Last updated: May 9, 2026
At Cofactu we take our users' privacy seriously. This policy describes what data we collect, how we use it, and what rights you have over it, in accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD).
1. Data controller
Codificado SL, Tax ID (CIF) B75761601, registered in Madrid (Spain). Email: legal@cofactu.com
2. Data we collect
- Account data: name, email, hashed password.
- Tax data: tax ID, company name, address, your clients' and invoices' data. Required for compliance with VeriFactu regulations.
- Payment data: managed by Stripe (we do not store card numbers).
- Usage data: technical logs, product events via PostHog (with your explicit consent), errors via Sentry.
3. Purposes of processing
- Provision of the electronic invoicing service.
- Compliance with legal obligations (submission to AEAT, record retention).
- Communication with the user (support, service notifications).
- Product improvement (analytics, only with consent).
4. Legal basis
Performance of a contract (SaaS service), compliance with legal obligations (tax regulations), and legitimate interest (security and service improvement).
5. Retention
Tax data is retained for the legal period required by tax regulations (a minimum of 4 years). Account data is deleted upon user request or after prolonged inactivity.
6. Recipients
We share data with the following data processors, all under a DPA contract:
- Cloudflare — hosting (servers in the EU)
- Neon — PostgreSQL database (eu-central-1 region)
- Stripe — payment processing
- Resend — transactional email delivery
- Sentry — error monitoring
- PostHog — product analytics (only with consent)
- Anthropic — AI assistant (no end-customer identifying data)
- AEAT — submission of tax records (legal obligation)
7. User rights
You have the right to access, rectify, erase, object to, restrict the processing of, port your data, and withdraw consent. To exercise these rights, write to privacidad@cofactu.com providing a copy of your ID document.
You may also file a complaint with the Spanish Data Protection Agency (aepd.es).
8. Cookies
See our Cookie Policy.