Privacy Policy — FactuSimple

1. Data Controller

• Data Controller: RMTracker S.L. («RMTracker»)
• Tax ID: B88803085
• Activity (CNAE): 6210 — IT programming activities
• Registration data and address: as appearing in the Legal Notice of RMTracker Solutions.
• Privacy email: legal@rmtrackersolutions.com

2. An important notice about who decides what

A FactuSimple can be achieved in two ways: because their advice registers you registers under his own account. This changes who decides about his data, and therefore it is advisable to explain this first.

If he registers through his advisory firm: regarding the tax and labor data that you enter, she decides for what purpose they are used, because she is the one providing the advisory service and is obligated to keep them. RMTracker acts as a provider of the tool.

If he registers under his own account and does not have an affiliated advisory firm: the responsible for the treatment is RMTracker, and you will deal directly with us for everything, including your rights.

In any case, you can contact RMTracker in legal@rmtrackersolutions.com to exercise your rights: if the responsible for that part of the treatment is his advisory firm, he will be given a copy and informed about it.

3. What data is processed

3.1 About you, as a user

• Identification and access: email and password (the latter is never stored in plain text; it is managed by Supabase Auth).
• Data about his business: name, NIF/CIF, address, phone number, email and logo, which are included in the invoices he issues.

3.2 Data that you enter about third parties

• Your customers and suppliers: name or company name, NIF/CIF and address, as they appear on the invoices.
• Their employees (Labor department section): the data necessary for processing new hires and terminations, and for providing you with pay stubs.

You are responsible for entering data about others. You must have a legal basis for providing us with this information and informing them that their data is being processed in this tool.

3.3 Documents and files

• Invoices captured with the camera and other supporting documents.
• Bank statements (N43, CSV file or spreadsheet) that you send so that your advisor can reconcile the transactions. They contain your account movements.

They are stored in a container. privatein its own folder by user, with database-level access rules that prevent a user from reading the files of another.

3.4 Activity log

An audit trail of operations on tax data is maintained (creation, modification and deletion). It is append-only: even you can't change it. It exists to be able to prove what happened and when, which is exactly what anti-fraud regulations require.

4. What we do NOT do

• We do not sell or transfer your data. for commercial purposes.
• There is no advertising or profiling. The application does not incorporate any analytics or advertising SDKs.
• The invoice text recognition is done on your own device (Google ML Kit locally). The photograph is not sent to Google to read it.
• There are no automated decisions with legal effects on you.

5. For what purpose and with what legal basis

6. Who else is involved

• Your advisor: accesses the documentation you send to them. They are the natural recipient of the service.
• Supabase (hosting, database, storage and authentication). The data resides in the European Union (region eu-north-1).
• Tax Agency (AEAT): receives the billing records required by the Veri*factu regulation. It is a legal obligation.
• Google (ML Kit): only as a library that runs on your device. It does not receive your documents.

International data transfers outside the European Economic Area are not performed for the provision of the service. If any are necessary in the future, they will be informed about and the guarantees required by Chapter V of the GDPR will be adopted.

7. How long are records kept

• Invoices and accounting documents: as long as required by tax and commercial regulations. As a reference, four years of tax prescription and six years of conservation of accounting books.
• Veri*factu records: are immutable by design. They cannot be modified or deleted: an invoice registered is corrected by issuing a rectification, never altering the original.
• Access and profile data: as long as the account is active. They are deleted when the account is closed.

8. Your rights

You can exercise your rights of access, rectification, deletion, limitation, portability and opposition by writing to: legal@rmtrackersolutions.com, and claim against Spanish Agency for Data Protection.

9. Account deletion

You can delete your account in two ways:

• From within the app itself: Settings → Delete my account.
• From the website, without needing to log in: data deletion request form.

What is being eliminated: his access, his business data and logo, and his customers and products.

What cannot be removed, and why: your invoices and payroll records are under the custody of your advisor for the period required by law. We cannot delete them even if you request it: the obligation to retain is legal and falls on the taxpayer and their advisor. The Veri*factu records already sent to the AEAT also cannot be removed.

10. Safety

Access to data is restricted at the database level through user policies: each client can only read and write their own data. Document containers are private and are served via limited-duration signed links. Invoices that have already been recorded are protected from modification by rules within the database itself.

11. Under 18

FactuSimple It is a professional tool aimed at freelancers and companies. It is not intended for minors and their data are not collected knowingly.

12. Changes in this policy

Versions are recorded with their effective date. If a change significantly affects the treatment, you will be notified through available contact methods.