Privacy policy
This policy explains what personal data Fakturist processes, why, how long we keep it, who sees it and what rights you have under the General Data Protection Regulation (GDPR). The Bulgarian text prevails.
Who processes the data
Carbon Stealth VCC (Карбон Стелт ЕДПК), EIK 208725180, ul. Samuil 3, 2670 Bobov Dol, Kyustendil Province, Bulgaria, tel. +359 877 414 874. For personal data write to privacy@carbonstealth.eu.
For the data of accounts (the people who use Fakturist) we are the controller — this policy covers them. For personal data in companies' documents (counterparties, contact persons), in the bank statements and incoming e-invoices companies upload, and in the emails they send through Fakturist, we are a processor: the controller is the company issuing the document, and we process the data under the data processing agreement.
What data, why and for how long
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Name, email, language, password hash (Argon2id), email confirmation date, last sign-in | The account and signing in to it | Contract, Art. 6(1)(b) GDPR | While the account exists |
| Two-factor sign-in: secret key (encrypted with AES-256-GCM) and the last accepted step | A second factor at sign-in, if you turned it on | Contract | Until turned off or the account is closed |
| The data of the company you are a member of (name, EIK, VAT number, address, IBAN) and your role in it | The particulars of documents and the rights in the account | Contract | While the company is registered |
| Session: the cookie and a record in the database (when it was created and used) — no IP address | To keep you signed in | Contract | Until sign-out or expiry: 3 days without activity, at most 14 days (for our staff — 8 hours and 1 day); the record is deleted within 30 days after expiry |
| Email links (new password, email confirmation): SHA-256 hash of the link, the address it was sent to, its validity | Security of the account | Contract; legitimate interest, Art. 6(1)(f) GDPR | The link is valid 1 hour (password) or 7 days (email); the record is deleted within 30 days after it expires |
| Emails from the queue: recipient address, kind of email, when it was sent | To send the email and see whether it went out | Contract | 90 days after sending |
| Invitations and mandates: the invitee's email, the link hash, who invited and when | Transferring a company to its owner and the accounting firm's work under a mandate | Contract; legitimate interest | The invitation is valid 7 days; the record — while the company is registered |
| Accepted legal documents: who, which document, which version, when | Proof of the contract | Legitimate interest: to prove the conclusion and content of the contract in a dispute | Five years after the account is closed (the general limitation period) |
| Audit log: who did what and when in the account and the company — no IP addresses and no emails | Accountability and defence in a dispute | Legitimate interest: to show who did what in a dispute or abuse | While the company is registered and up to 5 years after it is closed |
| Plan payments: the amount, VAT, the plan and period, the reference ("FKT-…"), the Revolut order identifier, which member placed the order and which of our team confirmed the transfer, the payment date; the pro forma and the invoice, which arrive in the company's inbox and by email to its owner, administrators and accountants | The paid plan contract and our accounting | Contract; legal obligation, Art. 6(1)(c) GDPR | The periods under the Accountancy Act and the VAT Act |
| Company API keys: key name, who created it, its prefix, SHA-256 hash, scope, last use, revocation | Access for the company's integrations; documents issued with the key are recorded in the creator's name | Contract; legitimate interest: to show which key issued what | While the company is registered |
| Emails you write to us | To answer you | Legitimate interest: to answer and keep the correspondence in case of a dispute | Up to three years after the last email |
Email, name and password are needed for an account to exist. Without them we cannot create it.
IP addresses
We do not keep IP addresses: neither the application nor the web server logs requests. The limit on sign-in and email attempts counts the address (for IPv6 — the /64 network) only in the server's memory, for up to 15 minutes. The web server records an address only in its log of critical errors. The same applies to the API request limit.
Who else sees the data
- The other members of your company and its accounting firm with an active mandate; the recipient company of a document delivered to its inbox, and its members.
- Our support team — under a duty of confidentiality and only as far as needed.
- netcup GmbH, Germany — the server Fakturist runs on, in a data centre in the European Union. The database backups are on it too — every day and before every update, for at most 90 days.
- Sendinblue SAS (Brevo), France — sending the emails described below.
- Revolut Bank UAB, Lithuania, and the payer's bank — card payment takes place on Revolut's page: you enter your card details there, and we receive only the status, amount, identifier and time of payment. Revolut and the bank process the payment data as independent controllers.
We do not sell data or provide it for advertising. We do not transfer personal data outside the European Union; if a subcontractor of Brevo processes data outside the EU, the transfer is protected by standard contractual clauses (Art. 46 GDPR).
Cookies
We use two cookies without which the service does not work or is not protected — the session after sign-in and the trusted device. We have no analytics, advertising or third-party cookies, so we show no consent banner. Fonts are loaded from our own server.
| Name | Purpose | Legal basis | Lifetime |
|---|---|---|---|
__Host-fakturist | The session after sign-in (signed identifier, HttpOnly, Secure, SameSite=Lax) | Strictly necessary for the requested service (Art. 4a(4) Electronic Commerce Act; Art. 5(3) Directive 2002/58/EC) — no consent needed; for the data — contract | 3 days without activity, at most 14 days (for our staff — 8 hours and 1 day) |
__Host-fakturist_dev | Trusted device: a browser you have signed in from successfully (with the password and — if enabled — the second factor) can still sign in when someone else has locked the account with wrong passwords (signed account identifier and expiry, no other data) | Strictly necessary for account security (the same provisions) — no consent needed; for the data — legitimate interest: account security | 180 days from the last sign-in |
The installed app (on your phone or computer) has a service worker that keeps nothing on the device: it only shows a “No connection” page when there is no network.
Emails
We send only emails related to the account and documents: email confirmation, a link for a new password, a notice of a document delivered to your company's inbox (with PDF and XML), the pro forma and invoice for the paid plan, an invitation to take over a company's account, and notices to our team to review ownership. We do not send marketing emails. Emails that companies send through Fakturist to their recipients (recurring invoices, pro forma invoices, payment reminders) are sent on their behalf — see "If you do not use Fakturist".
If you do not use Fakturist
If you received an invoice, a pro forma invoice or a payment reminder from a company through Fakturist, if you are a supplier whose e-invoice a company uploaded, or if you paid a company that reconciles its statements with us, the controller of your data is that company — replies to the email go to it. We process the data only on its instructions under the data processing agreement and keep it while the company uses the service; payers' data from statements — for a shorter period (agreement, clause 11). We forward any request sent to us to the company.
Automated decisions
We make no decisions with legal effects on you solely by automated means. The rules check on issue stops a document with an error — it concerns the document, not you as a person. The temporary limit after many sign-in attempts lifts by itself.
Security
The connection is HTTPS only, with HSTS. Passwords are stored as Argon2id hashes, two-factor secret keys and our integration keys — encrypted, companies' API keys, email links and invitations — only as hashes. Sessions live on the server and end at once on a new password. The master panel opens only with two-factor sign-in. Application logs contain no emails, passwords or IP addresses. We back up the database every day and before every update; backups are kept for at most 90 days.
Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and to object to processing based on legitimate interest. Under “Security” in your account you can download your personal data (JSON) and close the account yourself; the owner downloads the full company archive (ZIP with the PDF and XML of every document). For anything else write to privacy@carbonstealth.eu — we reply within one month.
Closing the account erases your name and email at once; on a request by email we do it within one month (Art. 12(3) GDPR). Documents issued by the company belong to the company, and the law obliges it to keep them — so they remain in its account while it is registered.
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg) or with the supervisory authority in the EU country where you live or work.
Minors
Fakturist is a professional tool and is not intended for persons under 16.
Changes
If we change this policy materially, we will notify you by email before the change takes effect. The version date is at the top of the page.