Privacy Policy
Last updated: October 17, 2026
This privacy policy describes how FacturX, published by Mr. Alain Robinson (SIREN 524 454 113), collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and applicable data protection laws.
1. Data Controller
- Name: Mr. Alain Robinson
- SIREN: 524 454 113
- Address: 116 Avenue de Paris, 94800 Villejuif, France
- Email: contact@facturx.vip
2. Data Collected
2.1 Registration Data
When creating your account, we collect:
- First and last name
- Email address
- Password (stored in hashed form)
2.2 Business Data
For the service to function, you provide:
- Company name, legal form
- SIRET number, EU VAT number
- Registered address
- Bank details (IBAN, BIC) displayed on your invoices
- Logo and brand color
- Contact details (email, phone)
2.3 Your Clients' Data
When managing your invoices and quotes, you enter your clients' information:
- Name / company name
- Address, email, phone
- SIRET and VAT numbers
- Invoice and quote history
2.4 Payment Data
If you enable online payment (Stripe Connect), card payment data is processed exclusively by Stripe, PCI-DSS Level 1 certified. FacturX does not store any card data.
2.5 Technical Data
- IP address
- Browser type and operating system
- Pages visited and visit duration
- Session and authentication cookies
- Origin of the sign-up: UTM parameters, referring site and landing page (see section 9)
2.6 Data from public registers
When you search for a company (yours or a client) to pre-fill a form, FacturX asks the free public registers of its country: the French government's company directory (recherche-entreprises.api.gouv.fr, INSEE and INPI data) and VIES, the European Commission service that checks VAT numbers. Only the number, name or VAT number you typed is sent to them.
The full answers (name, legal form, activity, address, VAT number, active or ceased status), including those about a sole trader, who is a natural person, are cached for 24 hours to limit the calls. A daily purge then deletes them, at the latest 48 hours after the search. In your account, only the fields of the form are kept, and only if you save it. The source and the date of reading are shown under the pre-filled fields.
2.7 Report of the validator by e-mail
If you ask to receive the report of the free validator by e-mail, we keep your address, the language of the page and the summary of the report shown on the screen (verdict, profile, number, failed rules). Your file itself is never kept. We first send you a confirmation e-mail: the report leaves only after a click on its link, valid for 48 hours. The summary is deleted as soon as it is sent, or after 48 hours without confirmation.
If you tick the tips box, we also keep the date of your consent and its wording, to send you tips about e-invoicing and FacturX. Every e-mail contains a one-click unsubscription link. After an unsubscription, nothing more is sent to this address, and we keep it 3 years to respect your objection.
2.8 Follow-up e-mails of your account
When you create an account, we send you a few follow-up e-mails: a welcome message, help to send your first invoice if you have not done it yet, and two reminders before the end of your free trial if you have not chosen a plan. We rely on our legitimate interest in helping you use the service. Every e-mail contains a one-click unsubscription link, which stops these follow-up e-mails and the tips, not the e-mails of your invoices or your account. We keep the record of the e-mails sent, without your address, 90 days.
3. Processing Purposes
Your data is collected for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your user account | Contract performance |
| Generating Factur-X compliant invoices and quotes | Contract performance |
| Sending invoices and quotes by email to your clients | Contract performance |
| Processing online payments via Stripe Connect | Contract performance |
| Managing your SaaS subscription and billing | Contract performance |
| Sending service-related notifications | Legitimate interest |
| Service improvement and bug fixes | Legitimate interest |
| Compliance with legal and tax obligations | Legal obligation |
| Sending the report of the validator asked by e-mail | Performance of your request |
| Sending tips about e-invoicing and FacturX | Consent |
| Follow-up e-mails of the account (welcome, first invoice, end of trial) | Legitimate interest |
4. Data Recipients
Your data may be shared with:
- Stripe Inc.: payment processing (SaaS and Connect). Stripe Privacy Policy
- Contabo GmbH.: application hosting. Contabo Privacy policy
- Your accountant: if you enable data sharing in settings (Advanced plan only)
No data is sold to third parties for commercial or advertising purposes.
5. International Transfers
Some of our processors (Vercel, Stripe) are located in the United States. These transfers are governed by:
- Standard Contractual Clauses (SCCs) issued by the European Commission
- The EU-U.S. Data Privacy Framework, where applicable
6. Retention Periods
| Data Type | Retention Period |
|---|---|
| Account data | Duration of subscription + 3 years after deletion |
| Invoices and quotes | 10 years (legal accounting and tax obligation) |
| Stripe payment data | Per Stripe's policy |
| Technical logs | 12 months |
| Invoices saved from the free generator (seller, client, lines) | 7 days after saving |
| Report of the validator waiting for confirmation (summary, without the file) | Until it is sent, 48 hours at most |
| E-mail address of a report request, without consent to the tips | 3 days at most after the request |
| E-mail address and consent to the tips | Until unsubscription, 3 years at most after your last consent |
| Unsubscription from the e-mails of the free tools | 3 years |
| Record of the follow-up and tips e-mails sent (without the address) | 90 days |
| Session cookies | Duration of session |
7. Your Rights
Under GDPR, you have the following rights:
- Right of access: obtain confirmation of processing and receive a copy of your data
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request deletion of your data (subject to legal retention obligations)
- Right to restriction: request restriction of processing under certain conditions
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to the processing of your data on legitimate grounds
To exercise these rights, contact us at: contact@facturx.vip
We commit to responding within 30 days.
In the event of a dispute, you may lodge a complaint with the CNIL (French Data Protection Authority): www.cnil.fr
8. Data Security
We implement the following technical and organizational measures:
- HTTPS/TLS encryption for all communications
- Password hashing using modern algorithms
- Secure hosting on servers compliant with security standards
- Restricted access to personal data (principle of least privilege)
- PCI-DSS payments via Stripe (no card data stored on our servers)
9. Cookies and audience measurement
9.1 Strictly necessary cookies
These cookies are essential for the site to work; they do not require your consent:
| Cookie | Purpose | Duration |
|---|---|---|
| Authentication session | Maintain your login | Session duration |
| Language preferences | Remember your language choice | 1 year |
| fx_consent | Remember your choice on audience measurement | 6 months |
9.2 Audience measurement, with your consent
On your first visit, a banner asks you to accept or refuse audience measurement. The Google Tag Manager script is loaded only after you accept: until then, no request is made to Google, no measurement cookie is set and no event is sent.
If you accept:
- the Google tools loaded by Google Tag Manager may set measurement cookies (for example
_ga), for 13 months at most; - we measure the use of the free tools (tool used, valid result or not, click towards sign-up), the start of the sign-up, the confirmed sign-up, the subscription and the sending of the first invoice. These events contain neither your files nor the content of your invoices;
- the page of your first visit and its origin (UTM parameters, referring site) are kept in your browser (local storage), then saved with your account if you sign up.
This data is processed by Google Ireland Limited and Google LLC; transfers to the United States may take place, under the EU-US Data Privacy Framework.
If you refuse, nothing is kept in your browser: only the UTM parameters present in the address of the sign-up page are saved with your account, to know which campaign led to the sign-up.
9.3 Changing your mind
You can change your choice at any time with the "Manage cookies" link at the bottom of the public pages of the site (home, free tools, pricing). If you refuse after accepting, the origin kept in your browser and the Google measurement cookies are erased. Your choice is asked again after 6 months.
10. Policy Changes
We reserve the right to modify this privacy policy. In the event of a material change, you will be notified by email or by an in-app notification.
11. Contact
For any questions regarding the protection of your personal data:
- Email: contact@facturx.vip
- Address: Mr. Alain Robinson - 116 Avenue de Paris, 94800 Villejuif, France