Terms of Service

These general terms of service (the "Terms") govern access to and use of the software-as-a-service (SaaS) product Cofactu (the "Service"), owned by Codificado SL. By registering, subscribing to a plan or using the Service, the customer (the "Customer") accepts these Terms in full. They complement the legal notice, the privacy policy and the acceptable use policy.

1. Parties

Provider: Codificado SL (sole-shareholder company), Tax ID (CIF) B75761601, registered office at Paseo de la Castellana 194, 28046 Madrid (Spain). Email: legal@cofactu.com.

Customer: the individual or legal entity that registers for the Service, whose tax identification details are provided at sign-up and on invoices issued through the Service.

2. Subject matter

The Service provides an electronic invoicing platform designed for compliance with the VeriFactu regulation (RD 1007/2023 and Order HAC/1177/2024), together with complementary management, accounting, treasury and tax-filing features, depending on the plan.

3. Registration and account

• The Customer must provide accurate, complete and up-to-date information at sign-up and keep it current.
• The Customer is responsible for keeping its credentials confidential and for all activity carried out under its account.
• The Service is intended for professionals, self-employed workers and businesses. It is not directed at minors or at consumers for purposes unrelated to their economic activity.

4. Plans, pricing and billing

• Current plans, features and prices are published at cofactu.com/precios. Prices are stated in euros and, unless otherwise indicated, exclude VAT.
• Billing is recurring (monthly or annual, at the Customer's choice) and in advance.
• Payments are processed through our payment provider Stripe. Cofactu does not store full card details.
• Add-ons are contracted expressly and billed per unit of use at the rates published at cofactu.com/precios. Once the plan's monthly pool of AI credits is used up, the Customer may buy additional packs through an explicit purchase. Cofactu never bills overage automatically: without an express purchase or contracting by the Customer, no additional charge arises. Reference thresholds are described in the fair use policy.

5. Trial period

Where a trial or free plan is offered, its limits are described on the pricing page. After the trial, the Service may require a paid plan to keep using premium features. Customer data is retained per the retention policy (see clause 12).

6. Automatic renewal and price changes

Unless cancelled beforehand, the subscription renews automatically for periods equal to the one contracted, at the price in effect at renewal. The Customer may disable auto-renewal at any time from the account panel, effective at the end of the current period.

Notice of increases: if Codificado SL raises the price of the Customer's plan, it will notify the Customer by email at least 30 calendar days before the first renewal to which the new price applies. The Customer may cancel before that renewal at no cost; absent cancellation, the renewal proceeds at the new published price.

7. Cancellation and refunds

• The Customer may cancel at any time from the account panel. Cancellation stops renewal; the Service remains active until the end of the period already paid.
• Already-started periods are non-refundable, except as required by mandatory applicable law.
• After cancellation, the Customer retains the right to fully export its data (see clause 10).

8. Service level (SLA)

• Availability target: 99.9% monthly for the application and the API (at most ~44 minutes of unavailability per month). Measured as the percentage of minutes in the calendar month in which the Service responded correctly, per the monitoring published at cofactu.com/status.
• Exclusions: scheduled maintenance (minimum 48h notice, maximum window of 4h/month during low-activity hours), force majeure, failures of third parties outside Codificado SL's control (including the AEAT's electronic office and banking providers), DDoS attacks under mitigation, and causes attributable to the Customer.
• VeriFactu clarification: AEAT unavailability does not affect the validity of invoicing — records are generated, chained and queued, and are submitted automatically once the AEAT's office is restored, per the deferred submission the regulation allows. Invoice issuance remains operational.
• Service credits (paid plans): if monthly availability falls below 99.9%, the Customer may request, within the following 30 days, a credit against the monthly fee, applicable to future invoices: 10% (availability ≥ 99.5%), 25% (≥ 99.0%) or 50% (< 99.0%). The credit is the sole remedy for unavailability, without prejudice to clause 14.
• Support: first response during business hours (Mon-Fri, 9:00-18:00 CET): critical incident (service down or inability to issue invoices) within 4 business hours; high-severity incident (main feature degraded) within 8 business hours; other queries, the next business day.

9. Acceptable use

The Customer undertakes to use the Service lawfully and in accordance with the acceptable use policy. Fraudulent use, infringement of third-party rights, or any activity that compromises the security or performance of the platform is prohibited.

10. Customer data and portability

• Data entered by the Customer belongs to the Customer. Codificado SL processes it under the privacy policy and, where the Customer acts as controller of third-party data (e.g. accounting firms), under the data processing agreement (DPA).
• The Customer can export its invoicing data at any time (issued and received invoices, clients, suppliers, products and quotes, including VeriFactu PDFs and XMLs) via the Service's full export, in an open format. Other modules (accounting, treasury, CRM, payroll) have dedicated exports; for a complete copy of the account, the Customer may request one at privacidad@cofactu.com. We do not lock in data ("no lock-in").
• Exportable categories: Customer inputs and data generated or co-generated through use of the Service, including customers, suppliers, products, invoices and expenses with their PDFs and XML records, quotes, payments, imported bank transactions, journal entries and ledgers, CRM data and, where applicable, payroll and employment documents. Available formats include CSV, PDF, XML, JSON or ZIP depending on the module.
• Exclusions: source code, internal models, trade secrets, data or assets protected by intellectual property rights of Codificado SL or third parties, credentials, keys, security telemetry and strictly internal data whose disclosure would create a security or integrity risk are not exportable. These exclusions will not prevent or delay switching.

10.1 Switching under Regulation (EU) 2023/2854 (Data Act)

• The Customer may request in writing a switch to another provider, migration to on-premises infrastructure or erasure of exportable data. The maximum notice period to initiate switching is two months; where the Customer requests an earlier start and it is feasible, Codificado SL will proceed without undue delay.
• After the notice period, the ordinary transition period will not exceed 30 calendar days. During it, Codificado SL will provide reasonable assistance to the Customer and its authorised provider, maintain service continuity and security, and disclose known risks. The Customer may request one extension of the transition period.
• If completing the transition within 30 days is technically unfeasible, Codificado SL will notify and justify this within 14 working days of the request, propose an alternative period not exceeding seven months, and maintain service continuity in the meantime.
• Switching and data egress carry no specific charge. Only ordinary service fees during notice and transition and any expressly agreed early-termination fee remain payable; Cofactu's standard plans have no such early-termination fee.
• After transition, the Customer has an additional minimum period of 30 calendar days to retrieve data. Once it expires, Codificado SL will erase exportable data and digital assets except data that must remain blocked by law or on the Customer's documented instruction under the DPA.
• Documentation of formats, structures, methods and known limitations is provided with the export or, before switching, on request to privacidad@cofactu.com. Per-module exports are available in the relevant screens; until a full-account export is automated, Codificado SL will deliver the complete copy through a secure channel after identity verification.
• The contract ends on successful completion of switching or, where the Customer requests erasure only, at the end of the notice period, without prejudice to the retrieval period and statutory retention duties.

11. Customer's digital certificate

Where the Customer provides its digital certificate for submitting records to the AEAT, Codificado SL stores it encrypted (AES-256-GCM) on European Union infrastructure and uses it exclusively for transmissions the Customer orders by issuing or approving an invoice, or has expressly configured as automatic, through the transmission service (see the DPA). The Customer warrants that it is authorised to use the certificate and authorises this limited use; it may remove the certificate at any time, stopping further transmissions. Codificado SL will not file tax returns on its own initiative or use a representative or tax-collaborator certificate without sufficient authority or appointment. Codificado SL is responsible for secure custody under clause 14; the Customer remains responsible for the certificate's validity and revocation before its issuing authority.

12. Retention after termination

Four categories apply for retention purposes:

• Customer data retained on the Customer's instruction: invoices, VeriFactu records and accounting books that tax law requires the Customer to retain (as a rule, 4 years of limitation — art. 66 of the Spanish General Tax Act — and 6 years of commercial retention — art. 30 of the Commercial Code). After termination, Codificado SL keeps them blocked for the period the Customer indicates or, failing that, returns or deletes them per the DPA.
• Codificado SL's own data: the invoices Codificado SL issues to the Customer and its own accounting records, retained under Codificado SL's own tax and commercial obligations.
• Blocked archive (art. 32 LOPDGDD): deleted data is kept blocked, with restricted access, solely for disclosure to courts and public authorities during limitation periods, and destroyed afterwards.
• Transport control documents (DeCA): each issued DeCA is retained and remains available to the parties to the transport for Cofactu's custody period — twelve months from the later of the issue of the last version and the effective end of the transport, on top of the one-year minimum in Art. 9 of Order FOM/2861/2012 —, including after the Customer's termination, because it contains the other party's data and both parties must be able to produce it to the inspection authorities. Retention of the document is independent of the availability of its download link, which may be disabled in accordance with the regulation seven days after the service ends. Details in the privacy policy and the DPA.

Other personal data is deleted or anonymised per the privacy policy and the Customer's request.

13. Intellectual property

The software, brand, design and contents of the Service are owned by Codificado SL or its licensors. This agreement transfers no intellectual property rights in the Service; it grants only a non-exclusive, non-transferable licence limited to the subscription term.

14. Limitation of liability

• The Service is provided "as is". Tax-regulation information is informational and does not constitute professional advice; the Customer remains ultimately responsible for its tax obligations.
• AEAT rejections: if a record is rejected for a cause attributable to the Customer (incorrect data, expired certificate), Codificado SL displays the error and the ways to fix it, with no further liability. If the rejection stems from a software defect (generation, chaining or submission), Codificado SL fixes the defect and regenerates or resubmits the affected records free of charge and with top priority as the first remedy; if the Customer nevertheless suffers a final administrative penalty directly caused by that defect, Codificado SL is liable for the damage within the cap in the next point.
• To the extent permitted by law, Codificado SL's total aggregate liability for damages arising from the Service is limited to the greater of: (i) the amount paid by the Customer in the 12 months preceding the event giving rise to the claim, or (ii) €500. Indirect damages, loss of profit and loss of data not attributable to Codificado SL are excluded.
• These limitations do not apply in cases of wilful misconduct or gross negligence, personal injury, or any other liability that cannot legally be excluded or limited (including liability arising mandatorily under data protection law).

15. Suspension and termination

Codificado SL may suspend or terminate the Service for non-payment, material breach of these Terms or of the acceptable use policy, with prior notice where possible. On termination, the switching, retrieval and erasure periods and safeguards in clause 10.1 apply.

16. Changes

Codificado SL may amend these Terms. Material changes will be communicated with reasonable notice by email or within the Service. Continued use after they take effect constitutes acceptance of the updated version. Our public "no breaking changes" commitment is detailed in the changelog.

17. Governing law and jurisdiction

These Terms are governed by Spanish law. Disputes will be submitted to the courts that are competent under the statutory venue rules of the Spanish Civil Procedure Act.

18. Contact

For any questions about these Terms: legal@cofactu.com.