Privacy Policy

1. Controller

The controller for this website and for the account data of the Facturx-Prêt service is: Radom UG (haftungsbeschränkt) Telemannstr. 2 60323 Frankfurt am Main Germany E-mail: support@facturx-pret.fr

For questions about data protection or to exercise your rights, write to us at this address or use our contact form.

For the content of the invoices you process with the service, you are in principle the controller; we then act as a processor on your behalf (see sections 6 and 7).

2. Hosting and server logs

We host the website and the service with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the Nuremberg data centre (Germany). Hetzner acts on our behalf as a hosting provider.

When you visit our website, our web server (nginx) processes technically necessary access data: your IP address, the date and time of the request, the address requested and your browser identifier (server logs). We use them to operate the service and to prevent abuse; they are rotated daily and deleted after 14 days. The logs of the application containers have a limited size and are overwritten continuously.

If a page violates our Content Security Policy, your browser automatically sends a report to our server (/api/csp-report). The application logs only the affected directive and the host of the affected resource (or a keyword, for example inline, eval, data, blob, self, other or unknown); it logs neither the address of the page you visited, nor URL parameters, nor your IP address, nor any user data; the request itself appears, like any request, in the web server access logs described above. To prevent abuse, reports are counted per network (IP address, or /64 network for IPv6, used only as the counter key and never logged); these counters are kept in memory and reset after one hour. These log lines are copied to a file on the host and kept for at most 14 days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the service.

3. Strictly necessary cookies and local storage

To provide the functions you request, we use cookies and browser storage entries that are strictly necessary:

• next-auth sign-in cookie (session token): set when you sign in; it keeps you signed in for up to 30 days after your last activity.
• next-auth security cookies (CSRF token and callback address): session cookies set when you use the sign-in and deleted when you close the browser.
• NEXT_LOCALE language cookie: a session cookie that remembers the language in which you use the website.
• Your analytics choice in your browser's localStorage (facturx_analytics_consent_v1), so that the banner does not appear on every visit. The entry stays until you change your choice or clear your browser storage.

These cookies and storage entries are strictly necessary to provide the service you expressly request; they are not used for tracking. They require no consent (Article 82 of the French Data Protection Act). The legal basis for the processing that follows is Art. 6(1)(b) or Art. 6(1)(f) GDPR (legitimate interest in a working website).

4. User account

If you create an account, we process your name, e-mail address, password and subscription status (plan, status, end of period, Stripe customer and subscription identifiers). The e-mail address and password are required for registration; without them we cannot create an account. The password is stored only as a bcrypt hash, never in plain text.

If you ask to reset your password, we use your e-mail address to send you a message containing a one-time link. This link is valid for one hour and can be used only once. In our database, we keep the token it contains only as a fingerprint (hash), together with your e-mail address; it is deleted as soon as the link is used, and expired tokens that were never used are deleted every day. The token is never written to our logs. The message is sent through Google Workspace, the mail provider named in section 10: as with any e-mail sent, a copy of the message may be kept in the sending account's mailbox. When you choose a new password, the sessions opened before are closed. The site answers in the same way whether or not the address entered matches an account.

If you change your password from “My account”, we first check your current password; the new one is also stored only as a bcrypt hash, and the sessions opened before are closed.

The account data is stored in an SQLite database on our server at Hetzner. We back up the database daily, on the same server and as a copy on a second Hetzner server in Nuremberg, transferred over an encrypted connection (SSH). Both copies are kept for 14 days. This database also holds, if you have saved them, your seller profile and your client book, as well as your invoice history (section 6): they are therefore included in these backups.

We keep your account data for as long as your account exists. You can delete your account yourself at any time from “My account” (your password is asked), or write to us at support@facturx-pret.fr. The deletion first erases the invoice files of your account kept on our server (the generated files, the source files and the associated tracking files); if these files cannot be erased, your account is not deleted and you can try again later. It then removes from the database your account, your seller profile, your saved clients, your invoice history, your quota counters, the attempt-limit counters computed from your account identifier or from your e-mail address alone, and your password-reset tokens; the counters computed from your network, including the sign-in counter that combines your network and your e-mail address, cannot be linked to your account: they expire by themselves (section 5). It is refused while a paid subscription is neither over nor cancelled (active, unpaid, paused or awaiting payment) or while a payment has just been started and is not recorded yet (for 30 minutes at most): cancel it first in Stripe's secure payment portal, or write to us; we do not cancel it for you and we do not delete your Stripe customer. The data deleted from the database can then remain in the backups for up to 14 days; these backups contain no invoice file.

The legal basis is Art. 6(1)(b) GDPR (providing the account and the plan you chose). The backup is based on Art. 6(1)(f) GDPR; our legitimate interest is protection against data loss.

5. Quotas and abuse protection

If you use the service without an account, we derive an identifier (HMAC) from your IP address (for IPv6, the /64 network) and a secret key, and store with it the number of your conversions and file analyses in the current period. The IP address itself is not stored for this purpose. With an account, these counters are linked to your account.

We delete these counters no later than 32 days after the start of their counting period; those linked to your account are deleted as soon as you delete your account (section 4).

To limit sign-in, sign-up and password reset attempts, as well as contact form submissions and VAT number checks, we also count requests per network (IP address, or /64 network for IPv6) and, for sign-in and password reset, per e-mail address. These are counted per account, with a fingerprint computed from the internal identifier of your account: openings of Stripe's secure payment portal, openings of the payment page (Stripe Checkout), password changes from “My account”, the calls that read, save or delete your seller profile, your clients or your history (including the check of an invoice number), invoice downloads from the history and attempts to delete your account. As with the quotas, we store only a fingerprint (HMAC) computed with a secret key, with the type of limit, the start of the counting period, the number of requests and the creation and last update times of the record, never the IP address or the e-mail address itself. These records are deleted within the same period as the quota counters: no later than 32 days after the start of their counting period; those computed from your account identifier or from your e-mail address alone are deleted as soon as you delete your account (section 4).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a fair distribution of the free quotas and the security of the service.

6. Processing of invoice data

When you use the generator, we process the files you upload and the invoice data you enter in order to produce electronic invoices in Factur-X format. Invoices may contain personal data, for example the names, addresses and bank details of the issuer and the recipient.

For business use, you are the controller of the invoice data; we process it exclusively on your behalf and on your instructions (processing agreement, next section).

Source files and generated results are stored under a technical identifier, without their original file name and without your name or e-mail address; the file contents remain unchanged. We keep them to answer queries and to fix processing errors as part of the service: 7 days in guest mode, 90 days with an account, after which they are deleted automatically (daily purge), together with the associated tracking files (manifests). You can ask for earlier deletion at any time at support@facturx-pret.fr. Invoice files are included in no backup.

At your request, we also save in your account what is needed to fill in your invoices in advance: your seller profile (company name, legal form, share capital, RCS or RM registrations, SIREN, SIRET, VAT number, address, e-mail address, VAT franchise), your bank details (IBAN, BIC, account holder), your payment terms, your legal mentions, your invoice number pattern and the next sequence number. These details are saved only when you click “Save as profile”. After each invoice generated with the form whose number follows your pattern, the next sequence number, and the year it relates to when the pattern contains the year, are updated automatically in your profile.

You can likewise save up to 500 clients with “Save this client” (for each: the name and the label, the address, the e-mail address, the SIREN, the SIRET, the VAT number and the buyer reference). This data concerns your own customers and can be personal data of third parties, for example the name of a sole trader: we process it on your behalf (section 7).

The saved profile and clients stay in your account until you delete them or your account is deleted: you can edit the profile from the generator and delete it from “My account” (which also deletes the number counter), and delete each client from the generator. They are stored in the account database and are therefore included in its backups, kept for 14 days (section 4). They are used only to fill in your invoices in advance.

For each invoice you generate with an account, we also save in the history of your account: the invoice number, its date, the recipient's name, the total amount including VAT, the currency and the document type. The history does not contain the invoice itself: it lets you download the file again for as long as it is kept, which is 90 days at most after it was generated, then the file is deleted automatically (daily purge). The history line stays in your account until you erase the history from “My account” or delete the account (section 4); it is stored in the account database and is therefore included in its backups, kept for 14 days. Erasing the history does not delete the files already generated: they stay stored, without your being able to download them again, until they are deleted 90 days at most after they were generated or until your account is deleted. A recipient's name can be personal data of a third party: we process it on your behalf (section 7).

The validation of the generated e-invoices and PDF/A files runs locally on our own server; no data is sent to third parties for it.

We do not transmit your invoices: the service generates a file that you download. It is not an approved platform and is not connected to the French public invoicing portal.

Where we exceptionally process invoice data as a controller (for example guest use without professional status), the legal basis is Art. 6(1)(b) or Art. 6(1)(f) GDPR.

7. Processing agreement for business customers, and providers

For business use, we conclude with you, by your acceptance of our terms (CGV) at registration, the data processing agreement under Art. 28 GDPR. This agreement is an integral part of our terms; you can read it at facturx-pret.fr/en/accord-sous-traitance, and its annexes set out the details of the processing, the security measures and the list of sub-processors.

This agreement applies only to customers with an account, because guest users do not accept the terms. Businesses that process third parties' personal data should therefore use an account.

The following providers take part in our processing. The first three receive the content of your invoices and are the sub-processors of Annex 3 of the agreement; the others process only account, billing or audience data, or the VAT numbers you check:

Stripe, PostHog, Umami and VIES never receive the content of your invoices; they are therefore not listed in Annex 3 of the data processing agreement.

8. AI-assisted reading (Microsoft Azure OpenAI)

To read some files that you upload, we use the Azure OpenAI Service of Microsoft Ireland Operations Ltd. In those cases, the file content (text or page images) is sent to Microsoft; the file name is sent too when the text of PDFs and of CSV, Excel, XML and MT940 files is read, but not for images. This applies exclusively to the following cases:

• images (JPG, JPEG, PNG, HEIC): always, together with the text recognised by OCR;
• PDFs without usable text (for example a scanned document) or whose automatic extraction is incomplete or uncertain (missing or ambiguous invoice number or date, seller or buyer details, seller tax identifier or line items): the extracted text is sent together with the file name and, if that is not enough, the page images (at most 10 pages); a PDF containing a complete Factur-X XML is in principle not read by AI;
• CSV or Excel files uploaded one at a time (outside batch processing) whose column structure is not recognised: the file content (for an Excel workbook, the first 100 rows of each sheet) and its name are sent;
• XML files that are neither CII (Factur-X/ZUGFeRD) nor a camt.053 statement, for example UBL XML: the file content and name are sent; a CII file that our secure XML reader cannot parse (for example invalid XML) is sent too (without its original file name), whereas a well-formed CII file that the reader cannot interpret is not sent to the AI, and camt.053 statements never are;
• MT940 bank statements (.sta, .mt940, .940, .mt9): always, the first 10,000 characters of the statement and the file name.

Entry in the form, generation of the Factur-X XML, validation and the batch processing of CSV and Excel files do not use AI: the content of the files of a batch is never sent to Microsoft. A validation failure does not trigger any further AI call: the extracted data is shown to you with the errors, for you to correct.

Provider and place of processing: Microsoft Azure OpenAI Service — regional (Standard) deployment in the Azure region Sweden Central (EU): requests are processed there. Microsoft acts on our behalf as a processor (a sub-processor for business use). According to Microsoft's terms, the content sent is not used to train the models. According to Microsoft's documentation, a sample of inputs and outputs may be reviewed to detect abuse, in some cases by human review by authorised Microsoft employees. Any access by authorised Microsoft employees is governed by Microsoft's data protection addendum (terms of the Microsoft customer agreement).

The results of the AI-assisted reading are shown to you for review: it is up to you to check them before you generate the file. No automated decision producing legal effects concerning you, including profiling, is taken (Art. 22 GDPR).

For business use, this processing takes place on your behalf; where we act as a controller, the legal basis is Art. 6(1)(b) GDPR.

9. Payment of subscriptions (Stripe)

We bill paid plans through Stripe Payments Europe, Ltd., Dublin, Ireland. You enter your payment data on Stripe's payment page. Stripe processes this data under its own terms, partly as a controller and partly as a processor. Stripe may transfer data to Stripe, Inc. in the USA, based on the EU-US Data Privacy Framework or standard contractual clauses.

From “My account”, the “Manage my subscription” button opens Stripe's secure payment portal, which Stripe operates: there you can see your invoices, update your payment method and cancel your subscription. To open it, we send Stripe the Stripe customer identifier of your account, the language of the page and the return address to our site.

We receive information from Stripe about the status of your subscription, which we link to your account.

Deleting your account does not cancel your subscription and does not delete your Stripe customer: it is refused while a paid subscription is neither over nor cancelled. Stripe keeps your billing and payment records under its own terms and the legal obligations.

The legal basis is Art. 6(1)(b) GDPR. Billing and payment records are kept for the period required by the statutory retention obligations (up to 10 years; Section 147 AO and Section 257 HGB); the legal basis for this is Art. 6(1)(c) GDPR.

10. Contact form, support and e-mail (Google Workspace)

If you contact us through the contact form or by e-mail, we process the information you give us (name, e-mail address, subject and message) to handle your request. Messages from the form are forwarded by e-mail to our support mailbox. All fields of the form are mandatory; without them we cannot handle your request.

For support and the service's e-mails we use Google Workspace from Google (contracting party based in Ireland). A transfer of personal data to Google LLC in the USA cannot be excluded; it relies on the EU-US Data Privacy Framework where the provider is certified.

If you send us files or invoice data by e-mail, we process them on your behalf (section 7).

The legal basis is Art. 6(1)(b) GDPR where your request relates to your account, a contract or its preparation, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering the requests addressed to us. Requests are kept in our mailbox for as long as needed to handle the request and to follow up on the relationship.

11. Audience measurement, only with your consent (Umami and PostHog)

We load the audience measurement tools only after you agree through our consent banner. They help us measure page views, journeys in the product and errors. We have configured them so that URL parameters, file names, e-mail addresses and invoice contents are not sent to them.

Umami is a measurement tool that works without cookies. We operate it ourselves at Hetzner in Germany, on the same server as the service, at analytics.konverter-pro.de. Analytics data collected with Umami (page views, events and sessions) is automatically deleted 14 months after it was collected.

PostHog is a service of PostHog Inc. We use PostHog's EU cloud (eu.i.posthog.com). After your consent, we store a random identifier in your browser's sessionStorage (fx_ph_facturx-pret_sid) to group the events of a session; it is deleted when you close the tab. Your browser communicates technically with PostHog's servers (IP address). If a transfer to the USA takes place, it relies on the EU-US Data Privacy Framework where the provider is certified.

The legal basis is your consent (Art. 6(1)(a) GDPR and Article 82 of the French Data Protection Act). You can withdraw your consent at any time, with effect for the future, with the "Privacy settings" button at the bottom left of every page.

12. VAT number verification (VIES)

If you use our VAT number verification tool, we query the European Commission's VIES service with the number you entered to check its validity. The recipients are the European Commission (VIES) and the tax authority of the Member State concerned.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is providing you with the verification you asked for.

13. Transfers outside the European Union and safeguards

We host account and invoice data in Germany (Hetzner, Nuremberg), and the AI-assisted reading takes place in a regional deployment in the Azure region Sweden Central (EU); for these two services we do not plan any transfer to a third country. A transfer outside the European Union may take place in the following cases:

• Stripe: transfers to Stripe, Inc. (USA);
• Google Workspace: a transfer to Google LLC (USA) cannot be excluded;
• PostHog: the operator is PostHog Inc. (USA), even though the data is received by the EU cloud.

These transfers rely on the EU-US Data Privacy Framework, where the provider is certified. For Stripe, they rely failing that on the European Commission's standard contractual clauses (Article 46 GDPR). For any question about these safeguards, write to us at support@facturx-pret.fr.

14. Security

We protect your data with appropriate technical and organisational measures, in particular:

• connections encrypted with TLS (HTTPS), redirection from HTTP to HTTPS and HSTS;
• passwords stored only as a bcrypt hash;
• administrative access to the servers by SSH key only, with a firewall that opens only SSH, HTTP and HTTPS to the public;
• sign-in attempts limited at the web server: 5 requests per minute per IP address (short bursts tolerated) on sign-in, registration and password reset;
• sign-in attempts limited by the application: 50 attempts per 15 minutes per network (IP address, or /64 network for IPv6), 10 attempts per 15 minutes for the same network and e-mail address, and 100 attempts per hour for the same account, whatever the network; sign-up is limited to 5 per hour per network, and password reset requests are also limited;
• password reset link that can be used once and is valid for one hour, and sessions opened before a password change are ended;
• the application's internal interface and the validation services reachable only locally on the server, the interface being protected by an internal key;
• access to the servers restricted to the managing director and persons he expressly authorises, who are bound to confidentiality;
• every read and write of your profile, your clients and your history is limited to the identifier of the signed-in account, and the file of an invoice is given only to the account that generated it, on a signed request between the site and the processing service;
• automatic deletion of uploaded files and results after 7 days in guest mode or 90 days with an account (section 6), and a daily backup of the account database (section 4).

Radom UG (haftungsbeschränkt) holds no security certification. The measures are detailed in Annex 2 of the data processing agreement.

15. Your rights

Under the GDPR, you have the following rights:

• access to the data we process (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure of your data (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection to processing (Art. 21 GDPR, detailed in the next section).

You can withdraw a consent you have given at any time, with effect for the future (Art. 7(3) GDPR). Write to us at support@facturx-pret.fr or use our contact form.

To exercise your right to erasure, you can delete your account from “My account” (section 4) or write to us.

For the data of third parties named in your invoices, those persons must turn to you, as the controller; we assist you in accordance with Article 7 of the data processing agreement.

17. Complaint to a supervisory authority

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example with the Commission Nationale de l'Informatique et des Libertés (CNIL, www.cnil.fr) in France.

The lead supervisory authority for Radom UG (haftungsbeschränkt), whose seat is in Frankfurt am Main, is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit, HBDI) in Wiesbaden (datenschutz.hessen.de).