Privacy Policy
Version: 2026-07-10
Courtesy translation. The Spanish version is the binding text.
1. Data controller
CanaryCoders S.L., Plaza de la Constitución 4, 3.º B, 35500 Arrecife (Las Palmas), Spain, tax ID (CIF) B05278437. Contact: hola@canaryfactura.es.
2. What data we process
- Account data: name, email address and password (stored hashed).
- Business tax data: tax ID (NIF), legal name, registered address, tax regime.
- Website usage data: only what is strictly needed to serve the pages (technical access logs). We use no analytics or advertising cookies (see the Cookie Policy).
- Payment data: handled by Stripe; we only receive the subscription status and the last digits of the card.
- Data contained in your invoices (for example, your customers’ details): for that data you are the controller and CanaryCoders acts only as processor, under the data processing agreement (art. 28 GDPR). This policy does not apply to that data.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service and managing your account | Performance of contract (art. 6.1.b GDPR) |
| Billing for the service and accounting/tax obligations | Legal obligation (art. 6.1.c GDPR) |
| Submitting billing records to the AEAT | Legal obligation (art. 6.1.c GDPR) |
| Operational communications about the service | Performance of contract (art. 6.1.b GDPR) |
| Security, abuse prevention and service improvement | Legitimate interest (art. 6.1.f GDPR) |
We do not sell your data or use it for advertising. We make no automated decisions with legal effects on you.
4. Recipients
We share data only with the providers needed to run the service:
- Hosting in data centres within the European Union.
- Stripe (payment processing). Stripe may transfer data to the US under the EU-US Data Privacy Framework and standard contractual clauses.
- AEAT (Spanish tax agency): submission of billing records required by RD 1007/2023.
No other international transfers outside the European Economic Area take place.
5. Retention periods
- Account data: while the account is active and, after cancellation, for 90 days to allow export.
- Data with accounting or tax relevance (service invoices, records): the legal limitation periods (in general, 4 years for tax purposes and 6 years for commercial-law purposes).
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@canaryfactura.es, proving your identity. You can also lodge a complaint with the Spanish data protection authority (aepd.es).
7. Security
We apply appropriate technical and organisational measures: encryption in transit, hashed passwords, per-customer data isolation, backups and access control. Billing records are additionally protected by the integrity and inalterability requirements of RD 1007/2023.
8. Changes to this policy
We will publish any changes here and, if material, notify you by email or in the application.