Privacy Policy

1. Data controller

The entity responsible for processing your personal data is:

This Privacy Policy applies to personal data collected through the website invoseal.es and the InvoSeal application at app.invoseal.es.

2. Legal basis and applicable law

InvoSeal processes personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)
• Spanish Organic Law 3/2018 (LOPDGDD) on the Protection of Personal Data and Guarantee of Digital Rights
• Any other applicable national data protection legislation

3. Data we collect and why

3.1 Account registration

When you register for InvoSeal, we collect: full name, email address, company name, tax identification number (NIF/CIF), and billing address. This data is necessary to provide the service and fulfil our contractual obligations (Art. 6(1)(b) GDPR).

3.2 Invoicing data

To provide the electronic invoicing service, InvoSeal processes the invoice data you enter: client names, addresses, tax IDs, invoice amounts and line items. This data belongs to you and is processed only to deliver the service (Art. 6(1)(b) GDPR). InvoSeal acts as a data processor with respect to your clients' personal data; you act as the data controller.

3.3 Payment data

Payments are processed by Stripe. We receive only a payment confirmation and a masked card reference. We do not store full card numbers or CVV codes. Stripe's privacy policy is available at stripe.com/privacy.

3.4 Usage and technical data

We collect standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring and service improvement. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). Logs are retained for a maximum of 90 days.

3.5 Communications

When you contact us by email or through the application, we retain the content of that communication to handle your request and maintain service quality records. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

4. Data processors (sub-processors)

To deliver our service, we engage the following sub-processors. All have signed Data Processing Agreements that comply with GDPR requirements:

Processor	Location	Purpose	Transfer mechanism
Invopop S.L.	Spain / EU	Electronic invoice generation and validation (GOBL engine)	Within EU — no transfer
Base44 Inc.	United States	Application hosting and backend infrastructure	Standard Contractual Clauses (SCC)
Cloudflare Inc.	United States	CDN, DDoS protection, DNS	EU–US Data Privacy Framework (DPF)
Stripe Inc.	United States	Payment processing	EU–US Data Privacy Framework (DPF)

5. Data retention

We retain your data for as long as your account is active or as required by law. Specific retention periods:

• Account and invoicing data: retained for the duration of the contractual relationship plus 6 years after cancellation, as required by Spanish tax law (Ley General Tributaria, Art. 66).
• Billing records: 6 years from the date of each transaction, in compliance with commercial and tax regulations.
• Server logs: maximum 90 days.
• Support communications: 2 years after the matter is resolved.

6. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing — request that we limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please email [email protected]. We will respond within 30 calendar days.

7. Right to lodge a complaint

If you believe your data protection rights have been violated, you may lodge a complaint with a supervisory authority. The competent authority in Spain is:

UK users may also contact the Information Commissioner's Office (ICO) at ico.org.uk. Users in other EU member states may contact their local data protection authority.

8. Cookies and tracking

InvoSeal uses only strictly necessary cookies required for the operation of the service (session management, authentication). We do not use advertising or tracking cookies. Our website does not embed Google Fonts — all fonts are self-hosted. Full details are available in our Cookie Policy.

9. Security

InvoSeal implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encrypted connections (HTTPS/TLS), access controls, and regular security reviews. However, no system is completely infallible and we cannot guarantee absolute security.

10. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified by email at least 15 days before they take effect. The date of the latest revision is shown at the top of this page.

For any questions about this Privacy Policy, please contact us at [email protected].