Fakturata
fakturata.com
Fakturata
BG
Sign in
Last updated: 02.10.2026
The controller for account, support and security data is SHOPFILES LTD („ШОПФАЙЛС“ ЕООД), 3 Atanas Vlaev Street, Sevlievo 5400, Gabrovo region, Bulgaria, Company ID 204350007, VAT BG204350007. Data protection contact: [email protected].
For the User’s client data (names, VAT/company numbers, addresses, invoices) the User is the CONTROLLER and the Provider acts as a PROCESSOR under the GDPR. The User is responsible for lawfully collecting such data.
Processing includes recording, organising, calculating, storing, exporting and sending under instructions for the service term. Data subjects include clients, contacts, employees and users; data includes identifiers, contact details and financial/employment records. The processor follows documented instructions, confidentiality and appropriate GDPR Article 32 measures, assists with rights, assessments and breaches without undue delay, and returns/deletes data on termination as instructed unless legally required to retain it. It provides compliance information and reasonable assistance for audits. Subprocessors in section 5 are used under corresponding contractual duties; material changes are notified with an opportunity to object. Request detailed Article 28 terms and supplier information at [email protected].
Account data (name, email, hashed password), company data, clients, invoices and purchases, uploaded documents, email logs and audit journal (actions, IP address, user agent, time).
When you choose Google sign-in, Google processes the authentication request. Fakturata requests basic profile and email access (openid, email, profile) and receives your name, email, its verification information and a unique Google account identifier. We use these data to sign you in, create an account or link an account. We store the Google identifier and email for the account connection and, when creating an account, the supplied name. The recipients, retention periods and rights described below apply to these data.
While you complete Google registration, the profile details are kept temporarily in a signed HttpOnly cookie valid for up to 10 minutes. Google access and ID tokens are discarded after retrieving the profile; we do not persist them or send them to the browser.
Contract performance — account and support; legal obligation — the Provider’s own mandatory records; legitimate interests — security, abuse prevention and claims. For company documents we follow controller instructions. Starting an AI feature is a processing instruction, not universal GDPR consent: the company must have an appropriate legal basis. Optional tracking would require a separate choice.
DigitalOcean (hosting/database), the configured SMTP provider (addresses and sent documents), OpenAI (content needed for the selected AI feature), Telegram when the bot is connected, and selected payment/store integrations. Only data needed for the action is shared. Daily AI tax updates search public sources without sending company documents. We do not sell data for advertising. Authorities receive data where legally justified.
Connected providers may process data outside the EEA. Transfers must have an applicable GDPR Chapter V safeguard, such as an adequacy decision or standard contractual clauses with necessary additional measures. Request information about the provider, location and applicable safeguards at [email protected]. You can work manually and leave optional AI/Telegram/payment services disconnected.
Account and company records are retained to provide the service until a valid deletion/return request, except for legal obligations or claims. Audit entries older than 400 days are cleaned weekly; unused sessions are cleaned on sign-in. Technical-log retention depends on hosting/SMTP settings; specific periods are available on request. The service does not promise an 11-year statutory archive: the company maintains required accounting records for the applicable period and keeps its own backups. Uploaded files are operational copies, not guaranteed long-term archives.
Where applicable, rights include access, rectification, erasure, restriction, portability, objection and withdrawal of consent without affecting prior lawful processing. Contact [email protected]; we verify identity and respond within statutory periods (normally one month). For client/employee data also contact the relevant controller company. You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the competent authority. We do not make decisions with legal effects for you solely through AI.
Passwords are stored hashed (bcrypt), access uses httpOnly session cookies, actions are recorded in an audit journal. The Provider applies reasonable technical and organisational measures but does not guarantee absolute security. Backups are recommended.