Privacy Policy — FactuSimple

1. Data Controller

• Data Controller: RMTracker S.L. («RMTracker»)
• Tax ID: B88803085
• Activity (CNAE): 6210 — IT programming activities
• Registration data and address: as appearing in the Legal Notice of RMTracker Solutions.
• Privacy email: legal@rmtrackersolutions.com

2. An important notice about who decides what

With an account, FactuSimple can be reached in two ways: because their advice registers you registers under his own account. This changes who decides about his data, and therefore it is advisable to explain this first.

If he registers through his advisory firm: regarding the tax and labor data that you enter, she decides for what purpose they are used, because she is the one providing the advisory service and is obligated to keep them. RMTracker acts as a provider of the tool.

If he registers under his own account and does not have an affiliated advisory firm: the responsible for the treatment is RMTracker, and you will deal directly with us for everything, including your rights.

If you use the app without an account (Personal mode only): what you record stays on your device and never reaches our servers. See section 3.6.

In any case, you can contact RMTracker in legal@rmtrackersolutions.com to exercise your rights: if the responsible for that part of the treatment is his advisory firm, he will be given a copy and informed about it.

3. What data is processed

3.1 About you, as a user

• Identification and access: email and password (the latter is never stored in plain text; it is managed by Supabase Auth).
• Data about his business: name, NIF/CIF, address, phone number, email and logo, which are included in the invoices he issues.

3.2 Data that you enter about third parties

• Your customers and suppliers: name or company name, NIF/CIF and address, as they appear on the invoices.
• Their employees (Labor department section): the data necessary for processing new hires and terminations, and for providing you with pay stubs.
• People you split an expense with (SplitPay, in Personal mode): their name and, if you add it, their phone number.

You are responsible for entering data about others. You must have a legal basis for providing us with this information and informing them that their data is being processed in this tool.

3.3 Documents and files

• Invoices captured with the camera and other supporting documents.
• Bank statements (N43, CSV file or spreadsheet) that you send so that your advisor can reconcile the transactions. They contain your account movements.

They are stored in a container. privatein its own folder by user, with database-level access rules that prevent a user from reading the files of another.

3.4 Activity log

An audit trail of operations on tax data is maintained (creation, modification and deletion). It is append-only: even you can't change it. It exists to be able to prove what happened and when, which is exactly what anti-fraud regulations require.

3.5 Personal mode and SplitPay

Besides your business, the app has a Personal mode to keep track of your everyday expenses and split them with other people (SplitPay). If you have an account, the following is stored on our servers:

• Your expenses: date, merchant, amount, category and notes and, if you scan the receipt, its lines and the text read from it.
• Photos of your receipts, in a private container with the same access rules as the rest of your files.
• SplitPay: the people you split with, the share that corresponds to each one and whether they have already paid you.

Personal data is not sent to your advisor and is not part of your invoices, reports or tax data.

Access to your contacts. To add people to SplitPay you can pick them from your phone's contacts, if you give the app permission. Only the name and one phone number of each contact are read to show you the list, and only the people you choose are saved: the rest of your contacts never leave the device. Without that permission you can add them by hand.

Asking for what you are owed. The app opens WhatsApp, or the app you choose, with the message already written. You send it yourself: RMTracker does not send messages on your behalf.

3.6 Use without an account

Personal mode can also be used without creating an account. In that case, everything you record (expenses, categories, people, splits and receipt photos) is stored only on your device. It never reaches our servers: RMTracker does not receive it, cannot see it and cannot recover it.

• If you uninstall the app, lose the device or leave no-account mode from Settings, that data is lost.
• Your device backup (Google's on Android or iCloud on iOS) may include the app's data. That backup is managed by Google or Apple under their own terms.
• If you later create an account or sign in, the app uploads what you recorded without an account to it and deletes it from the device. If the account already had expenses, it first asks whether you want to add them or discard them. From then on they are treated like the rest of your account data.

4. What we do NOT do

• We do not sell or transfer your data. for commercial purposes.
• There is no advertising or profiling. The application does not incorporate any analytics or advertising SDKs.
• Text recognition of invoices and receipts is done on your own device (Google ML Kit locally). The photograph is not sent to Google to read it.
• There are no automated decisions with legal effects on you.

5. For what purpose and with what legal basis

6. Who else is involved

• Your advisor: accesses the documentation you send to them. They are the natural recipient of the service.
• Supabase (hosting, database, storage and authentication). The data resides in the European Union (region eu-north-1).
• Tax Agency (AEAT): receives the billing records required by the Veri*factu regulation. It is a legal obligation.
• Google (ML Kit): only as a library that runs on your device. It does not receive your documents.
• WhatsApp or another messaging app: only if you decide to request a split through it. You send the message yourself from that app.

International data transfers outside the European Economic Area are not performed for the provision of the service. If any are necessary in the future, they will be informed about and the guarantees required by Chapter V of the GDPR will be adopted.

7. How long are records kept

• Invoices and accounting documents: as long as required by tax and commercial regulations. As a reference, four years of tax prescription and six years of conservation of accounting books.
• Veri*factu records: are immutable by design. They cannot be modified or deleted: an invoice registered is corrected by issuing a rectification, never altering the original.
• Access and profile data: as long as the account is active. They are deleted when the account is closed.
• Personal mode data: with an account, as long as the account is active; it is deleted when the account is closed. Without an account, it only exists on your device.

8. Your rights

You can exercise your rights of access, rectification, deletion, limitation, portability and opposition by writing to: legal@rmtrackersolutions.com, and claim against Spanish Agency for Data Protection.

9. Account deletion

You can delete your account in two ways:

• From within the app itself: Settings → Delete my account.
• From the website, without needing to log in: data deletion request form.

What is deleted: your access, your business data and logo, your customers and products, and everything in Personal mode: expenses, receipt photos, categories, people and splits.

What cannot be removed, and why: your invoices and payroll records are under the custody of your advisor for the period required by law. We cannot delete them even if you request it: the obligation to retain is legal and falls on the taxpayer and their advisor. The Veri*factu records already sent to the AEAT also cannot be removed.

10. Safety

Access to data is restricted at the database level through user policies: each client can only read and write their own data. Document containers are private and are served via limited-duration signed links. Invoices that have already been recorded are protected from modification by rules within the database itself.

11. Under 18

FactuSimple It is a professional tool aimed at freelancers and companies. It is not intended for minors and their data are not collected knowingly.

12. Changes in this policy

Versions are recorded with their effective date. If a change significantly affects the treatment, you will be notified through available contact methods.