Privacy Policy
Last updated: 15.09.2026
This document explains what personal data Fakturcho processes, on what grounds, to whom it discloses it, and what rights each data subject has under the GDPR. The policy applies to the web application at https://www.fakturcho.com and to the businesses and individuals across the European Union who use it.
1. Data controller
The controller is Pacheliev Consulting EOOD, UIC 208697044, Sofia 1324, Lyulin district, bl. 715, entr. B, fl. 1, apt. 21, Bulgaria, email support@fakturcho.com.
For data the user enters about their own clients, the user is the controller and Fakturcho acts as a data processor on the user's instructions.
2. What data we process
Account data: email address, name, a cryptographically hashed record of the password, and the country of establishment given at signup.
Issuer data: company name, national company or VAT identifier, address, authorized representative, bank account, and the person who drew up the document. This data is printed on issued documents.
Client and document data: the recipient's name and identifiers, addresses, catalogue items, amounts and dates, as entered by the user.
Technical data: access logs, request time, request address and response code, kept for security and troubleshooting purposes.
Analytics data: anonymized, cookieless product-usage events (pages viewed, features used), collected through our self-hosted Umami analytics instance. This data cannot be linked back to an identified visitor and is never shared with any advertising network.
We do not process special categories of personal data and we do not carry out automated decision-making or profiling.
3. Purposes and legal grounds
Providing the service and maintaining the account — processing is necessary for performance of the contract with the user.
Processing payments and keeping the credit balance — performance of a contract and compliance with legal obligations.
Service security, abuse prevention and technical support — the controller's legitimate interest.
Understanding and improving the service through anonymized product analytics — the controller's legitimate interest, balanced by the fact that the data cannot identify a visitor.
Compliance with the accounting and tax obligations that apply to us as controller — a legal obligation.
4. Recipients and processors
Revolut — processes payments as the payment service provider. Receives the email address and payment data. Fakturcho does not store bank card data.
Railway Corporation — hosting of the application, the database, and our self-hosted analytics instance.
Resend, Inc. — sending transactional emails when the user chooses to send a document by email.
Where a recipient processes data outside the European Economic Area, the transfer is based on the standard contractual clauses adopted by the European Commission or another safeguard recognized by the GDPR.
We do not sell personal data and do not provide it for advertising purposes.
5. Retention periods
Account data and content entered by the user is retained for as long as the account exists.
After a deletion request, data is removed within thirty days, except for records we are legally required to keep.
Technical access logs are retained for up to twelve months.
6. Data subject rights
Every natural person has the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest.
These rights are exercised by a request to support@fakturcho.com. We reply within one month.
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg — or, under Article 77 of the GDPR, with the data protection supervisory authority of the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.
7. Cookies
We use only one strictly necessary cookie — a session cookie that keeps the account signed in. It is required for the service to work and does not require consent.
Our self-hosted product analytics (Umami) does not use cookies and does not track visitors across other sites. We do not use advertising or tracking cookies and do not embed third-party analytics scripts.
8. Security
Access to the application is password-protected and the connection is encrypted. Every account sees only its own data; separation is enforced at the database query level.
In the event of a security breach that creates a high risk to the rights of affected persons, we notify the Commission for Personal Data Protection and the affected persons within the applicable deadlines.