Privacy notice for accounts

This notice adds to our privacy policy for people who create an account or are invited to one. The controller is Mohamed (Mo) Farag, Carrer de Floridablanca 68, Local 9F, 08015 Barcelona, Spain, [email protected]. The lists you add to your account (identifiers, references, client names) are your data; we process them for you under the data processing terms.

What we store about you, and why

Data	Purpose	Legal basis	Kept for
Login email, and when you last logged in	logging you in by email link, sending the change emails you asked for	contract	until the account closes, then 30 days
Colleagues you invite (their work email)	giving them access: we email them one link	contract with the account holder; legitimate interest for the colleague	until they leave or the account closes; an invite nobody accepts is deleted after 7 days
Company name, country and VAT number	the account, refusing businesses in Spain, invoices	contract; legal obligation (invoices)	account: as above; on invoices: 6 years [3]
VIES check of your VAT number (the EU's answer and its reference)	proof for the reverse-charge rule on invoices	legal obligation	6 years from the check
Payments and invoices (handled by Stripe; we keep only Stripe's customer and subscription references, never card details)	billing	contract; legal obligation	6 years; after the account closes they stay, blocked, until then
Terms you accepted (the version, a fingerprint of its text, the time, and your confirmation that you act for a business)	proof of the contract	legitimate interest; legal claims	6 years after the contract ends; after the account is deleted we keep only the company, VAT number, Stripe reference and these facts, no email
Order confirmations (what you bought, the price, the period)	the confirmation email the law asks for	contract; legal obligation	sent to your login email; kept with the contract record
Featured bookings (product, country, status, paid until)	showing the box and billing it	contract	with the account; the billing part 6 years
Alert emails: the identifier and reference lines from your lists	sending the changes you asked for	contract	not kept by us; Lettermint keeps delivery logs 28 days
API key (stored only as a hash, with its first characters to show which one), webhook address and signing key, embed domains	the developer features of your plan	contract	until you remove them or the account is deleted
Session: a random value in a cookie, stored by us only as a hash	keeping you logged in	contract	until you close the browser (at most 12 hours after you last used the site), or 30 days if you ticked "Keep me logged in"
Rate limiting: a short-lived counter keyed on a hash of your IP address and of your email	stopping abuse of the login and sign-up emails	legitimate interest	1 hour
Your logo (Firm plan, if you upload one)	putting it on your reports	contract	until you remove it or the account is deleted

We don't use your data for advertising, don't sell it and don't build profiles. Change emails go only to account users who didn't turn them off.

If your identifier is on someone's list

A business with an account may add identifiers of its customers or clients, some of which belong to sole traders. For that data the account holder decides why and how, and we act as its processor under the data processing terms. To use your rights, ask the account holder. If you write to us, we pass the request on to them without undue delay and tell you who is responsible. You can also object to our own use of public Peppol data under the privacy policy.

Who else handles it

• Stripe Payments Europe, Ltd. (Ireland) takes the payment. It acts for us as processor, and as its own controller for fraud prevention and its legal duties; see Stripe's privacy policy. Its US group company receives data under the EU–US Data Privacy Framework.
• Hetzner Online GmbH (server in Germany), Cloudflare, Inc. (USA; delivery and security; see the transfers in the privacy policy) and Lettermint B.V. (Netherlands) (sending emails, EU servers) on our behalf.

In your browser

Logging in sets one strictly necessary cookie (em_session, HttpOnly). It ends when you close the browser (or 12 hours after you last used the site, if that comes first), or lasts 30 days if you tick "Keep me logged in". It needs no consent. "Watch this ID" keeps the numbers you chose in your browser's storage for at most a day, only after you click it, to hand them to the account page. If you pick a plan on the plans page, that choice is kept in your browser for at most a day, so it is still there after the login link. See cookies.

Your rights

You can see your account data on the account page, download your lists as a file, remove entries and close the account. To correct your company details or email, or to have your data deleted at once, write to [email protected]. If you close the account yourself, we delete everything 30 days after it closes (with a paid plan, after the paid period ends), so you can still change your mind. You can also ask for access, correction, erasure, restriction or portability, or object. Requests are free; we answer within 7 days and at the latest within one month. You can also complain to the Spanish data protection authority (AEPD) ^[2].