Legal

Privacy policy

Last updated: October 4, 2026

This policy explains what personal data we process when you visit gestifactura.es, request beta access or use the invoicing app at app.gestifactura.es (the “Service”), what we use it for and what rights you have. It is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

This English version is a translation for information purposes. If it differs from the Spanish version, the Spanish version prevails.

1. Data controller

Owner: Aleksei Andrushchenko, trading as GestiFactura
NIE (tax ID): Y7671861H
Address: Carrer de Sant Pere Més Alt 54, 08003 Barcelona (Spain)
Email: info@gestifactura.es

We have not appointed a data protection officer, as we are not required to. For any privacy question, write to the address above.

2. What data we process and why

2.1. Visiting the website

gestifactura.es uses no analytics or advertising tools and sets no first-party cookies. Our hosting and network provider (Cloudflare) processes your IP address and technical request data to serve the page and protect it against attacks.

Legal basis: legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

2.2. Beta access request

If you fill in the beta form, we receive your name, your email, the plan you are interested in and the page language. We use them only to manage your access and send you the invitation.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

2.3. User account

To provide the Service we process:

account data: name, email, password (stored only as a hash) and interface language;
issuer tax data: name or company name, tax ID (NIF), registered address and, if you provide them, bank name, IBAN and SWIFT, which appear on your invoices;
content you enter: customers and suppliers, invoices, estimates, received invoices and their attachments;
session data: IP address, browser (user agent) and time of last activity, to keep you signed in and protect your account.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for session data, also our legitimate interest in the security of the Service (Art. 6(1)(f) GDPR).

2.4. Data of your customers and suppliers

We process the data of your customers and suppliers (name, tax ID, email, address) on your behalf, as a data processor: you decide what data you enter and why. The terms of that processing are set out in the Annex to the Terms and conditions.

You can sign in with your Google account if you already have a GestiFactura account with the same email. See section 3.

2.6. Google Drive integration

If you connect Google Drive, you can save your invoice PDFs to your own Drive. See section 3.

2.7. Submitting billing records to the Spanish Tax Agency (VERI*FACTU)

When the Service submits billing records to the Spanish Tax Agency (AEAT) under Royal Decree 1007/2023, we will send on your behalf the invoice data the regulation requires: tax ID and name of the issuer and the recipient, number, date, amounts, taxes and the record hash. We do this on your instructions and with your authorization, as set out in the Terms and conditions.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with the legal obligation of the taxpayer (Art. 6(1)(c) GDPR).

2.8. Sending invoices by email

When the Service lets you send invoices by email, we will process the recipient’s email and the document sent only to deliver it.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

2.9. Subscription payments and billing

When you subscribe to a paid plan, Stripe processes the payment. We do not receive or store your full card details: only the customer identifier, the plan, the payment status and the data needed to invoice you.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with tax and accounting obligations (Art. 6(1)(c) GDPR).

2.10. Communications

We will email you about the Service: your invitation, account notices, changes to prices or to these terms. We do not send marketing communications without your prior consent.

We do not make automated decisions with legal effects on you, and we do not profile you.

3. Google user data

This section describes how we access, use, store and share data from your Google account.

3.1. Data we access

Sign in with Google (scopes openid, email and profile): we read your Google identifier, email and basic profile once to identify you. We store only the Google identifier linked to your account. We do not store your Google photo or name, or any access token.
Google Drive (scopes openid, email and drive.file): we store the email of the connected Google account and the access and refresh tokens, encrypted in our database. We also store the identifier of the folder that contains the last folder you saved a PDF to, so that the Google picker opens there next time. The drive.file scope only grants access to files that GestiFactura creates or that you explicitly open with it, such as the folders you choose in that picker. We cannot see or read the rest of your Drive. Before saving a PDF, we check whether the chosen folder already has a file with the same name created by GestiFactura. We do not store the identifiers of the files we upload.

3.2. How we use it

We use Google data only to identify you when you sign in and to upload the invoice PDFs you choose to your Drive. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train artificial intelligence or machine learning models.

We do not share Google data with third parties, except as needed to provide these features (the hosting described in section 4), to comply with the law, or with your explicit consent. No person reads this data, except with your consent, for security purposes, to comply with the law, or for internal operations when the data is aggregated and anonymized.

3.4. Retention and deletion

The Google identifier is deleted when you delete your account.
Drive tokens and the folder identifier are deleted when you disconnect Drive from your profile, when Google invalidates the grant, or when you delete your account.
Disconnecting Drive in GestiFactura does not revoke the permission at Google. You can revoke it at any time at myaccount.google.com/permissions.
Files we upload to your Drive are yours and stay there even if you disconnect the integration or delete your account.

3.5. Compliance with Google’s policy

GestiFactura’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Recipients and providers

We do not sell your data. We disclose it only to the providers we need to run the Service, acting as processors under contract, or where the law requires it:

Oracle Cloud Infrastructure: application servers, database and files, in the Frankfurt region (Germany).
Cloudflare, Inc.: hosting of this website, DNS and attack protection. United States.
Web3Forms (Web3Creative): receiving beta requests. India, using Amazon Web Services infrastructure; transfers covered by standard contractual clauses.
Google: Sign in with Google, the Drive integration and our email (Gmail), where we receive beta requests and your messages. United States.
Stripe: subscription payment processing. For the data it processes to prevent fraud and meet its own legal obligations, Stripe acts as an independent controller. United States and Ireland.
Email delivery provider: once sending invoices by email is enabled, we will name it in this policy before using it. It will be in the EU or have adequate safeguards.
Spanish Tax Agency (AEAT): billing records, as described in section 2.7.
Public authorities, judges and courts: where a law requires it.

International transfers

Some providers are outside the European Economic Area. In those cases the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission (Art. 46 GDPR).

5. How long we keep data

Beta requests: until we send you the invitation, and for no more than 12 months.
Account data and content: while your account is active. After you close it, you have 30 days to download your invoices. Then we delete them.
Session data and technical logs: 90 days.
Invoices for your subscription and payment data: 6 years (Art. 30 of the Spanish Commercial Code) and the limitation period for tax obligations.
Backups: no more than 30 days; deleted data disappears from them when this period expires.

Where the law requires us to keep data after deletion, we keep it blocked, available only to judges, courts and competent authorities, for the limitation period of any possible liabilities (Art. 32 LOPDGDD).

Important: keeping your invoices for the legal periods (generally 4 years under the Spanish General Tax Law and 6 years under the Commercial Code) is your obligation as the issuer. Download them before closing your account.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by writing to info@gestifactura.es. Say which right you want to exercise and which email you use for the Service. We will reply within one month.

To delete your account, email us from the account’s address. We will delete it within 30 days at most, as described in section 5.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
If you are a customer or supplier of a GestiFactura user, contact that user first, as they are the controller of your data. We will help them handle your request.

7. Cookies

gestifactura.es sets no first-party cookies. The app uses only technical cookies required for it to work, which do not need consent (Art. 22(2) of Spanish Law 34/2002, LSSI):

gestifactura-session: keeps you signed in. Expires after 2 hours of inactivity.
XSRF-TOKEN: protects forms against cross-site request forgery. Lasts as long as the session.
remember_web_*: only if you tick “Remember me” when signing in. Keeps you signed in for up to 400 days or until you sign out.

We use no analytics, advertising or tracking cookies.

8. Security

We apply technical and organizational measures appropriate to the risk:

encrypted connections (HTTPS);
passwords stored as hashes;
Google tokens encrypted in the database;
attachments in private storage;
system access limited to those who need it.

If a security breach affects your data, we will notify it as the GDPR requires.

9. Minors

The Service is intended for professionals and businesses. It is not for anyone under 18, and we do not knowingly process their data.

10. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will email you before it takes effect.