Privacy Policy

1. Who We Are

AEAT Sync ("we", "us", "our") operates the aeatsync.io platform — a VeriFactu-compliant invoicing engine for businesses operating in Spain. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Spain's Ley Orgánica de Protección de Datos (LOPD-GDD).

2. Data We Collect

3. How We Use Your Data

• Processing and submitting invoices to AEAT on your behalf
• Maintaining the hash chain and compliance audit trail
• Account authentication and API access control
• Sending transactional emails (submission confirmations, failures)
• Improving our service through anonymised usage analytics

4. Subprocessors

We do not sell your data. To deliver the service we rely on the following subprocessors, each bound by a data-processing agreement (DPA):

We notify customers of any new subprocessor at least 30 days before they begin processing data, giving you time to object.

5. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) — currently to Resend, Stripe and OpenAI in the United States — the transfer is protected by:

• The Standard Contractual Clauses (SCCs) adopted by the European Commission in Implementing Decision (EU) 2021/914, signed with each subprocessor; and
• Where applicable, the EU–US Data Privacy Framework (DPF) for subprocessors that are self-certified under it.

6. Data Security

• All API communications over TLS 1.2+
• API keys stored as bcrypt hashes
• Database encrypted at rest, strict network isolation

7. Data Retention

Invoice records are retained for the minimum period required by Spanish tax law (4 years from the filing date). Account data is retained while your account is active and for 30 days after deletion.

8. Your Rights (GDPR)

You have the right to:

• Access (Art. 15) — request a copy of your personal data. You can self-serve by visiting Settings → Danger Zone → Download my data, which produces a complete JSON export.
• Portability (Art. 20) — the same export endpoint provides your data in a structured, machine-readable JSON format.
• Rectification — correct inaccurate data from your account settings, or by contacting us.
• Erasure — request deletion (subject to the legal retention obligations described in section 7).
• Object / Restrict — object to or restrict processing based on legitimate interest.
• Lodge a complaint — with the Spanish Data Protection Agency (AEPD).

To exercise any other right, contact us at [email protected]. We will respond within one month.

9. Cookies

We use:

• Session cookies — essential for login functionality
• Preference cookies — language selection, cookie consent status

No third-party advertising or tracking cookies are used.

Your cookie consent record

When you choose Accept All or Necessary Only on the banner, we record that choice together with the IP address and browser it came from, under a random identifier stored in a cookie on this device. You do not need an account to see or erase that record — the cookie is what identifies it.

Erasing removes every consent record held under this device’s identifier and clears the cookie. The banner will appear again on your next visit, because we then hold no record of a choice.

10. Changes

We may update this policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use after changes constitutes acceptance.

11. Contact

For privacy enquiries: [email protected]