Privacy notice

Data controller

EduWell s.r.o., company ID 03407331, registered at Na Kuthence 825/13, Dejvice, 160 00 Praha 6, Czech Republic, is controller for account and service-operation data. Send privacy questions or requests to billing@factelo.app.

For personal data users enter about their customers, suppliers or contacts, the user is normally controller and EduWell s.r.o. acts as processor under the DPA.

Data we process

• Account: name, email, account identifiers, authentication and security events.
• Business: identity and contact details, address, tax and bank details, logo and settings.
• Invoicing: customers, contacts, line items, prices, notes, invoices, recurrence and payment status.
• Technical data: IP address, browser, request time, error logs and basic usage information.
• Communications: subject, message, recipient and invoice attachment when sending email.

Purposes and legal bases

• Providing the account and Factelo features: performance of a contract or pre-contract steps (Article 6(1)(b) GDPR).
• Security, abuse prevention and reliability: legitimate interests (Article 6(1)(f)).
• Accounting, tax and other mandatory records: legal obligation (Article 6(1)(c)).
• Optional marketing or non-essential tracking will be used only with valid consent where required.

Recipients and external services

• Amazon Web Services: Cognito, DynamoDB, S3, Lambda, API Gateway and SES; primary application data in eu-central-1.
• Vercel: hosting, server-side web functions, content delivery and technical logs.
• ARES and VIES: only data submitted when the user requests a company or VAT-number check.
• Geoapify: address query and country code only when address autocomplete is enabled and used.

International transfers

Vercel and some other providers may process technical or customer data outside the EEA, including in the United States. Where applicable, transfers rely on an adequacy decision, the EU–US framework, or Standard Contractual Clauses with supplementary safeguards.

Retention

• Account and active workspace data are retained while the service is used.
• After an account-closure request, data are deleted or anonymised without undue delay, except records required for legal duties, security or legal claims.
• Technical logs are kept only as reasonably needed for security and diagnosis; providers may apply their own limited retention periods.
• Backup or technical copies may persist for a limited period and are not used for ordinary operation.

Your rights

Depending on applicable law, you may request access, correction, erasure, restriction or portability and may object to processing. Consent may be withdrawn without affecting prior lawfulness. We normally respond within one month and may reasonably verify identity.

You may also complain to the Czech Office for Personal Data Protection (ÚOOÚ) or another competent supervisory authority.

Security and changes

We use access controls, encryption in transit, managed storage encryption and account separation. No system can be guaranteed absolutely secure. Material changes to this notice will be published here and notified where appropriate.