Privacy policy

The data controller is eFakturi.net. For data protection matters write to support@efakturi.net.

For your account data - email, name, company details, subscription - we are the controller and decide the purposes of processing.

For the data you enter about your clients, you are the controller and we are your processor, acting only on your instructions. If one of your clients contacts us about access or erasure, we will refer them to you.

Without an account: invoice content is processed on the server only to render the PDF and is not retained afterwards. For the weekly limit we keep a hashed identifier - a random cookie value plus part of the IP address. We do not store IP addresses. Basis: legitimate interest (Art. 6(1)(f) GDPR) - preventing abuse of the free service.

With an account: email address and sign-in data, to create and maintain the account; company details, clients and saved invoices, to provide the service. Basis: performance of a contract (Art. 6(1)(b)).

Payments: a Stripe customer and subscription identifier, status and period. Card data is handled solely by Stripe and never reaches us. Basis: performance of a contract and the legal obligation to keep accounting records (Art. 6(1)(b) and (c)).

Technical logs and an audit trail of administrative access, for security and incident investigation. Basis: legitimate interest (Art. 6(1)(f)).

Website analytics runs only if you consent through the cookie banner. Basis: consent (Art. 6(1)(a)), which you may withdraw at any time.

We use strictly necessary cookies for signing in and for counting the free-tier limit - these do not require consent. Analytics cookies load only after explicit consent; until then the analytics tool runs without cookies.

We use carefully selected providers, each processing data under contract with us and only for our purposes: our hosting and database provider; Stripe (payments); our email provider for sign-in links and invoice delivery; Google (analytics, only with consent).

We do not sell personal data and do not provide it to third parties for their own marketing purposes.

Where a provider processes data outside the EEA, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision.

Account data - for as long as the account exists and up to 6 months after deletion, so that an accidental deletion can be reversed.

Issued invoices and the accounting records of our own payments - 10 years under the Bulgarian Accountancy Act. This period overrides a deletion request.

Hashed rate-limit identifiers - up to 30 days. Technical logs - up to 12 months. The administrative audit trail - 24 months.

Our admin console shows metadata by default - invoice counts, totals, statuses. The contents of a specific invoice are reachable only by a full administrator, for support or abuse investigation, and every such access is written to an audit trail.

We apply technical and organisational measures including transport encryption, encryption of stored operational secrets, need-to-know access limits and auditing of administrative actions. No system is perfectly secure - in the event of a breach likely to result in a high risk to you, we will notify you under Art. 34 GDPR.

You have the right of access, rectification, erasure, restriction of processing and portability, and the right to object to processing based on legitimate interest. Where the basis is consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Exercise your rights at support@efakturi.net. We respond within one month. We do not carry out automated decision-making producing legal effects concerning you, including profiling.

If you believe we process your data unlawfully, you may complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia, cpdp.bg.

If this policy changes materially we will notify you by email or in the app before the change takes effect.