Privacy policy

1. Data controller

The controller's full identification details are set out in the table below. You can contact us about anything related to the protection of your data at the email address shown there.

2. What data we process

Depending on how you use FichasDoc, we may process the following categories of data:

• Account data: name, email and password (hashed) when you register; language and interface preferences.
• Organization data: company name, tax ID, address and logo, when you provide them so they appear on your sheets.
• Service usage data: templates created, documents generated, connections configured with your ERP or online store, change history, access and activity logs for security and support purposes.
• Billing data: the data needed to manage your subscription payments. Your card number never reaches our servers: it is handled directly by our payment processor, Stripe.
• Product data you enter to generate spec sheets (for example, ingredients, composition or manufacturer details). For this data, FichasDoc acts as a data processor on the customer's behalf, who remains the controller: see section 3.

3. Your role as controller of the product data you enter

When you use FichasDoc to generate spec sheets with data about your products, customers or suppliers, you are the controller of that processing and FichasDoc acts as processor, under Article 28 GDPR. This means FichasDoc processes that data solely on your instructions (to generate, store and deliver the document you request) and never uses it for its own purposes.

If your organization needs one, we make a data processing agreement (DPA) available on request — write to the contact address on this page.

4. Purposes and legal basis

• Providing the contracted service, managing your account and generating the documents you request — performance of a contract (Art. 6(1)(b) GDPR).
• Managing your subscription payments and complying with accounting and tax obligations — performance of a contract and compliance with a legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).
• Sending you service communications (account verification, security notices, service changes) — performance of a contract and legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR).
• Improving service security and preventing fraudulent use — legitimate interest (Art. 6(1)(f) GDPR).
• Sending you marketing communications about new features, when you have opted in — consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

5. Who we share your data with

We do not sell or share your data with third parties for commercial purposes. We only share data with the providers we need to deliver the service, acting as processors under contract in accordance with Article 28 GDPR:

• Stripe, Inc. — payment processing and billing.
• Hostinger — sending transactional emails (verification, password reset, invitations) and, where applicable, hosting.
• [PENDING: provider hosting the application servers and database, if different from the above].
• Public authorities, where there is a legal obligation to disclose data to them.

6. International transfers

Some of the providers listed above may be located outside the European Economic Area, or may transfer data there in the course of their business. In those cases, we make sure the transfer is covered by an appropriate safeguard under Chapter V GDPR (for example, standard contractual clauses approved by the European Commission or an adequacy decision).

7. How long we keep your data

• Account and organization data: for as long as the account is active, and after closure, for the period needed to address any legal liabilities.
• Generated documents and related files: for as long as the organization has an active subscription, and 30 days after cancellation or non-payment, after which they are deleted.
• Billing data: for the period required by applicable commercial and tax law (generally 6 years from the last accounting entry).

8. Your rights

You can exercise your rights of access, rectification, erasure, restriction of processing, portability and objection at any time, and withdraw your consent where processing is based on it, by writing to the contact address on this page and attaching a copy of an ID document.

If you believe the processing of your data does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the supervisory authority in your own country.

9. Security

We apply appropriate technical and organizational measures to protect your data: passwords are stored hashed, credentials for your connections to external systems are encrypted at rest, communications travel encrypted (HTTPS/TLS), and access to data within an organization is limited to what is needed to provide the service.

10. Minors

FichasDoc is a service aimed at businesses and professionals. It is not directed at minors and we do not knowingly collect data from minors.

11. Changes to this policy

We may update this privacy policy to reflect legislative developments or changes to the service. We will notify you of any material change, and the date of the last update always appears at the top of this page.