Privacy Policy

Last updated: April 2026 (version 2026-04-29)

1. Who We Are

AEAT Sync ("we", "us", "our") operates the aeatsync.io platform — a VeriFactu-compliant invoicing engine for businesses operating in Spain. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and Spain's Ley Orgánica de Protección de Datos (LOPD-GDD).

2. Data We Collect

Category	Examples	Legal Basis
Account Data	Company name, NIF, email address	Contract performance
Invoice Data	Issuer/recipient details, line items, amounts	Legal obligation (VeriFactu)
Technical Data	IP address, browser type, access logs	Legitimate interest
Certificates	AEAT signing certificates (encrypted at rest)	Contract performance

3. How We Use Your Data

Processing and submitting invoices to AEAT on your behalf
Maintaining the hash chain and compliance audit trail
Account authentication and API access control
Sending transactional emails (submission confirmations, failures)
Improving our service through anonymised usage analytics

4. Subprocessors

We do not sell your data. To deliver the service we rely on the following subprocessors, each bound by a data-processing agreement (DPA):

Subprocessor	Purpose	Region
Agencia Tributaria (AEAT)	Mandatory submission of VeriFactu invoice records	Spain (EU)
Hetzner Cloud	Application hosting, database, object storage	Germany / Finland (EU)
Cloudflare	CDN, DDoS protection, WAF, secure tunnel	Global (EU presence; SCCs)
Resend	Transactional email (login OTPs, notifications)	United States (SCCs)
Stripe	Subscription billing & payment processing	United States / Ireland (SCCs, DPF)
OpenAI (optional)	"Veri" assistant chatbot — only when you choose to use it	United States (SCCs, DPF)

We notify customers of any new subprocessor at least 30 days before they begin processing data, giving you time to object.

5. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) — currently to Resend, Stripe and (when enabled) OpenAI in the United States — the transfer is protected by:

The Standard Contractual Clauses (SCCs) adopted by the European Commission in Implementing Decision (EU) 2021/914, signed with each subprocessor; and
Where applicable, the EU–US Data Privacy Framework (DPF) for subprocessors that are self-certified under it.

The OpenAI integration ("Veri" chatbot) is opt-in and can be disabled at any time from your account settings; if disabled, no data is sent to OpenAI.

6. Data Security

All API communications over TLS 1.2+
Certificates encrypted at rest with Fernet (AES-128-CBC)
API keys stored as bcrypt hashes
Database encrypted at rest, strict network isolation

7. Data Retention

Invoice records are retained for the minimum period required by Spanish tax law (4 years from the filing date). Account data is retained while your account is active and for 30 days after deletion.

8. Your Rights (GDPR)

You have the right to:

Access (Art. 15) — request a copy of your personal data. You can self-serve by visiting Settings → Danger Zone → Download my data, which produces a complete JSON export.
Portability (Art. 20) — the same export endpoint provides your data in a structured, machine-readable JSON format.
Rectification — correct inaccurate data from your account settings, or by contacting us.
Erasure — request deletion (subject to the legal retention obligations described in section 7).
Object / Restrict — object to or restrict processing based on legitimate interest.
Lodge a complaint — with the Spanish Data Protection Agency (AEPD).

To exercise any other right, contact us at [email protected]. We will respond within one month.

9. Cookies

We use:

Session cookies — essential for login functionality
Preference cookies — language selection, cookie consent status

No third-party advertising or tracking cookies are used.

10. Changes

We may update this policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use after changes constitutes acceptance.

11. Contact

For privacy enquiries: [email protected]