Privacy policy

Last updated: 6 November 2026

Who is the controller?

The controller of your data is Conductiva Online Services, S.L. (“Conductiva”), with NIF B65152100 and registered office at C/ de la Llotja, sn, VIT, 08500 Vic, Barcelona, Spain, registered in the Barcelona Commercial Registry, Volume 41388, Folio 9, Sheet B392505, Entry 1.

You can contact us about any privacy matter through the chat on the website and in the program, or by email at privacidad@facturadirecta.com.

Two different types of data: which one this policy covers

• Your data as a user or visitor (the data you register with, your contact and billing details with Conductiva, and your browsing data). Conductiva is the controller of this data, and it is the data this policy covers.
• The data you enter into your FacturaDirecta account (that of your customers, suppliers or employees). You are the controller of that data, and Conductiva acts solely as processor, following your instructions. That processing is not governed by this policy but by the Data Processing Agreement, which forms part of the Service agreement.

What data do we collect?

In general terms, we request the following identification data: first name, surname, trade name, tax ID number (NIF), town, country, email and telephone. Most of it is not mandatory: it is possible to register with just a name and an email.

If you subscribe to a paid plan, we also process your billing and payment data (the payment method details are collected directly by our payment provider and are not stored in FacturaDirecta).

Browsing data is also collected: connection IP, device characteristics, preferred language, location country and session data (referring domain, pages visited, date and time of access).

If you connect an artificial intelligence assistant to your account, we also process the data of that connection and its technical logs (see If you connect an artificial intelligence assistant).

We obtain it from registration on our website, from our blog, from the application itself (web and mobile) and from our customer service.

What do we use this data for, and on what legal basis?

We do not create profiles that produce legal effects on you, nor do we make automated decisions of that kind.

How long do we keep your data?

For as long as you keep your account or your relationship with us. When you delete your account, the data is blocked and kept for a maximum period of 18 months, after which it is permanently erased, except for data we must keep longer under a legal obligation (for example, tax information or the invoicing records required by the regulations), which remains blocked and solely at the disposal of the competent administrations for the legally required periods. You can request early erasure at any time.

Do we share or transfer your data?

We do not sell your data or transfer it to third parties for their own purposes. We only communicate it to:

• Providers that supply services to us (hosting, email delivery, support, artificial intelligence tools that help the support team prepare their replies, payment, etc.), which act as processors following our instructions. The main ones are identified in the list of sub-processors.
• Public administrations and authorities, when required by law.

When you connect an artificial intelligence assistant or another external service, the data reaches that service by your decision and with the permissions you grant (see If you connect an artificial intelligence assistant).

We undertake to inform you of any corporate change that involves new ownership of the data you have entrusted to us, giving you the option to exercise your rights.

Is data transferred outside the European Union?

Our main infrastructure is in the European Union. Some specific providers (for example, the Intercom support chat or the artificial intelligence services used for document scanning and to support the support team) process data in the United States. In those cases the transfer is covered by the safeguards of Chapter V of the GDPR: the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. You can find the details for each provider in the list of sub-processors.

Is my data safe in FacturaDirecta?

Conductiva applies appropriate technical and organisational measures to prevent the loss, misuse, alteration, unauthorised access and theft of personal data. All communications take place over a secure encrypted channel (TLS), the servers are hosted in European Union data centres (Google Cloud and Amazon Web Services), access credentials are stored irreversibly and sensitive keys are always kept encrypted.

If you connect an artificial intelligence assistant

You can connect an artificial intelligence assistant, such as Claude or ChatGPT, to your account with the official FacturaDirecta connector (mcp.facturadirecta.com). Connecting it is always your decision. This section explains what data is involved, who processes it and how you control access.

What you authorise. You sign in on the FacturaDirecta page, not on the assistant’s, so the assistant never knows your password. You then choose which companies it can access and what it can do in each one (for example, only view data or also create documents). The assistant never has more permissions than you have in that company.

What data the assistant receives. The data it needs to handle what you ask or instruct it to do, within the permissions you have granted: data about your companies, contacts, products, invoices, estimates, expenses, accounting, banks and any other sections you authorise. This may include personal data of your customers, suppliers or employees. FacturaDirecta does not send anything to the assistant on its own initiative: it only responds to the requests the assistant makes with your authorisation.

Who processes it. The assistant’s provider (for example, Anthropic for Claude or OpenAI for ChatGPT) receives the data by your decision and processes it under the terms and privacy policy you have accepted with that provider, which govern how long it keeps conversations, whether it uses them to improve its models and where it processes them, possibly outside the European Union. That provider is not a sub-processor of Conductiva (see the list of sub-processors). You remain the controller of the data of your customers, suppliers or employees, so connect only the companies and permissions you need.

What we keep.

• The connection: which application it is, which companies it can access and with what permissions, and when it was created, last used or disconnected. Its access key is stored irreversibly.
• Technical logs of each access: date and time, user, application, connection, IP address and the operation requested, in order to provide the service, protect your account and prevent abuse. The legal basis is the performance of the contract and our legitimate interest in the security of the service.

We do not receive or keep what you write to the assistant or what it replies. Whatever the assistant creates or changes in your account stays there like any other change you make in FacturaDirecta.

For how long. The connection is kept for as long as your account exists, with the periods set out in How long do we keep your data?. Technical logs are kept for 30 days in our logging system and then in a restricted-access security archive, from which they are erased at the end of the fourth calendar year after the year of the log.

How you control access. You can view, change or disconnect each application at any time in Connected apps, in your FacturaDirecta profile menu. Changes apply from the assistant’s next request. Removing the connector from the assistant may not disconnect it in FacturaDirecta: to cut off access, disconnect it in Connected apps. Data the assistant has already received is managed by its provider: to delete it, use the assistant’s own options (for example, deleting the conversation) or contact that provider. For the data we process, you can exercise your rights as explained below.

If you receive an invoice or a document through FacturaDirecta

When a FacturaDirecta user sends you an invoice or shares a document with you through the portal, the controller of your data is that user (the issuer of the document), and Conductiva acts as their processor. To exercise your rights over that data, contact the issuer; if you ask us, we will forward your request to them.

What are your rights?

• Right of access: to know what data of yours we process, for what purposes and to whom we have communicated it;
• Right to rectification: to amend your data when it is incomplete or inaccurate;
• Right to erasure (“right to be forgotten”): to obtain the erasure of your data when it is no longer necessary, when you withdraw your consent or in the other cases provided for by law;
• Right to object: to object to the processing on grounds relating to your particular situation, and in any case to the sending of commercial communications;
• Right to restriction of processing: in cases of inaccuracy, unlawfulness, claims or objection;
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller;
• Right not to be subject to automated individual decisions that produce legal effects on you or similarly significantly affect you;
• Right to withdraw consent at any time, without affecting the lawfulness of the processing carried out beforehand.

How can I exercise these rights?

You can exercise any of these rights through the help service of the website and the program (chat) or by email at privacidad@facturadirecta.com. We will reply within one month at most.

If you believe we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).