frankfurt region).
• Vercel — hosting of the web application and the API.
• GitHub — running the scheduled submission jobs.
• Anthropic, PBC — only when a business using Fiscaza Invoicing uploads a receipt or a supplier invoice to be read automatically: the file is sent to Anthropic's API to extract the expense's details (date, supplier, amounts) and is not stored on our servers. Anthropic may process data outside the European Economic Area; see section 5.
• Stripe — billing for Fiscaza Invoicing subscriptions.
• The Spanish tax agency (AEAT) — recipient of the invoicing records, as required by law.

5. International transfers

The database is hosted in the European Union. Some of the providers named above are US companies that may process data outside the European Economic Area; where that happens, the transfer relies on the European Commission's standard contractual clauses or on the applicable adequacy decision.

6. Fiscal data belonging to our vendors' customers

When a software company integrates Fiscaza, their customers' invoicing data — including the digital certificates those customers entrust to us — is processed on that company's behalf, and they are the controller. Fiscaza acts as processor and handles the data only on their instructions, under the agreement required by GDPR article 28.

Digital certificates are encrypted on arrival using envelope encryption. Neither the software vendor nor Fiscaza can read them in clear afterwards. They are used solely to sign submissions to the tax agency for the taxpayer they belong to.

If you are a customer of a company that uses Fiscaza and wish to exercise your rights, approach them first: they decide about that data. We will give them whatever assistance they need.

6 bis. Fiscaza Invoicing payroll

For payroll, the employer decides how its employees’ data is used and acts as controller. Fiscaza processes it on the employer’s behalf and instructions to prepare calculations, payslips and records, under GDPR article 28. The employer must inform its employees and establish the applicable legal basis for its employment, tax and Social Security obligations.

Stored information includes employee identification and Social Security references, employment terms, pay, working time, declared tax and family facts, payslips, and payment or delivery records entered by the employer. Where needed for employment or Social Security obligations, it may include disability status and administrative sick-leave information. The employer must establish an applicable GDPR article 9 exception, such as article 9(2)(b) where its conditions are met. Do not enter diagnoses or medical histories in free-text fields.

Application access is restricted to the authorised business owner. Hosting uses the providers described in sections 4 and 5. Income tax is calculated within Fiscaza without sending employee tax or family facts to AEAT or artificial-intelligence services. Calculating or issuing a payslip does not send it to the employee or file a return.

Issued documents and corrections retain their history. Employers must keep payslips and Social Security contribution records for at least five years under article 3 of the Order of 27 December 1994, and other records for their applicable statutory periods. Ending a subscription does not itself erase records subject to retention. Employees should approach their employer for copies, correction, erasure or restriction; Fiscaza will assist the employer, subject to statutory retention limits.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@fiscaza.com, stating which right you are exercising. We will respond within one month.

Erasure has one limit: invoicing records already generated must be kept unaltered because Spanish tax law requires it, and cannot be deleted on request.

If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).

8. Cookies

This site uses no analytics, advertising or tracking cookies, so no consent is requested for them.