Version 2026-11
Privacy policy
What facturx does with your data, depending on whether you use the Studio without an account or with one: what is received, where it is hosted, how long it stays, and what you can demand.
1. Who is responsible
For your account's data, the controller is the publisher of the facturx service, named below. For your customers' data that you enter in the Service, you are the controller and facturx is your processor: see the data processing agreement.
Site publisher and controller: Ibird, a private individual, on a non-professional, free-of-charge basis. Contact, including to exercise your rights: hello@ibird.dev.
Site host: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, +49 9831 505-0.
This policy carries version number 2026-11, like the terms of use, and applies from 8 November 2026.
2. Without an account, nothing you enter is sent
The account-less Studio keeps everything in your browser (IndexedDB): your company, your customers, your catalogue, your history and your numbering. The online validator reads your file in your browser. Neither sends what you type or drop to any server, ours or a third party's. As long as you do not open the sign-in, the Studio does not even load the account code and does not contact Supabase.
One thing does go out, and it carries neither what you entered nor your files. For each PDF produced in the Studio and each file checked in the validator, the page requests an address on our own site, with nothing attached. The server answers with no body, but the request leaves a line in two logs: the statistics log, where the IP address is truncated of its last byte, and the short-lived operating log, which keeps the full address (section 5). No file name, no verdict, no cookie: it is a count, to know whether the tool is used. The full IP address in the operating log is nonetheless personal data, which can identify your connection: that is why that log is short-lived, and the statistics log keeps only a truncated address.
This data stays with you, so we cannot recover it: if you clear the site's data in your browser, it is gone. Think of the Studio's backup.
3. With an account: what we receive, and why
| Data | What it is for | Our role |
|---|---|---|
| E-mail address and password | Create the account, sign you in, confirm the address, reset the password. | Controller |
| Version of the terms accepted and date of acceptance | Keep proof of your acceptance. | Controller |
| Your company: name, SIREN, address, VAT, payment details, appearance, uploaded logo and font | Draw up your invoices, your way. | Controller |
| Your customers: name, address, contact person, e-mail, phone | Draw up your invoices and send your reminders. | Processor |
| Catalogue and drafts | Prepare your invoices. | Processor |
| Issued invoices and their PDFs, recorded payments (date, amount, method, note) | Keep your invoices, work out what is still to be paid, run the dashboard. | Processor |
| Reminders: recipient, subject, text, sending status, identifier returned by Brevo | Send the reminder, keep the history, apply the sending limits. | Processor |
| Site statistics log: truncated IP address, requested page, referring page (referer), browser, date | Measure the site's traffic. | Controller |
| Site operating log, short-lived: full IP address, requested page, referring page (referer), browser, date | Diagnose how the site is running. | Controller |
We process account data to provide the Service you asked for (performance of a contract, article 6(1)(b) of the GDPR). The site logs and the usage figures rest on our legitimate interest in running the Service (article 6(1)(f)).
To know whether the Service is used, we count directly in the database: accounts created, active accounts (at least one invoice issued in the month), invoices issued and reminders sent. These are totals, computed in SQL; no tracker is added to your pages.
4. Where your data is, and who can reach it
| Provider | What it does | Company | Where |
|---|---|---|---|
| Supabase | Database, authentication, storage of PDFs and files, the Service's functions | Supabase Inc., a US company | eu-central-1 region (Frankfurt, Germany), on AWS infrastructure |
| Brevo | Sending e-mails: address confirmation, forgotten password, reminders | French company | Hosted in the European Union |
| Scaleway | Daily encrypted copy of the Service's data | Scaleway SAS, a French company | fr-par region (Paris), outside Supabase |
Brevo receives your account's e-mail address and, for a reminder, the recipient's address, the subject, the text and the attached PDF. The site itself (pages, Studio, validator) is served by the publisher's server, rented from Hetzner in Falkenstein (Germany): it receives no account data, only page requests and their log.
Supabase is a US company. Your data is hosted in Frankfurt, but hosting in Europe does not change the provider's nationality: Supabase Inc. remains subject to US law. We therefore cannot promise that your data escapes every request from a US authority addressed to that provider. If that is an obstacle for you, use the Studio without an account: nothing you enter or drop then leaves your browser.
No end-to-end encryption. Your data is encrypted at rest by the host, but it remains readable by the Service: the server reads your invoice to issue it, number it, work out what is still to be paid and send a reminder. That is the trade-off of having an account, and the choice is yours.
5. For how long
| Situation | Duration |
|---|---|
| Your account exists | Your data is kept as long as the account exists. An issued invoice is neither edited nor deleted in the meantime. |
| You request deletion of the account | 30 days of grace, which you can cancel. During that time the Service issues nothing and sends no reminders: it offers only the export, the cancellation and signing out. |
| The 30 days have passed | Everything is erased at the first nightly run after that, in this order: your PDFs and files; your sign-in identity; the company's data (invoices, customers, catalogue, payments, reminders); finally the traces the authentication server keeps of your sign-up and sign-ins (email address, identifier, and for some events IP address). Only the backups remain (next row), and the host's technical logs (requests to the API and the authentication server, which may contain your IP address and email address), which expire on their own after one day. |
| An invoice issuance is interrupted and leaves a PDF without an invoice | The PDF is erased after at least one day, at the next nightly run. |
| Backups | A daily encrypted copy, at Scaleway: the erasure above does not rewrite the copies already made, so your data stays in them until they expire. Retention period: 12 weeks for each copy, and 4 months at most if Scaleway keeps a previous version of it. |
| Site logs | The log used for statistics never holds a full address. A separate, short-lived operating log is used for diagnosis and keeps full addresses. Periods: 13 months for the statistics log, whose older lines are erased every night; the operating log is erased at each update of the site. |
The law requires you to keep your invoices for ten years: that obligation rests on you, not on facturx. Export your data before deleting your account.
6. Your rights
You can access your data, have it corrected or erased, restrict its use, object to a processing operation and take it away in a portable format. In the Studio, “Export my data” gives you a zip archive with a portable JSON file and all your PDFs, and account deletion follows the schedule in section 5. For anything else, write to the contact address given in section 1.
The customers whose data you entered exercise their rights with you, as the controller; we help you answer them (see the data processing agreement). Issued invoices fall under your legal retention obligation, which limits the right to erasure for that data.
If you believe your rights are not respected, you can complain to the data protection authority of your country; in France, the CNIL.
7. Security
- Every table in the database is protected by access rules that deny by default: one account can neither read nor write another's data.
- Issuing an invoice and sending a reminder are done only by server functions. The browser has no write access to an issued invoice.
- Your PDFs, your logos and your fonts sit in private storage. They open only through a signed link, valid for 60 seconds.
- The database's service key exists only in the server functions' secrets; it is never sent to the browser.
- The data is copied every night, encrypted, to another European host: that is its only backup.
- Your sign-in session is kept in your browser's storage, so that you stay signed in. So that nothing you type is lost, the open draft is also copied into the browser.
The database schema, its access rules and the Service's functions are published in the project repository: you can read them.
8. Trackers and audience measurement
The site's pages embed no tracker and no third-party audience-measurement tool. Traffic is read from the statistics log of our own server, in which the IP address is truncated of its last byte as it is written, with GoAccess installed on that same server. The report is password-protected.
9. Changes to this policy
This policy may change. Each version has a number, shown at the top of this page.