Privacy policy

Last updated: 26 October 2026

This policy explains which personal data we process when you visit this website, join the waitlist or use the faturi invoicing app.

1. Controller

ASISTO LLC
30 N Gould St, Ste R
Sheridan, WY 82801
USA

Represented by Sydney Pollak (Manager/Member)
Email: support@faturi.app

2. Hosting and server logs

The website and the app run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the data on our behalf.

When you open the website, the web server stores technically necessary access data: IP address, time, requested URL, status code, amount of data transferred, referrer and browser identifier (user agent). We use this data to deliver the website, find errors and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Connections to the website and the app are encrypted via HTTPS.

3. No cookies, no tracking on the website

The website sets no cookies, stores nothing in your browser and uses no analytics or tracking tools. Fonts and all other resources are loaded from our own server, not from third parties.

4. Waitlist

When you join the waitlist, we process your email address, the language of the page and the time you signed up and confirmed. Your sign-up only takes effect once you click the link in our confirmation email (double opt-in). We only write to you to let you know when faturi launches.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by emailing support@faturi.app. We then remove your data from the waitlist.

Emails are sent via Resend (see section 7).

5. Using the app

For your account we process your name, email address, password (stored only as a hash), the confirmation of your email address and, if you enable it, your two-factor sign-in data. For each session we store the IP address and browser identifier so that sessions can be managed and abuse detected. Sign-ins and changes to your password or two-factor settings are recorded in a security log.

If you sign in with Google, GitHub or Apple, the provider sends us your name, email address and, where available, your profile picture. The provider’s privacy policy also applies.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR); for session data and the security log, our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

Cookies and browser storage

The app only sets technically necessary cookies:

Session cookies (prefix faturi_v2) for sign-in. A session expires after 7 days without use.
faturi_active_tenant remembers the workspace you last selected, 30 days.
faturi_theme remembers your display setting, 1 year.
faturi_locale remembers your language.

The app also keeps interface settings in your browser’s local storage (for example whether the sidebar is collapsed) and holds an invitation until you have signed in. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as this storage is strictly necessary for the service you requested.

Your business data

In faturi you enter data about your business and your clients: names, addresses, VAT IDs, contacts, invoices, quotes and payment details. You are the controller for this data; we process it on your behalf (Art. 28 GDPR). The data is stored in a PostgreSQL database and on the file system of our servers at Hetzner.

Sent invoices cannot be changed or deleted, only cancelled. This helps you meet your statutory retention obligations.

When you share an invoice or quote via a link, anyone with the link can open the document. The link is blocked for search engines, and you can renew it at any time. For quotes, we store when and how often the recipient opened the quote and, where given, their reply and comment. The sender can see this information. Requests are recorded in our API log (section 6), without IP address.

Company search, VAT ID check and exchange rates

When you add a client, you can search for companies and check VAT IDs. Our server sends the search term to GLEIF (Global Legal Entity Identifier Foundation, Switzerland) and the VAT ID to the European Commission’s VIES system. For exchange rates, the server only sends currency codes to Frankfurter (api.frankfurter.dev). Your IP address is not passed on.

AI assistance for invoice templates

When you have a template created with AI, we send the website you enter (header, stylesheets, logo) and any logos or brand images you upload to OpenRouter (USA), which forwards the request to a language model. We require that requests are neither stored nor used for training. We send no invoice or client data, and only a pseudonymous identifier instead of your name. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

API, MCP interface and webhooks

With API tokens and the MCP interface, programs such as Claude or Cursor can access faturi on your behalf. We store tokens only as a hash. Webhooks send event data to the addresses you enter yourself. What the program on the other end does with the data is your responsibility and subject to its own terms.

6. Logs

We log requests to the API, the MCP interface and share links with method, path, status code, duration, time, workspace, user and token, but not the IP address. The purpose is troubleshooting and detecting abuse (Art. 6(1)(f) GDPR).

7. Sending emails

Emails from the app (email confirmation, password reset, invitations, invoices, quotes, payment reminders) and from the waitlist are sent via Resend (USA). Resend processes the recipient address, subject, content and attachments on our behalf.

8. Recipients and transfers to third countries

We only share data with the service providers and bodies named in this policy. We do not sell data or use it for advertising.

We ourselves are based in the USA, as are Resend and OpenRouter. For transfers to the USA we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

9. Retention

Website server logs: until the web server’s routine deletion.
Waitlist: until faturi launches or until you withdraw your consent.
Account and business data: as long as your account exists. We then delete the data unless statutory retention obligations require otherwise.
Sessions: 7 days after last use.
Security log: as long as the related workspace exists.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)). Write to us at support@faturi.app.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work (Art. 77 GDPR).

11. Required data, no automated decisions

To use the app we need at least your name, email address and password, or a sign-in via one of the providers named above. Without this data we cannot create an account. We make no automated decisions within the meaning of Art. 22 GDPR and do not create profiles.

12. Changes

We update this policy when our service or the law changes. The version published here applies.