Privacy policy
Data controller
The controller is GÜELL SANS ARNAU (NIF 48023777F), operating FacturaFácil. Address: Carrer Bisbe Morgades 2, España. Contact: soporte@facturafacil.ai and phone +34 661 014 102. We have not appointed a Data Protection Officer; use the channels above for privacy matters.
Data we collect
Account and identity data (name, tax ID, address, email, phone). Tax and billing data you enter (invoices, expenses, contacts, encrypted VeriFactu certificates, filing proofs). Usage, device and technical logs. If you connect integrations: server-stored email OAuth tokens (Gmail/Microsoft); metadata and attachments from expense emails; bank transactions via Enable Banking; MONEI/Stripe Connect account identifiers and payment data for auto-invoicing; linked WhatsApp number; subscription and billing data via RevenueCat/Stripe/App Store/Google Play.
Purposes
Provide invoicing and tax management; run integrations you enable (email sync, banking, payment gateways, WhatsApp, VeriFactu/FACe); manage account and subscription; offer AI assistance; meet legal obligations; improve security and product; handle enquiries and complaints.
Legal basis
Contract (GDPR art. 6.1.b) for the core service. Consent (art. 6.1.a) for optional integrations, non-essential cookies and marketing where applicable. Legitimate interest (art. 6.1.f) for security, fraud prevention and service improvement. Legal obligation (art. 6.1.c) for tax and record-keeping duties.
Processors and integrations
We share data with providers that help operate the service under data processing agreements where required: Google (Firebase Auth, Firestore, Cloud Storage, Cloud Functions, Gmail read-only API, Vertex AI/Gemini, Places, Analytics, Crashlytics) — policies.google.com; Microsoft (Graph Mail.Read for Outlook) — privacy.microsoft.com; Stripe and RevenueCat (payments and subscriptions) — stripe.com/privacy and revenuecat.com/privacy; MONEI (only if you connect your account for payment webhooks) — monei.com; Enable Banking (PSD2 bank sync) — enablebanking.com; Meta/WhatsApp Cloud API (if you link your number) — facebook.com/privacy; Spanish Tax Agency (VeriFactu/FACe when you submit records). List current as of 12 de junio de 2026.
Email (Gmail and Outlook)
If you connect a mailbox under Settings → Email expense sync, the connection is optional and requires your explicit consent on Google's or Microsoft's screen before we access mail. We only request read access (Gmail: gmail.readonly scope; Outlook: Mail.Read). We use mail solely to detect expense invoices in PDF or image attachments and suggest registration; we never send email on your behalf or modify your mailbox. OAuth tokens are stored on secure servers only (Firestore, European region) and are not accessible from the app. You can disconnect the mailbox in Settings or revoke access in your Google account (myaccount.google.com/permissions) or Microsoft account.
Google user data (Gmail API and Limited Use)
This section describes how FacturaFácil accesses your Google account data when you authorise Gmail, in line with Google's API Services User Data Policy. Scope requested: gmail.readonly (read-only), plus openid and email to identify the connected account. What we read: message metadata (sender, subject, date, snippet) and PDF or image attachments (JPEG, PNG, WEBP) from messages matching your sender rules or that you search manually in the mailbox picker. How we use it: (1) periodic automatic scan (~every 6 hours) of mail from senders you configure, within the last 7 days, with PDF attachments; (2) manual mailbox search (last 30 days by default, or the full mailbox if you enter a search query); (3) AI extraction (Google Vertex AI / Gemini) of invoice data to show an expense suggestion you must confirm or dismiss — expenses are never saved without your action. Storage: refresh tokens on servers; pending suggestions (subject, date, extracted fields) in your account; we do not store your full mailbox contents or sell this data. Sharing: Gmail data is processed on our servers (Google Cloud/Firebase, europe-southwest1) and, for AI extraction, in Google Vertex AI, always to provide the expense-detection feature you enable. We do not share Gmail data with advertisers, data brokers, ad platforms, or for credit-worthiness or lending. Limited Use: we limit Google data use to the visible app features described here; we do not use it for personalised advertising or purposes unrelated to expense management you request. Human access: GÜELL SANS ARNAU staff do not read your mail except with your express consent for a specific case, for security (investigating abuse), or where required by law. Revocation: disconnect the mailbox in Settings or revoke «FacturaFácil» in Google's security settings. If we change how Google data is used, we will update this policy and request consent when law or Google requires it.
Payments (Stripe, MONEI, app stores)
Subscriptions to FacturaFácil are processed via RevenueCat and, on web, Stripe; on mobile, App Store or Google Play. We do not store your full card number. If you configure MONEI or Stripe Connect to invoice your customer payments, we securely store required credentials or identifiers on European servers; your customers' payments are governed by your gateway's policies.
International transfers
We prioritise EU infrastructure (e.g. Firebase in europe-southwest1). Some providers (Google, Microsoft, Stripe, RevenueCat, Meta) may process data outside the EEA with appropriate safeguards (standard contractual clauses, adequacy decisions or certifications). Request more information at soporte@facturafacil.ai.
Retention
We keep data while your account is active and for periods required by tax, commercial and claims defence obligations (often up to 6 years for accounting records). After account deletion we erase or anonymise data except where law requires retention. Email tokens are removed when you disconnect a mailbox.
Your rights
You may exercise access, rectification, erasure, restriction, objection and portability by emailing soporte@facturafacil.ai. In the app: export data, disconnect integrations and Delete account (Settings). You may complain to the Spanish Data Protection Agency (www.aepd.es).
Security
We use encryption in transit (TLS), access controls, database security rules, secure secret storage, and keep sensitive tokens inaccessible from the client. No system is 100% secure; report incidents to soporte@facturafacil.ai.
Minors
The service is aimed at professionals and freelancers aged 18+. We do not knowingly collect data from minors.
Changes
We may update this policy. The current version is published here with the revision date. Material changes are communicated via the app or email when needed. Last updated: 12 de junio de 2026.