Data processing agreement

1. The parties and their roles

• You (the “User”) are the controller of the personal data of your customers and their contact persons that you enter in the Service.
• facturx is your processor for that data: it processes it on your behalf and on your instructions.
• For your account and company data (e-mail address, acceptance of the terms, your company's profile and payment details, site logs), facturx is itself the controller: see the privacy policy.

facturx is published by Ibird, a private individual, on a non-professional, free-of-charge basis. Contact: hello@ibird.dev.

This agreement carries version number 2026-11, like the terms of use it is part of, and applies from 8 November 2026.

2. Subject matter, nature and duration

The processing has one purpose only: to provide you with the Service. It consists of hosting and keeping your data; issuing your invoices (numbering, checking, producing the PDF); working out payment statuses and the dashboard; sending the reminders you ask for; exporting and deleting your data.

It lasts as long as your account, until the erasure that follows its deletion (section 10).

3. Data and data subjects

• Data: name or company name, contact person's name, postal address, SIREN, SIRET and VAT number, e-mail address and phone number of your customers; the content of your invoices (lines and amounts); payments you enter; reminders sent (recipient, subject, text).
• Data subjects: your customers when they are individuals or sole traders, and the contact persons you name at your customers.

The Service is not designed for sensitive data (health, opinions, trade-union membership…). Do not enter it in notes or labels.

4. Your instructions

We process this data only on your documented instructions: what you do in the Service (create a customer, issue an invoice, record a payment, request a reminder, export, delete) and these terms. A reminder, for example, goes out only when you send it yourself. If an instruction seems to us to infringe the GDPR, we tell you.

5. Confidentiality

The people authorised to access this data are bound by confidentiality.

6. Security

We apply the following measures, detailed in the privacy policy.

• Access rules on every table, denying by default: one account can neither read nor write another's data.
• Legally binding writes (issuing, reminders) made only by server functions; no issued invoice can be edited or deleted from the browser.
• Private storage, opened through signed links valid for 60 seconds.
• A service key that stays in the server functions' secrets.
• An encrypted copy every night with another European host, the data's only backup.
• Encryption at rest by the host. The data remains readable by the Service, which needs it to issue, number, work out what is still to be paid and send reminders: it is not end-to-end encryption.

7. Sub-processors

You authorise us to use the following sub-processors.

Supabase is a US company. Your data is hosted in Frankfurt, but Supabase Inc. remains subject to US law: we cannot promise that your customers' data escapes every request from a US authority addressed to that provider. If that is a problem for you, do not use the Service with an account for your customers' data: the account-less Studio sends nothing you enter.

We bind each sub-processor by a contract that imposes on it the data protection obligations of this agreement (article 28(4) of the GDPR). Any addition or replacement of a sub-processor is published on this page, under a new version number. If you object, export your data and delete your account.

8. Data subjects' rights

If one of your customers writes to us to exercise their rights over data you entered, we refer them to you. We help you answer them: the export gives you all the data, and you correct your customers in the Service.

Issued invoices are neither edited nor deleted while the account exists. They fall under your legal retention obligation, which limits the right to erasure for that data.

9. Data breaches and assistance

If we find a personal data breach affecting your customers' data, we inform you without undue delay after becoming aware of it, with the information we have, so that you can meet your own obligations. We help you, as far as we can, with data security, impact assessments and dealings with the data protection authority.

10. End of contract: return and erasure

1. Before deleting your account, export your data: “Export my data” gives you a zip archive with a portable JSON file and all your PDFs.
2. When you request deletion, a 30-day grace period begins. The Service issues nothing and sends no reminders; it offers only the export, the cancellation of the deletion and signing out.
3. After 30 days, at the first nightly run that follows, we erase everything, in this order: the PDFs and files, your sign-in identity, your company's data (invoices, customers, catalogue, payments, reminders), then the traces of your sign-ins kept by the authentication server.

Backup copies are not rewritten by this erasure: they disappear when they expire, after the retention period given in the privacy policy. Nor are the host's technical logs: they expire on their own after one day.

The law requires you to keep your invoices for ten years. That obligation is yours, not facturx's: the export is how you keep them.

11. Evidence and audits

So that you can check that we respect this agreement, we make available this text, the privacy policy and the Service's code, published in the project repository (schema, access rules, issuing and reminder functions). We contribute to audits that you request, or that an auditor you appoint requests, on terms agreed in advance.

12. Your obligations

• You inform your customers that their data is processed to draw up and follow their invoices, and by whom.
• You make sure you are entitled to process this data and to contact your customers, in particular to send them reminders.
• You keep your invoices yourself for the legal period.